Privacy Policy

Information you give us

• Account details: your email address, and a password if you sign up with email. If you use Sign in with Google we receive your email address, name and profile picture from Google. We never receive your Google password.
• Profile: your name, a public username, and optionally a phone number.
• Date of birth: collected once during onboarding to enforce our minimum age of 13 and to tell whether you are under 18, so we can apply the additional protections described in section 7.
• Study goals: your target exam, target attempt, exam date, hours available per day, and any subjects you tell us you find difficult.
• Content you create or upload: notes, highlights, PDFs, images, article links and text you paste into News Lens, and the messages you send to Pady, our AI coach.

Information created as you study

• Every question you answer, whether you got it right, the option you chose and how long you took.
• Mock test and previous-year-paper attempts, including your answers and scores.
• Time spent studying, streaks, and which parts of the app you visited recently.

We collect this automatically as you use the app, because it is what makes progress tracking, performance analytics and AI coaching work. It is not optional while you have an account, but you can delete your account at any time (section 6).

Technical information

• IP address: we shorten it before storing it in our analytics, keeping only the network portion. This tells us roughly where our users are without identifying a household. We retain full IP addresses only in security records used to detect and prevent abuse.
• Country: an approximate country, derived from your connection rather than from any third-party lookup service.
• Device and browser type, and a random device identifier we generate to keep your sign-in secure.

What we do not collect

We do not collect your card number, CVV or UPI PIN. Payments are handled entirely by Razorpay on their own systems. We do not use your camera, microphone or precise device location, and the app does not ask for those permissions. We do not buy personal data about you from data brokers.

• To run the service: create and secure your account, serve questions and papers, save your notes and attempts, and keep you signed in.
• To personalise your study: show your performance analytics, identify weak chapters, and let Pady give advice based on your actual practice history.
• To provide AI features: generate answers, explanations, notes, mock questions and coaching replies (section 4 explains this in detail).
• To keep the platform safe: detect and block automated scraping, credential-stuffing, abusive sign-ups and fraudulent referrals.
• To communicate with you: send sign-in codes, password resets, receipts and important service notices. These are necessary for the service and cannot be unsubscribed from. Promotional email is separate and opt-in, as described in section 9.
• To improve Padhify: understand which features are used, where people get stuck, and what to build next.
• To meet legal obligations and to establish or defend legal claims.

We do not sell your personal data, we do not share it with advertisers, and we do not use your study data to target you with third-party ads.

Under India's Digital Personal Data Protection Act, 2023 we process your personal data on the basis of the consent you give when you create an account and accept these terms, and for certain legitimate uses the Act recognises, such as preventing fraud and abuse and complying with law.

You can withdraw consent at any time by deleting your account (section 6). Withdrawing consent does not undo processing that already happened, and it means we can no longer provide the service.

If you are in the EEA or UK, our lawful bases under the GDPR are: performance of a contract (running the service you signed up for), consent (AI memory and promotional email), legitimate interests (security, abuse prevention, product improvement), and legal obligation.

Padhify's AI features are provided by a third-party AI provider under enterprise terms. This section is deliberately specific, because AI processing is the least obvious thing we do with your data.

What is sent to the AI provider

• The question, message, document or article you are asking about.
• For Pady coaching: your first name, your study goals, a summary of your practice performance, the recent messages in that conversation, and anything Pady has remembered about you.
• For document features: the text or images of the PDF or picture you uploaded.

We do not send your email address, phone number, password or payment details to the AI provider.

Pady's memory

To coach you well over time, Pady saves short notes about things you tell it that stay relevant, such as that you study late at night, or that you find a particular topic stressful. It also keeps one-line summaries of past conversations. These are stored against your account and are used only to help Pady advise you.

You are in control of this. In Settings, under Privacy & AI, you can see how much Pady has remembered, turn memory off entirely, and delete everything it has stored. Deleting a conversation also deletes the summaries taken from it. We never build this kind of memory for users under 18.

Training

We do not train AI models on your data, and we use the AI provider under enterprise terms rather than a consumer product.

Accuracy

AI output can be wrong. Do not rely on it as your only source for an exam answer. See our AI Policy for what the AI can and cannot be trusted with.

We share personal data only with service providers who help us run Padhify, and only as much as each one needs to do its job. They fall into these categories:

• Hosting and databases, which store your account and study data.
• AI processing, which generates answers, explanations, notes and Pady's coaching.
• Sign-in, if you choose to continue with Google.
• Email delivery, for sign-in codes, receipts and account notices.
• Payments, handled by our payment processor, who collects card and UPI details directly.
• Bot protection and network security, which keep sign-up and sign-in safe.

Every one of them is bound by contract to use your data only for the service they provide to us, and none of them may use it for their own purposes. If you want to know which providers we currently use, email support@padhify.com and we will tell you.

