Privacy Policy — Practice Perfect

1. Who we are

Practice Perfect ("we", "us", "our") is operated by VIRA with registered office at A-78, Maharani Enclave, Uttam Nagar, Delhi 110059, India.

For DPDPA purposes:

When you use the consumer Practice Perfect app, we are the Data Fiduciary.
When your school provides Practice Perfect to you, your school is the Data Fiduciary and we are the Data Processor acting on the school's behalf. This Privacy Policy still describes what happens to your data; queries about whether data is collected should be raised with your school.

2. What data we collect

Category	Examples	Source
Account identifiers	name, email, password (hashed), date of birth, school code, grade, section; mobile number where your school provides it	You, at registration, or your school's roster
Learning activity	answers to practice questions, time taken, confidence level, mistakes, mastery scores, mastery streaks	Your use of the app
Exam integrity (school exams only)	during a teacher-set exam taken in a web browser, we record events such as leaving full screen, switching tabs, or attempting to copy — so your teacher can see whether exam conditions were kept	Your browser, during an exam only
Technical	IP address and standard server request logs	Automatic, when you use the service
Parental contact (minors only)	parent's name, email, mobile — for §9 consent and §13 grievance routing	You / your school
Optional	support-ticket messages	Only if you provide

This data is linked to you personally, not anonymous. That is deliberate: the product exists to show you the right next question, and to show your teacher where you need help. We do not attempt to make it anonymous while your account is active, because doing so would break the service.

We do not collect: contacts, calendar, location (GPS), microphone, camera, photos, biometric data, advertising identifiers, installed-app lists, web browsing history outside our own service, or financial / payment-card data (payments are made on our website through Razorpay; you transact with them directly).

The app does not contain any advertising, analytics or crash-reporting SDK. It does not send us your device model, OS version, or usage telemetry.

3. Why we collect it (purpose)

Purpose	Legal basis (DPDPA)
Show you the right practice questions and track mastery	Consent (§7); legitimate use (§7(b)) for school deployments
Show your teacher and principal how your class is doing, so they can teach to the gaps	Legitimate use (§7(b)) — school deployments
Authenticate your login + secure your account	Consent + security obligation
Send essential service messages (account verification, password reset, grievance acknowledgements)	Consent / legal obligation
Keep school exams fair (see "Exam integrity" in §2)	Legitimate use (§7(b)) — school deployments
Respond to your DPDPA requests (data export / deletion / grievance)	Legal obligation (§§11–13)

Yes, we analyse your learning behaviour — that is the service. We look at which questions you get wrong and why, to decide what to show you next and to tell your teacher where you are stuck.

We do not use your data for advertising, ad-targeting, building a profile of you for anyone outside your own school, profiling for credit or insurance, or sale to third parties. We show no ads of any kind.

4. Children under 18 — §9 of DPDPA

If you are under 18:

Your account requires verifiable consent from a parent or legal guardian before activation. In school deployments, your school collects this consent on our behalf using the §9 consent form supplied to the principal.
We record which version of this notice was accepted when your account was created.
We do look at how you answer questions — that is how the app decides what to teach you next, and how your teacher sees where you are stuck. We do not use it for anything else: no advertising, no ad-targeting, no profiling for any third party, and no ads of any kind anywhere in the app.
Your parent / guardian may request your data, ask us to delete your account, or raise a grievance at any time via the Privacy & data screen in the app, or by writing to our grievance officer (§9).

5. Who we share data with

We share data only with the following categories of recipients, and only as needed:

Your school (school deployments) — your teachers and principal can see the learning progress of students in the classes they teach.
Hostinger (our hosting provider, India region) — stores the database and application servers.
Google — only if you choose "Sign in with Google". Google then receives the sign-in request and confirms your identity to us. If you register with an email and password instead, Google receives nothing.
Razorpay (payments processor) — only when you make a purchase on our website; we share only the amount and an order ID. Razorpay collects your payment-card data directly under its own privacy policy.
Law-enforcement / regulators — only when compelled by a valid legal order under Indian law.

That is the complete list. We use no advertising networks, no analytics vendors, and no crash-reporting or attribution services.

We do not sell, rent, or trade your personal data.

6. Where data is stored

All personal data is stored in India (Hostinger's Mumbai region).
Backups are stored in the same region on encrypted volumes.
We do not transfer your personal data outside India. The only overseas processing that can occur is Google's own handling of a "Sign in with Google" request, if you choose that option, under Google's privacy policy.

7. How long we keep it

Data category	Retention
Active account (you log in within 12 months)	For as long as the account is active
Inactive account (no login for 12 months)	Anonymised after 12 months; full delete after 24 months
Account-deletion request	PII scrubbed immediately; account hard-deleted after 30 days (DPDPA §12 grace period)
Learning answers (after anonymisation or deletion)	Retained without identifiers for service-improvement research
Server logs	90 days
Backups	35 days rolling

8. Security

Passwords stored as bcrypt hashes — we cannot read them in plaintext.
Mobile auth tokens stored in Android's encrypted KeyStore (AES-256-GCM).
All API traffic over HTTPS / TLS 1.2+.
Database backed up daily to an off-server location.
Periodic security review of access controls; see security-checklist.md.

9. Your rights (DPDPA §§11–13)

You can do these from the Privacy & data screen in the app, or by emailing our Grievance Officer:

Right	What it does	How to exercise
§11 — Access	Download a copy of all data we hold about you	Tap "Download a copy of my data"
§12 — Erasure	Delete your account and personal data	Tap "Delete my account"
§13 — Grievance	Raise a complaint about how we handle your data	Tap "Raise a privacy concern"

We acknowledge grievances within 7 working days (statutory SLA).

Parents of minors exercise these rights on the child's behalf.

10. Grievance Officer

If you have used a school-flavor app, the §13 grievance routes to your school's appointed officer (typically the principal). The app surfaces the correct officer based on your school code.

11. Updates to this policy

We may update this policy. When we do:

The version number at the top of this page changes.
For material changes, we ask you to re-accept on your next login.
Previous versions are archived at docs/legal/archive/.

12. Contact us

For privacy questions: privacy@practiceperfect.in For support questions: support@practiceperfect.in