Privacy policy

Last updated: 20 October 2026

Overview

This Privacy policy explains how Upendra Competition Institute (“we”, “us”) collects, uses, and shares personal information when you use our exam preparation service. The service is India-first but may be accessed from other countries. The operator of Upendra Competition Institute is responsible for this policy.

What we collect

We collect information you provide and information generated when you use the service:

Account and identity: name, email address, and Google account subject identifier when you sign in with Google OAuth (or mock sign-in in development)
Learning activity: test attempt answers, scores, timestamps, and lesson or course progress
Session and security: session cookies and similar tokens to keep you signed in and protect the service
Preferences: theme or display preferences stored locally or in cookies (see our Cookie policy)
Technical data: basic server logs (such as IP address, user agent, and request timestamps) needed for security and troubleshooting

We do not run product analytics tools at this time. We do not send marketing emails at this time; transactional emails (such as receipts or account notices) may be added later.

We do not knowingly collect payment card numbers on our servers today; paid features may use a payment processor in the future.

Why we use it

We use personal information to:

Provide timed tests, courses, notes, and progress tracking
Authenticate you and maintain your session
Operate, secure, and debug the service
Comply with law and enforce our Terms of service
Improve content and features (using aggregated or de-identified data where possible)

Who we share it with

We share information only as needed to run the service:

Google: when you choose Google sign-in, Google processes authentication according to its own policies
Infrastructure providers: self-hosted Node (Dokploy), PostgreSQL database, Valkey or Redis cache, and Cloudflare R2 for stored files when used — under our control and contracts
Legal and safety: when required by law, court order, or to protect rights, safety, and integrity of the service

We do not sell your personal information.

Retention

We keep account and learning data while your account is active. After you request deletion or close your account, we delete or anonymize personal data within a reasonable period (typically within 90 days), except where we must retain records for legal, tax, or security reasons.

Server logs are kept for a limited time for security and then rotated or deleted.

Your rights

Depending on where you live, you may have the right to:

Access a copy of your personal information
Correct inaccurate information
Delete your account and associated data
Export your data in a portable format
Object to or restrict certain processing
Withdraw consent where processing is based on consent

To exercise these rights, email [email protected]. We may need to verify your identity. We will respond within a reasonable time and as required by applicable law.

Security

We use reasonable technical and organizational measures to protect personal information, including encryption in transit (HTTPS), access controls, and secured infrastructure. No method of transmission or storage is completely secure; use a strong Google account and report suspected issues to us promptly.

Children

The service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided data, contact [email protected] and we will take appropriate steps to delete it. Users under the age of majority may need parental consent where local law requires it.

International transfers

We primarily process data in India on infrastructure we operate. If you access the service from outside India, your information may be transferred to and processed in India or where our subprocessors operate. We take steps designed to protect data in line with this policy and applicable law.

GDPR (European Economic Area, UK, and similar laws)

If you are in the EEA, UK, or a region with similar data protection law, the following also applies:

Legal bases: performance of a contract (providing the service), legitimate interests (security, improvement, fraud prevention), consent where required (for example optional cookies), and legal obligation
Controller: the operator of Upendra Competition Institute. Contact: [email protected]
Rights: access, rectification, erasure, restriction, portability, objection, and lodging a complaint with your local supervisory authority

CCPA / CPRA (California residents)

If you are a California resident, you have additional rights under the CCPA/CPRA, including:

Right to know categories and specific pieces of personal information we collect and use
Right to delete personal information, subject to exceptions
Right to correct inaccurate personal information
Right to opt out of “sale” or “sharing” of personal information — we do not sell or share personal information for cross-context behavioral advertising
Right to non-discrimination for exercising privacy rights

Categories collected in the last 12 months may include identifiers, internet activity (server logs), and education-related information (attempt answers and progress). Submit requests to [email protected].

Changes

We may update this policy. We will post changes on this page and update the “Last updated” date. Material changes will be communicated when we have a way to reach you.

Contact

Privacy questions and requests: [email protected].

General support: [email protected].