We also disclose personal data:

• When the law requires it, such as a valid court order or a lawful request from a government agency.
• To establish, exercise or defend legal claims, or to investigate abuse of the platform.
• To a buyer or successor if Padhify is acquired or merges, in which case this policy continues to apply until you are told otherwise.

Your primary data is stored in India. Some providers process data outside India, notably AI inference on Google Cloud and email delivery in the United States. Where that happens we rely on the provider's contractual data protection commitments.

When you delete your account: it is deactivated immediately. Nothing is erased for 30 days. Signing back in during that window restores your account, including your username. After 30 days everything is permanently deleted, including your notes, attempts, conversations and AI memories.

You can:

• See and correct your information. Most of it is editable in Settings.
• Delete your account and data from Settings. This is self-service and takes effect immediately, with the 30-day recovery window described above.
• Control what Pady remembers in Settings, under Privacy & AI.
• Opt out of promotional email using the unsubscribe link in any promotional message. This takes effect permanently.
• Download a copy of your data from Settings, under Your data. It arrives as a JSON file covering your profile, study history, notes, attempts, conversations and billing records. If your history is very large the export is delivered in parts, and the file tells you where that applies. Email us and we will send you the complete set.
• Complain to our Grievance Officer (section 12), and if you are still unsatisfied, to the Data Protection Board of India.
• Nominate someone to exercise your rights if you die or become incapacitated, as the DPDP Act allows. Email us to arrange this.

We respond to rights requests within 30 days. We may ask you to verify your identity first, so that nobody else can use these rights against your account.

You must be at least 13 years old to have a Padhify account. This is enforced by the product, not only stated here: we ask for your date of birth during onboarding, and an account whose date of birth shows an age under 13 is not created. If one has already been created at sign-in, it is deleted, and we do not keep the date of birth or ask anything further of that person.

For users in the United States, this is also how we handle the Children's Online Privacy Protection Act: Padhify is not directed to children under 13, and where the date of birth gives us actual knowledge that a user is under 13 we refuse and remove the account rather than collect their personal information. If you believe a child under 13 has provided us with personal information, contact us and we will delete it.

Being over 13 does not make you an adult under Indian law. India's Digital Personal Data Protection Act treats everyone under 18 as a child, so a 15 year old on Padhify is a child for the purposes of that Act even though they are old enough to hold an account. The two thresholds are different and we apply both.

If your date of birth shows you are under 18, you must confirm at onboarding that a parent or guardian has read this policy and our Terms and agrees to your use of Padhify. We record that confirmation and the time it was given.

For accounts we know belong to someone under 18, we additionally:

• do not record behavioural analytics events;
• do not build or store AI memory about the student; and
• do not send promotional email, and exclude the account from every bulk campaign.

We do not knowingly serve advertising to children and do not use children's data for tracking or profiling.

What this consent is, and is not. The confirmation we collect is a declaration made by the person signing up that their parent or guardian agrees. It is not verified against the parent or guardian themselves. The DPDP Act contemplates verifiable parental consent, and the mechanism for it will be set out in the rules made under the Act; we will implement that mechanism when those requirements are settled. We would rather describe our current control accurately than call it more than it is.

If you are a parent or guardian and believe your child created an account without your agreement, or you want your child's data deleted, contact us using the details in section 12 and we will act on it. Anyone can also delete an account themselves at any time: our account deletion page explains how, and what happens to the data.

Padhify uses very few cookies. We use one essential cookie to keep you signed in, and we store some preferences in your browser's local storage. We do not use advertising or cross-site tracking cookies.

Our Cookie Policy lists each one, what it does and how long it lasts.

Service email covers sign-in codes, password resets, security notices, payment receipts and important changes. These are part of the service and are always sent.

Promotional email covers news about features and offers. This is opt-in, never sent to users under 18, and every message carries a one-click unsubscribe link. Unsubscribing is permanent and we keep a record of your address purely so we do not email you again.

Passwords are protected with strong, industry-standard one-way hashing and are never stored in a form anyone can read, including us. We apply technical and organisational safeguards including encryption in transit, strong access controls, short-lived sign-in sessions that can be revoked immediately, rate limiting, automated abuse detection, and restricted access to production data.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board as the law requires. If you believe you have found a vulnerability, please email support@padhify.com.

For any privacy question or to exercise your rights, email support@padhify.com.

If you are unhappy with our response, you can escalate to our Grievance Officer, who will acknowledge your complaint within 24 hours and resolve it within 15 days. Full details are on our Contact page.

Anquin LLP

You also have the right to complain to the Data Protection Board of India.

We update this policy when what we do with data changes. The date at the top always reflects the current version. For significant changes we will tell you in the app or by email before they take effect, and where the law requires it we will ask for your consent again.