Privacy Policy
## PRIVACY POLICY
Effective date: 2026-10-24
1. Introduction
Welcome to Prepzo.
Prepzo (“us”, “we”, or “our”) operates https://www.prepzo.study/ (hereinafter referred to as “Service”).
Our Privacy Policy governs your visit to https://www.prepzo.study/, and explains how we collect, safeguard and disclose information that results from your use of our Service.
We use your data to provide and improve Service. By using Service, you agree to the collection and use of information in accordance with this policy. Unless otherwise defined in this Privacy Policy, the terms used in this Privacy Policy have the same meanings as in our Terms and Conditions.
Our Terms and Conditions (“Terms”) govern all use of our Service and together with the Privacy Policy constitutes your agreement with us (“agreement”).
2. Definitions
SERVICE means the https://www.prepzo.study/ website operated by Prepzo.
PERSONAL DATA means data about a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession).
USAGE DATA is data collected automatically either generated by the use of Service or from Service infrastructure itself (for example, the duration of a page visit).
COOKIES are small files stored on your device (computer or mobile device).
DATA CONTROLLER means a natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal data are, or are to be, processed. For the purpose of this Privacy Policy, we are a Data Controller of your data.
DATA PROCESSORS (OR SERVICE PROVIDERS) means any natural or legal person who processes the data on behalf of the Data Controller. We may use the services of various Service Providers in order to process your data more effectively.
DATA SUBJECT is any living individual who is the subject of Personal Data.
THE USER is the individual using our Service. The User corresponds to the Data Subject, who is the subject of Personal Data.
3. Information Collection and Use
We collect several different types of information for various purposes to provide and improve our Service to you.
4. Types of Data Collected
Personal Data
When you create and use an account, we collect the following personally identifiable information (“Personal Data”):
0.1. Your name and email address. If you sign up with Google, we receive these from Google; we do not receive your Google password.
0.2. The examination and level you are preparing for, which you choose during setup.
0.3. A record that you accepted our Terms and Conditions and this Privacy Policy: the date and the version you accepted.
0.4. Cookies and Usage Data, described below.
We do not ask for your phone number, postal address, date of birth or government identifiers.
We will only send you newsletters, marketing or promotional material if you have chosen to receive it. You may withdraw that consent at any time using the unsubscribe link in any such message or by emailing support@prepzo.study. Messages needed to operate your account, such as confirmations, password resets, receipts and subscription notices, are not marketing and are sent regardless.
Study Material You Upload
Service lets you upload your own study material — notes, documents, images and past or mock examination papers — and photographs of your own handwritten answers ("Your Uploads"). We store Your Uploads, and the content we derive from them, in order to provide Service to you. Answer photographs are kept in private storage that only your account can access.
To generate questions, flashcards, cheatsheets, tutor responses and answer evaluations, the contents of Your Uploads are sent to a third-party artificial intelligence provider, Google, for processing through its Gemini API. Your answers to practice questions, whether typed or photographed, are sent in the same way when you ask for them to be evaluated. Your messages to the AI Teacher are sent in the same way. Google processes this content in order to return a result to us. Do not upload material you would not want processed in this way, and avoid including personal or confidential information that is not needed for your studies.
Your Uploads themselves are private to your account. Other users cannot see the files you upload, your answers, your scores or your study history.
Material we generate from an uploaded file may, however, be reused for another user who uploads an identical file. To avoid repeating the same processing, we store generated material against an identifier derived from the file's contents, and serve it again rather than regenerating it. This applies only to byte-for-byte identical files and only to material generated by Service. We keep that generated material for as long as at least one user still holds the corresponding file; once no user does, it is deleted. See section 9 of our Terms and Conditions.
You can delete Your Uploads at any time from within Service, which also removes the stored file and retires the content generated from it. Deleting your account removes Your Uploads and their derived content.
Usage Data
We may also collect information that your browser sends whenever you visit our Service or when you access Service by or through any device (“Usage Data”).
This Usage Data may include information such as your computer’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.
When you access Service with a device, this Usage Data may include information such as the type of device you use, your device unique ID, the IP address of your device, your device operating system, the type of Internet browser you use, unique device identifiers and other diagnostic data.
Tracking Cookies Data
We use cookies and similar tracking technologies to track the activity on our Service and we hold certain information.
Cookies are files with a small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Other tracking technologies are also used such as beacons, tags and scripts to collect and track information and to improve and analyze our Service.
