Privacy policy

Last updated 2 October 2026

This Privacy Policy describes how Philotium Studio (“Philotium”, “we”, “us” or “our”), located in Kumbakonam, Tamil Nadu, India, collects, uses, shares, stores and protects personal data in connection with ExamGraph, available at www.examgraph.app (the “Service”). It applies to every person who accesses or uses the Service (“you” or “User”).

We process personal data in accordance with the Digital Personal Data Protection Act, 2023 and the rules framed under it (the “DPDP Act”), and the Information Technology Act, 2000 and the rules framed under it. For the purposes of the DPDP Act, Philotium is the Data Fiduciary in respect of personal data processed through the Service. This Privacy Policy forms part of, and should be read together with, our Terms and Conditions. By creating an account or using the Service, you consent to the processing of your personal data as described in this Privacy Policy.

Contents

1. Personal data we collect
2. Purposes of processing
3. Disclosure to third parties
4. Storage and cross-border transfer
5. Cookies and similar technologies
6. Children’s personal data
7. Data retention
8. Your rights
9. Security
10. Changes to this Privacy Policy
11. Grievance Officer and contact

1. Personal data we collect

1.1 Data you provide

• Account data: your name, email address and password. Passwords are stored by our authentication provider in hashed form and are not accessible to us. Where you register or sign in using Google, we receive your name and email address from Google.
• Study profile data: information you provide to personalise the Service, including your stage of preparation, the year in which you intend to take the examination, the chapters you have covered, your available daily study time, your target score, and the state or union territory from which you study.
• Leaderboard data: where you elect to join the leaderboard, the board name you choose. Joining is optional, and you may leave at any time from the leaderboard page or from Settings.
• AI tutor data: the messages you submit to the AI tutor and the responses generated, which are saved as conversations in your account.
• Explanation requests: where you request an explanation of a question, the question concerned and the answer you selected.
• Question reports: the question reported and any reason you provide.
• Correspondence: the content of any communication you send to us.

1.2 Data generated through your use of the Service

• Practice records: for diagnostic tests, topic tests, daily sets, mock tests and past papers, the questions presented to you, the answers you select, the time taken per question, the confidence level you indicate, and your scores.
• Derived records: information derived from your practice records, including chapter mastery, your leaderboard rating and its daily rank history (retained whether or not you join a board, and disclosed to other Users only where you do), progress along the learning path, questions scheduled for review, streaks, and questions you have saved.
• Preferences: your dashboard layout, theme, learning-path and AI tutor preferences.
• Usage records: records of actions taken within the Service, such as starting a test or submitting a question to the AI tutor, and counts of AI requests used, maintained to apply usage limits and to maintain and improve the Service.

1.3 Payment data

Payments for paid plans are processed by Razorpay Software Private Limited (“Razorpay”), which collects your payment details directly and processes them in accordance with its own privacy policy. We receive and retain only the plan purchased, the amount, the date and status of each payment, and the reference identifiers issued by Razorpay. We do not receive or store card numbers, UPI identifiers or bank account details.

1.4 Technical data

Our hosting and database providers automatically record technical information when the Service is accessed, including IP address, browser and device type, the pages and resources requested, and the date and time of each request.

2. Purposes of processing

We process personal data only for the following lawful purposes, on the basis of your consent or as otherwise permitted by law:

• to create, authenticate and secure your account;
• to deliver practice content, evaluate your responses, and present your results, history and progress;
• to personalise the Service, by determining the chapters, questions and review items presented to you on the basis of your own practice records;
• to generate responses from the AI tutor, explanations of questions, and study summaries, using the relevant question and your practice records as context;
• to process payments, apply the limits of the free and paid plans, and detect and prevent fraud and misuse;
• to investigate reported questions and to maintain and improve the question bank and the Service;
• to communicate with you, including sending service emails relating to account verification (sign-in codes), password recovery and a welcome message on registration;
• to send you occasional product updates about ExamGraph, such as new features and changes to the Service, which you may opt out of at any time in Settings or through the link in any such email, without affecting the service emails your account requires; and
• to comply with applicable law and to respond to lawful requests from authorities.

We do not sell or rent personal data, we do not use personal data for advertising, and we do not process personal data to build profiles for the benefit of any third party. The only disclosure of personal data to other Users is the leaderboard described in section 3, which applies solely where you elect to join it.

3. Disclosure to third parties

Other Users, only where you elect to join the leaderboard. The leaderboard does not include you until you join it. Where you do, other Users of the Service can see the board name you chose, your state or union territory, your rating (a figure derived from your chapter mastery) and your rank, on the national board, the board for your state and the boards for each subject. No other personal data is disclosed, and the counts and averages a board displays are computed over joined Users only. Leaving the leaderboard removes you from every board immediately; your own rank history is retained for you alone.

Beyond that, we disclose personal data only to the following service providers, who act as Data Processors on our behalf, under our instructions, and only to the extent necessary for the services they provide:

Under OpenAI’s terms for its application programming interface, data submitted through that interface is not used to train its models by default. We may also disclose personal data where required by law, court order or a request from a competent authority; where necessary to protect the rights, property or safety of Philotium, our Users or others; or to a successor entity in the event of a merger, acquisition or transfer of the Service, subject to that entity continuing to honour this Privacy Policy.

