This Privacy Policy explains how R and D Educational Enterprises, H.No. 1-8-527, Chikkadpally, Musheerabad, Hyderabad, Telangana, India ("we", "us"), operator of VPR Prep (vprprep.com), collects, uses, stores and protects your personal data. We act as the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act"). We collect only what we need to run your preparation account, and we never sell your data.
1. Data we collect
- Account details: your name, e-mail address, mobile number and password. Passwords are stored only as a one-way hash (Argon2id); we cannot read them.
- Preparation profile: the exams you follow, target year, preparation stage, preferred language and your study goals.
- Learning data: your practice answers, test answers, time spent per question, scores, ranks, bookmarks and topic progress.
- Purchase data: the plan bought, amount, coupon used, order and receipt numbers, the Razorpay payment ID and the payment method type (for example "UPI" or "card"). We do not receive or store card numbers, CVV, UPI PIN or bank passwords; these are handled by Razorpay.
- Security data: sign-in records, active device sessions, one-time-code records and the IP address associated with security events.
- Messages: what you send us when you contact support.
2. Why we use it
- To create and secure your account, verify your e-mail and sign you in with a one-time code.
- To provide practice, mock tests, scoring, solutions, ranks and analytics for the exams you choose.
- To process payments, activate plans, issue receipts and handle refunds.
- To send service e-mails: sign-in codes, receipts, result revisions and important account notices. We do not send marketing e-mails without your consent.
- To prevent fraud, cheating and misuse, and to keep the Platform secure.
- To meet legal, tax and accounting obligations and respond to lawful requests.
We process your data on the basis of the consent you give when you register (which you may withdraw) and, where the DPDP Act permits, for legitimate uses such as complying with law and providing the service you asked for.
3. Who we share it with
- Razorpay Software Private Limited, to process payments and refunds.
- Hostinger, which hosts our servers and e-mail. Our application and database run on servers located in India.
- Government or law-enforcement authorities, when we are legally required to.
These providers act on our instructions and are required to protect your data. On leaderboards other students see you anonymously (for example "Student 4") unless the administrator chooses to show first name and last initial; e-mail and mobile are never shown to other students. We do not use advertising or third-party tracking cookies.
4. Cookies
We use only essential cookies: a session cookie that keeps you signed in, a security token that protects forms, and an optional "remember me" cookie. No analytics or advertising cookies are used. The payment page loads Razorpay's checkout, which may set its own cookies needed to complete a payment.
5. How long we keep it
- Account, profile and learning data: while your account is active, and until you ask us to delete it.
- IP addresses in security logs: cleared after 90 days.
- Used sign-in and verification code records: deleted after 30 days.
- Exam device and resume records: deleted after 365 days.
- Application error logs: about 30 days.
- Payment and invoice records: kept for as long as tax and accounting laws require (generally up to 8 years), even after account deletion.
6. How we protect it
Encrypted HTTPS connections, hashed passwords, two-step sign-in with e-mail codes, hashed session tokens, least-privilege database accounts, an append-only audit log, strict browser security headers and regular backups. No system is perfectly secure; if a breach affecting you occurs we will inform you and the Data Protection Board of India as the law requires.
7. Your rights
Under the DPDP Act you may:
- Access a summary of the personal data we hold about you and how it is used;
- Correct or update it (most details can be changed yourself under Profile and My Exams);
- Erase it: we will delete or anonymise your account, keeping only what the law requires us to retain;
- Withdraw consent at any time (this ends the service, as we cannot run your account without the data);
- Nominate another person to exercise your rights in case of death or incapacity;
- Raise a grievance with our Grievance Officer and, if unresolved, with the Data Protection Board of India.
To exercise a right, e-mail contact@vprprep.com from your registered e-mail address. We respond within 30 days.
8. Children
The Platform is intended for adults preparing for competitive examinations. If you are under 18, you may use it only with the verifiable consent of a parent or legal guardian. We do not knowingly track or target advertising at children. If you believe a child has registered without consent, contact us and we will delete the account.
9. Grievance Officer
Ramesh Kandula, R and D Educational Enterprises, H.No. 1-8-527, Chikkadpally, Musheerabad, Hyderabad, Telangana, India. E-mail: contact@vprprep.com · Phone: 9310364056. We acknowledge complaints within 48 hours.
10. Changes
We may update this policy. The effective date is shown at the top; we will notify you of significant changes by e-mail or on the Platform.