You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.
Examples of Cookies we use:
0.1. Session Cookies: We use Session Cookies to operate our Service.
0.2. Preference Cookies: We use Preference Cookies to remember your preferences and various settings.
0.3. Security Cookies: We use Security Cookies for security purposes.
0.4. Analytics Cookies: Google Analytics sets cookies to measure how Service is used, as described in section 14.
Study Activity
We store your practice answers, scores, flashcard reviews, mock test attempts and AI Teacher conversations so that Service can schedule your reviews and, on paid plans, show your study history.
Referral Data
If you subscribe using a referral code, we record which code you used, the discount applied and the payments made on that subscription, so that the discount can be applied once per email address and the code owner's commission can be calculated. We do not give the code owner your name or email address.
5. Use of Data
Prepzo uses the collected data for various purposes:
0.1. to provide and maintain our Service;
0.2. to notify you about changes to our Service;
0.3. to allow you to participate in interactive features of our Service when you choose to do so;
0.4. to provide customer support;
0.5. to gather analysis or valuable information so that we can improve our Service;
0.6. to monitor the usage of our Service;
0.7. to detect, prevent and address technical issues;
0.8. to fulfil any other purpose for which you provide it;
0.9. to carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection;
0.10. to provide you with notices about your account and/or subscription, including expiration and renewal notices, email-instructions, etc.;
0.11. to provide you with news, special offers and general information about Service, only if you have chosen to receive it;
0.12. in any other way we may describe when you provide the information;
0.13. for any other purpose with your consent.
6. Retention of Data
We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.
We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.
7. Transfer of Data
Service is offered only in India, and your account data is stored with our
hosting and database provider on infrastructure located in India.
Some processing necessarily takes place outside India. In particular, the
contents of Your Uploads and the answers you submit for evaluation are sent to
Google for processing through its Gemini API, as described in section 4, and
may be processed on infrastructure outside India. Payment processing is carried
out in India by Razorpay.
The DPDP Act permits transfer of personal data outside India except to
territories restricted by the Central Government, and we do not transfer
personal data to any such territory. Your consent to this Privacy Policy,
followed by your use of Service, represents your agreement to the processing
described here.
Prepzo will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organisation or a country unless there are adequate controls in place including the security of your data and other personal information.
8. Disclosure of Data
We may disclose personal information that we collect, or you provide:
0.1. Disclosure for Law Enforcement.
Under certain circumstances, we may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities.
0.2. Business Transaction.
If we or our subsidiaries are involved in a merger, acquisition or asset sale, your Personal Data may be transferred.
0.3. Other cases. We may disclose your information also:
0.3.1. to our subsidiaries and affiliates;
0.3.2. to contractors, service providers, and other third parties we use to support our business;
0.3.3. to fulfill the purpose for which you provide it;
0.3.4. for any other purpose disclosed by us when you provide the information;
0.3.5. with your consent in any other cases;
0.3.6. if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our customers, or others.
9. Security of Data
The security of your data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.
10. Service Is Offered in India Only
Service is intended for, and offered only to, individuals resident in India. It
is not directed at, and we do not knowingly provide Service to, individuals
located outside India. Prices are quoted in Indian Rupees and payments are
collected in India.
If you access Service from outside India, you do so on your own initiative and
are responsible for compliance with any local law that applies to you.
11. Your Rights Under the Digital Personal Data Protection Act, 2023
The Digital Personal Data Protection Act, 2023 ("DPDP Act") applies to our
processing of your personal data. Under it, we are the Data Fiduciary that
determines how your personal data is processed, and you are the Data Principal
to whom that data relates.
11.1. Basis for processing. We process your personal data on the basis of
the consent you give when you create an account and use Service, and for the
legitimate uses permitted by the DPDP Act, such as processing data you
voluntarily provide for a purpose you have not objected to. We ask for your
consent through a clear notice and process your data only for the purposes
described in this Privacy Policy.
11.2. Right to access information. You may ask us for a summary of the
personal data we process about you, the processing activities we undertake,
and the identities of any other Data Fiduciaries and processors with whom we
have shared it.
11.3. Right to correction and erasure. You may ask us to correct inaccurate
or misleading personal data, to complete incomplete data, to update it, and
to erase personal data that is no longer needed for the purpose it was
collected for. You can correct most of your details yourself in your account
settings, and you can delete your account and its associated data from there
at any time.
