Privacy Policy

PrepClever and its Android apps — NISMReady, PrepClever - IC-38 (package com.gritlabs.ic38) and PrepClever - JAIIB + CAIIB (package com.gritlabs.jaiibcaiib) — are published on Google Play under the developer name PrepClever and are operated by Grit Labs AI, a business based in India. In this policy "we", "us" and "our" mean Grit Labs AI; "the Services" means the prepclever.in website, the app.prepclever.in web app, these mobile apps and everything you can buy through them. We are the data fiduciary for the personal data described below. You can reach us any time at [email protected].

We collect only what the Services need to work, in four groups:

• Account information — your name, email address and mobile number when you sign up or verify with an OTP. If you sign in with Google, we receive your name, email address and profile picture from Google, and nothing else.
• Learning data — the exam you are preparing for, your target date, language preference, questions attempted, mock-test scores, time spent, streaks and your Preparedness Score. This is what makes the practice adaptive; without it the product cannot personalise anything.
• Payment information— the fact of a purchase, the exam it was for, the amount and the payment reference. Card numbers, UPI IDs, net-banking credentials and CVVs are entered on Razorpay's checkout and never reach our servers.
• Technical and usage data — IP address, browser and device type, operating system, app version, referring URL, the pages you view, and the marketing campaign that brought you here (utm parameters, Google click id, Meta click id). App installs also record a crash log when something breaks.

We do not collect financial account details, government identity numbers, biometric data, health data, precise location, contacts or photos.

We use the information above to:

• Create and secure your account, and verify it by OTP.
• Deliver the lessons, question banks and mock tests you have access to.
• Generate adaptive practice, performance analytics and study recommendations — this is the core of the product.
• Process payments and grant, extend or expire access to a paid exam.
• Send you service messages: OTPs, receipts, access-expiry reminders and, if you have opted in, study reminders and product updates. You can stop marketing messages at any time.
• Answer your support requests and act on your feedback.
• Detect and prevent fraud, abuse, and technical faults.
• Understand which pages and adverts work, in aggregate, so we spend our marketing budget on what actually helps learners find us.
• Meet our legal and tax obligations in India.

We do not use your learning data to make automated decisions that have a legal effect on you, and we do not profile you for anyone else's purposes.

Where the law requires a basis for processing, we rely on: your consent (analytics and advertising cookies, marketing messages); performance of our contract with you (running your account, delivering a course you paid for); our legitimate interests in keeping the Services secure and improving them; and compliance with legal obligations such as tax and accounting rules. You can withdraw consent at any time — see Your rights and choices.

We do not sell your personal information, and we never have. We share it only with the service providers who make the Services run, each of them processing it on our instructions:

• Razorpay — payment processing. Razorpay is the controller of your card and UPI details, under its own privacy policy.
• Supabase — the database and authentication behind your account and your progress, hosted in the Asia-Pacific region.
• Google (Analytics 4, Ads), Meta (Pixel) and Microsoft Clarity — website and app measurement, and attribution for our adverts. These see pseudonymous identifiers and page activity, not your name or your answers.
• PostHog — product analytics on which features are used.
• Railway and Cloudflare — hosting, content delivery and protection against attacks.
• Google Play — distribution and, for in-app purchases, billing.

Beyond that we disclose information only where the law requires it, to protect our rights or someone's safety, or as part of a merger or sale of the business — in which case this policy continues to apply to the data transferred.

We use three kinds of cookie:

• Essential — sign-in sessions and security. The Services do not work without these.
• Analytics — Google Analytics, PostHog and Microsoft Clarity, which tell us which pages people read and where they get stuck.
• Advertising — Google Ads and the Meta Pixel, which let us see that an advert led to a signup and stop showing adverts to people who already bought.

We also store the campaign parameters from the link you arrived on for up to 30 days, so a purchase can be attributed to the right advert. You can clear or block cookies in your browser at any time; essential ones are all that is needed to study and pay.

We keep your account and learning data for as long as your account exists, so that returning after a break does not mean starting over. If you ask us to delete your account we remove your personal data within 30 days, except records we are legally required to retain — payment and tax records are kept for eight years as Indian law requires. Anonymous, aggregated statistics that cannot identify you may be kept indefinitely.

Traffic to and from the Services is encrypted in transit (HTTPS). Data at rest sits in managed databases with access restricted to the few people who need it. Payments are handled by a PCI-DSS compliant processor, so we never hold card data. No system is perfectly secure and we will not pretend otherwise — if a breach ever affects your personal data, we will tell you and the relevant authority promptly.

You can ask us to:

• Give you a copy of the personal data we hold about you.
• Correct anything that is wrong or out of date.
• Delete your account and the personal data attached to it.
• Stop sending you marketing messages, without affecting service messages.
• Withdraw a consent you previously gave.
• Nominate someone to exercise these rights if you die or become incapacitated.

Email [email protected] from the address on your account. We acknowledge within 1 working day and complete the request within 30 days. There is no charge. You can also edit your profile and notification settings inside the app at any time.

The Services are built for candidates sitting professional certification exams and are intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to us and we will delete it.

Your data is stored primarily in India and the wider Asia-Pacific region. Some of the service providers listed above process data in other countries, including the United States and the European Union. Where that happens we rely on the provider's standard contractual protections for international transfers.

The Services link to third-party sites — NISM, SEBI, IIBF and IRDAI among them — so you can check official information at the source. Those sites have their own privacy policies and we are not responsible for what they do with your data.

We may update this policy as the Services change or the law changes. The "Last updated" date at the top of this page always reflects the current version, and material changes will be announced in the app or by email before they take effect. Continuing to use the Services after a change means you accept the updated policy.

For any question about this policy, a data request, or a complaint about how we have handled your information, write to [email protected]with "Grievance" in the subject line. We acknowledge every grievance within 1 working day and resolve it within 30 days.

If you are not satisfied with our response you may escalate to the relevant data-protection authority in India. This policy is governed by the laws of India, and the courts at New Delhi, India have exclusive jurisdiction over any dispute arising from it.

See also our Terms of Use, Refund & Cancellation Policy and Contact page.