PRIVACY POLICY

1. Who we are and what this policy covers

Prepzy.ai is an AI-powered learning and assessment platform for CBSE students in Classes 6 to 12 and for NEET-UG aspirants. It is operated by GlobusLearn Services India Private Limited ("GlobusLearn", "we", "us" or "our"), a private limited company incorporated in India.

Under India's Digital Personal Data Protection Act, 2023, GlobusLearn is the Data Fiduciary for the personal data described in this policy. This policy applies when you use:

• our website at prepzy.ai and the learning platform at app.prepzy.ai;
• the Prepzy mobile apps for Android and iOS;
• messages we send by SMS, WhatsApp or email, and our customer support channels.

Together these are called the "Services". Section 17 explains how responsibilities are shared when a school or government body enrols students.

2. Words we use

3. Laws we follow

We process personal data in accordance with the laws of India, including:

• the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the Digital Personal Data Protection Rules, 2025, as their provisions come into force;
• the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, to the extent they continue to apply;
• the Consumer Protection Act, 2019 and the Consumer Protection (E-Commerce) Rules, 2020;
• directions issued by CERT-In on cyber security incident reporting and log retention.

If you use the Services from outside India, your data is still processed under this policy and Indian law.

4. Students and parents

Most Prepzy.ai students are children. We have designed our data practices around that fact.

4.1 Parental involvement

Students under 18 should use the Services only with the knowledge and consent of a parent. When a parent creates an account for a student under 18, or allows one to be created, the parent consents on the student's behalf to the processing described in this policy.

We are introducing a process to verify parental consent in line with the Digital Personal Data Protection Rules, 2025, and will update this policy when it is in place. If a parent tells us that their child's account was created without consent, we will close the account and erase the child's data, unless the law requires us to keep it.

4.2 What we never do with students' data

Because we do not ask students their age at sign-up, we apply these protections to every student account:

• We do not show targeted or behavioural advertising to students.
• We do not track or monitor students' behaviour to build advertising or marketing profiles.
• We do not sell, rent or trade students' data, or share it with data brokers.
• We do not make students' profiles, scores or answers public.
• We do not process students' data in any way likely to harm their well-being.

4.3 Learning analytics

To teach effectively, the Services record how a student learns: lessons watched, questions attempted, scores and progress. We use this only to personalise learning, report progress to the student and parent, and improve our teaching content. We never use it for advertising.

4.4 Parent rights

A parent can see the student's progress through the student's account and can exercise every right in section 15 on the student's behalf, including withdrawing consent and deleting the account, by writing to contact@prepzy.ai.

5. Personal data we collect

We collect the following data. Items marked optional are not required to use the Services.

6. Data we do not collect

We do not ask for and do not collect:

• biometric data such as fingerprints, face scans or voiceprints;
• precise GPS location;
• your contacts, call logs, SMS messages or calendar;
• Aadhaar numbers, PAN or other government identity numbers;
• information about caste, religion, health, sexual orientation or political opinions.

The app asks for only two device permissions: the camera or photo library, when you choose to upload an image such as an answer sheet, and the microphone, when you choose to ask a doubt by voice. You can refuse either permission and still use the rest of the Services.

7. Why we use your data

We process personal data only for the purposes below. We rely on your consent (or a parent's consent for a child), or on a legitimate use permitted by section 7 of the DPDP Act where stated.

If we want to use personal data for a new purpose, we will tell you and, where required, ask for fresh consent first.

8. AI features

Prepzy.ai uses artificial intelligence to explain concepts, answer doubts, generate practice questions and evaluate written answers.

• Who processes it. Doubts, uploaded answers and the learning context needed to answer them are sent to AI model providers that act as our Data Processors under contract.
• No training by providers. We use AI providers only under terms that do not permit them to use Prepzy.ai user data to train their own models.
• Minimum data. We send only what is needed to answer the request, and we do not send students' names, phone numbers or email addresses with their doubts.
• Our own improvement. We may use de-identified doubts and answers to improve explanations and question quality. We do not use identifiable students' data to train AI models.
• Accuracy. AI responses can contain mistakes. You can report an error on any answer, and solutions and notes published on our website are reviewed by subject experts.
• No decisions with legal effect. AI evaluation produces practice feedback and scores only. It does not decide admissions, certification or any outcome with legal effect.