4. Storage and cross-border transfer

Our database and website are hosted in Tokyo, Japan. AI requests are processed by OpenAI in the United States of America, payments are processed by Razorpay in India, and the advertising measurement data described at 5.2 is processed by Google on its global infrastructure. Personal data is transferred outside India only to countries not restricted by the Central Government under section 16 of the DPDP Act, and only to providers that maintain safeguards consistent with this Privacy Policy.

5. Cookies and similar technologies

Apart from the advertising measurement tag described at 5.2, we use only those cookies and similar technologies that are necessary for the Service to function.

5.1 Necessary

• Authentication cookies maintain your signed-in session. The Service cannot be used without them.
• Local and session storage in your browser retain your display mode and theme, and preserve a test in progress against accidental page reloads. This information remains on your device.

5.2 Advertising measurement

We advertise the Service on Google. So that we can tell which advertisements lead to a purchase, and stop paying for those that do not, we operate the Google Ads tag on a defined set of pages. It sets cookies and reads technical data of the kind described at 1.4.

The tag operates only on: our home page and the two pages describing the question bank and the learning path, the sign-in, sign-up and password pages, this page and the Terms and Conditions, and the page on which the pass is purchased. On a completed purchase it reports the amount paid and the payment reference so that the sale can be attributed to an advertisement.

The tag does not operate anywhere inside the study application. Your practice tests, mock papers, past papers, AI tutor conversations, the Ascent, circles, the leaderboard, your profile and your settings carry no advertising tag, and nothing you do on those pages is disclosed to Google. We do not use the tag to build an advertising profile of an identified User, and we do not upload your study records, results or email address to any advertising service.

We do not permit advertisements to be targeted at Users we know to be children, and no page on which a child’s activity is recorded carries the tag. See section 6.

You may block this tag with any standard browser setting or content blocker, and doing so has no effect whatever on the Service: every feature, including purchasing the pass, works identically. You may also delete the cookies it sets through your browser settings at any time. Deleting authentication cookies will sign you out of the Service.

6. Children’s personal data

The Service is intended for candidates preparing for the NEET-UG examination, some of whom may be under 18 years of age. A person under 18 may use the Service only with the consent of a parent or lawful guardian, who should review this Privacy Policy on the child’s behalf. Where required by the DPDP Act, we will obtain verifiable consent from a parent or lawful guardian before processing a child’s personal data. A parent or lawful guardian may at any time request access to, correction of or erasure of the child’s personal data, or withdraw consent, by writing to the Grievance Officer.

We do not undertake tracking or behavioural monitoring of children, or targeted advertising directed at children, and we do not process children’s personal data in any manner likely to have a detrimental effect on their well-being. Personalisation within the Service is limited to selecting the practice content presented to the User.

This governs where the advertising measurement tag described at 5.2 may operate. No page that records a child’s study activity carries it. The single page within an account that does carry it is the page on which the pass is purchased, and there it reports one completed transaction — the amount and the payment reference — and no behaviour, no study record and no identifier of the User. We do not supply any advertising service with a list of our Users, and we do not use any attribute of a User to target an advertisement.

7. Data retention

We retain personal data for as long as your account remains active, or for as long as necessary to fulfil the purposes described in this Privacy Policy. If you delete your account in Settings, your personal data is erased immediately; on a verified request made to us by email, within 30 days. In either case:

• records of payments and subscriptions are retained for the period required under applicable tax and accounting laws;
• a limited record of free-plan allowances already used may be retained to prevent misuse of those allowances;
• question reports may be retained in a form that does not identify you, as they relate to the content of the question bank; and
• residual copies in backups are erased in the ordinary course of the backup cycle.

Technical logs are retained by our service providers for a limited period and then deleted.

8. Your rights

Subject to applicable law, you have the right to:

• access a summary of the personal data we process about you and the processing activities undertaken;
• correct, complete or update your personal data; your name may be changed in Profile and your password in Settings;
• erase your personal data; individual test attempts may be deleted from History, AI tutor conversations may be deleted from the tutor, and your entire account may be deleted by you at any time from Settings → Privacy & legal, or by writing to us;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal; certain features of the Service may not be available without the data they require;
• opt out of product updates at any time in Settings or through the unsubscribe link in any such email; we retain a record of the emails sent to you so that no email is sent twice;
• nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and
• seek redressal of grievances from us and, thereafter, from the Data Protection Board of India.

To exercise any of these rights, write to support@examgraph.app from the email address associated with your account. We may take reasonable steps to verify your identity before acting on a request.

9. Security

We implement reasonable security safeguards to protect personal data against unauthorised access, disclosure, alteration and loss. Data is encrypted in transit; database access controls restrict each User’s records to that User; and access to production systems is limited to personnel who require it to operate the Service. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will notify affected Users and the Data Protection Board of India as required by law.

10. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time. The date of the latest revision is stated at the top of this page. Where an amendment materially affects the processing of your personal data, we will notify you through the Service or by email before the amendment takes effect.

11. Grievance Officer and contact

In accordance with the Information Technology Act, 2000, the rules framed under it, and the DPDP Act, the details of our Grievance Officer are as follows:

Vasanth Nagarajan
Grievance Officer, Philotium Studio
Kumbakonam, Tamil Nadu, India
Email: support@examgraph.app

Grievances will be acknowledged within 24 hours and resolved within 15 days of receipt. If you are not satisfied with the resolution, you may approach the Data Protection Board of India.