11.4. Right to withdraw consent. You may withdraw your consent at any time,
as easily as you gave it. Withdrawing consent does not affect the lawfulness
of processing carried out before the withdrawal. If you withdraw consent for
processing that is necessary to provide Service, we will stop providing
Service to you and delete your account data, subject to any retention we are
required by law to apply.
11.5. Right of grievance redressal. You may raise a grievance with our
Grievance Officer, whose details are in section 20. We will respond within
the timelines set out there. You are required to raise your grievance with us
before approaching the Data Protection Board of India.
11.6. Right to nominate. You may nominate another individual to exercise
your rights under the DPDP Act on your behalf in the event of your death or
incapacity. Contact us to record a nomination.
11.7. Your duties. The DPDP Act requires you not to impersonate another
person when providing personal data, not to suppress material information
when providing it, and not to register a false or frivolous grievance.
11.8. Complaints. If you are not satisfied with our response to a grievance,
you may complain to the Data Protection Board of India.
12. Children
Service is intended only for individuals aged eighteen (18) or over, and we do
not knowingly collect personal data from children. The DPDP Act requires
verifiable parental consent before processing the personal data of a child, and
prohibits tracking, behavioural monitoring and targeted advertising directed at
children. Because we do not offer Service to anyone under 18, we do not process
children's personal data. If you believe a child has provided us with personal
data, contact us and we will delete it.
13. Service Providers
We may employ third party companies and individuals to facilitate our Service (“Service Providers”), provide Service on our behalf, perform Service-related services or assist us in analysing how our Service is used.
These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose. They are:
0.1. Supabase, which hosts our database, account sign-in and file storage;
0.2. Google, which processes Your Uploads, answers and AI Teacher messages through its Gemini API (section 4), provides Google sign-in if you choose it, and provides analytics (section 14);
0.3. Razorpay, which processes payments (section 17); and
0.4. our website hosting provider, which serves Service and keeps short-lived technical logs.
14. Analytics
We use Google Analytics, loaded through Google Tag Manager, to understand how Service is used — for example which pages are visited and for how long. Google Analytics uses cookies and receives Usage Data such as your IP address, browser and device type. It does not receive Your Uploads, your answers or your payment details. You can block these cookies in your browser settings or with Google's opt-out add-on at https://tools.google.com/dlpage/gaoptout without affecting your use of Service.
15. CI/CD tools
We may use third-party Service Providers to automate the development process of our Service.
16. Advertising
We do not show advertisements in Service and do not use your data for behavioural advertising or remarketing.
17. Payments
Service is offered on a free plan and on paid subscription plans that renew automatically until cancelled.
Payments are processed by Razorpay, a third-party payment processor. You provide your payment details directly to Razorpay, and its privacy policy governs how it handles them.
We do not collect, see or store your full card number, CVV or bank credentials. We store only what we need to manage your subscription: the plan and billing cycle you chose, the amount charged, the current period dates, the subscription and payment identifiers issued by Razorpay, any referral discount applied, and whether the subscription is active or cancelled.
We also record how much of your plan allowance you have used — for example the number of uploads this month or AI Teacher messages today — so that plan limits can be applied.
18. Links to Other Sites
Our Service may contain links to other sites that are not operated by us. If you click a third party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.
We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.
19. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.
We will let you know via email and/or a prominent notice on our Service, prior to the change becoming effective and update “effective date” at the top of this Privacy Policy.
You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
20. Contact Us and Grievance Officer
If you have any questions about this Privacy Policy, contact us by email at
support@prepzo.study.
For any grievance regarding the processing of your personal data, or to
exercise a right under section 11, contact our Grievance Officer, whose details
are published in accordance with the Digital Personal Data Protection Act, 2023
and the Information Technology Act, 2000:
Name: S. Srihitha
Email: sri@prepzo.study
Address: Manasarovar Heights Road, RTC Colony, Tirumalagiri,
Secunderabad, Hyderabad, Telangana 500015, India
We will acknowledge your grievance within twenty-four (24) hours of receipt and
resolve it within fifteen (15) days, in accordance with the Information
Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
Service is operated by Prepzo, a sole proprietorship of S. Srihitha
registered under the Udyam Registration scheme, having its registered office
at Manasarovar Heights Road, RTC Colony, Tirumalagiri, Secunderabad,
Hyderabad, Telangana 500015, India.