9. Cookies and analytics

Cookies and similar technologies are small files or identifiers stored on your device.

You can block or delete analytics cookies at any time in your browser settings. Blocking essential cookies may stop parts of the Services from working.

10. Who we share data with

We do not sell or rent personal data. We share it only as described here, and only as much as each recipient needs.

10.1 Data Processors working for us

These companies process data on our instructions under written contracts that require confidentiality and security and prohibit use for their own purposes. You can ask us for a current list of our Data Processors at contact@prepzy.ai.

10.2 Others

• Parents see their child's progress and account details.
• Schools and government programmes that enrolled a student receive that student's progress reports, as set out in section 17.
• Authorities receive data only when required by law, a court order or a lawful request, and only what is required.
• Professional advisers such as auditors and lawyers, under confidentiality obligations.
• A successor business in a merger, acquisition or sale of assets, which must continue to protect the data under this policy. We will notify you before your data becomes subject to a different policy.

11. Where data is stored

We store personal data on servers in India, in the Mumbai region. If a Data Processor needs to process data outside India to provide its service, we transfer data only to countries not restricted by the Central Government under section 16 of the DPDP Act, and only to processors bound by contracts that require protection at least equal to this policy.

12. How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires. After that, we erase it or irreversibly de-identify it.

13. Deleting your account

You can delete your account at any time:

• on the web, from your profile at app.prepzy.ai/profile, which also works if you no longer have the app;
• by emailing contact@prepzy.ai from your registered email address or quoting your registered mobile number.

A parent can ask us to delete a student's account. Refunds for paid plans follow our refund and cancellation policy.

14. How we protect data

We use reasonable security safeguards, including:

• encryption of data in transit using HTTPS;
• role-based access, so staff see only the data their job needs, with access logged;
• security assessment of Data Processors before we use them;
• regular backups, vulnerability testing and staff training on data protection.

If a breach happens

If personal data is breached, we will act to contain it, report it to the Data Protection Board of India and to CERT-In within the timelines the law sets, and inform affected users (and parents of affected students) without delay, explaining what happened, the likely impact, what we are doing and what you can do.

15. Your rights

Under the DPDP Act you have the right to:

How to make a request

Email contact@prepzy.ai from your registered email address, or quote your registered mobile number. We may ask you to confirm your identity, for example with a one-time password sent to that number. A parent makes requests for a student under 18. We do not charge for requests.

16. Messages we send

• Service messages such as OTPs, receipts, refund updates, and plan expiry reminders sent 7 days and 1 day before expiry by email and WhatsApp. These are part of the Services.
• Marketing messages about new courses or offers, sent only to adult users and parents who have opted in. You can opt out at any time using the unsubscribe link in an email, by replying STOP on WhatsApp, or by writing to contact@prepzy.ai.

We follow the Telecom Regulatory Authority of India's rules on commercial communications, including Do Not Disturb preferences.

17. Schools and government programmes

Schools, education departments and government programmes may provide Prepzy.ai to their students. In these cases the institution and GlobusLearn act as joint Data Fiduciaries, because together we decide why and how students' data is processed under the programme.

• The institution decides which students to enrol, provides limited student details (name, class, section and enrolment ID) to create accounts, and is responsible for informing students and parents and obtaining any consent needed for enrolment.
• GlobusLearn is responsible for processing that data on the platform in line with this policy, keeping it secure, and honouring students' and parents' rights.
• The institution receives progress and usage reports for its students, and nothing beyond what our agreement with it specifies.
• We never use institutionally provided data for marketing.

Students and parents in such programmes keep every right in section 15 and can contact either the institution or our Grievance Officer. We will coordinate with the institution to respond.

18. Third-party sites and content

The Services may link to or embed content from other services, such as YouTube videos, app stores and our social media pages. Those services have their own privacy policies, and we are not responsible for their practices. Please read their policies before giving them personal data.

19. Changes to this policy

We may update this policy when our Services or the law change. For significant changes we will notify you by email, SMS or in-app message at least 15 days before they take effect and, where required, ask for fresh consent. The "Last updated" date at the top shows the current version.

20. Grievance Officer and contact

For any question, request or complaint about personal data, contact our Grievance Officer:

If your complaint is not resolved to your satisfaction, you may complain to the Data Protection Board of India.

This policy is written in English. If we provide it in another language and there is a difference in meaning, the English version prevails.