Privacy notice

• We collect what is needed to run your preparation — account details, and your answers and scores — and use it only for that.
• No selling or renting of data. Ever. Analytics and advertising cookies are used only if you accept them in the cookie banner, only on the public website, sign-up and checkout, and never for a student under 18. We also measure whether the offer emails you chose to get are opened and clicked.
• Students under 18 need a parent or guardian’s consent first, and nothing about them can be made public.
• You can download your data, correct it, erase it, or withdraw consent — from Settings → Privacy & data or our grievance page. We answer within 90 days at the latest.

This notice is given under the Digital Personal Data Protection Act, 2023 (the “Act”) and the Digital Personal Data Protection Rules, 2025. You can ask us for it in English or in any language in the Eighth Schedule to the Constitution.

Nikaalle is operated by Chiragh Educational and Welfare Trust, Barri Phulwariya, Bajpatti, Sitamarhi, Bihar 843314 (“we”, “us”). We are the Data Fiduciary for the personal data described here: we decide why and how it is processed.

Questions about this notice or your data go to our Grievance Officer, Shahab Alam, at [email protected], or through the grievance page.

We process each item below only for the purpose next to it. The legal basis is your consent, given when you sign up (or your parent’s, for a minor), except where the Act lets us process without it — for example to comply with a law or a court order.

We do not collect Aadhaar, caste, religion, health, financial account or location data. We do not build advertising profiles. Marketing email is sent only if you tick the separate, optional box, and never to a student under 18.

Under the Act, anyone under 18 is a child. Before we process a child’s personal data we obtain the verifiable consent of their parent or lawful guardian:

1. The student gives their date of birth and a parent’s email. Their account is created but stays inactive, and nothing is sent to the student.
2. We email the parent a notice of what we would collect and why, with a link that works for 14 days.
3. The parent confirms they are an adult and agrees. Where the parent already has an adult account with us, we rely on the identity and age details we already hold.

If no consent is given, the account is never opened, and it is erased 30 days after the last link lapses.

For children we never track behaviour, never target advertising, never send marketing, and never make anything public: no profile, no leaderboard entry. Their discussion posts are checked by a moderator before anyone else sees them.

A parent may withdraw consent at any time, from the parent view or through the grievance page. We stop processing and close the account at once.

We do not sell or rent personal data. We share it only as follows:

• Data Processors acting for us, under contract, only on our instructions: our hosting provider (Amazon Web Services (Mumbai, India), with Cloudflare for content delivery), which stores the database; our email provider (Brevo), which delivers our emails; and Razorpay, which takes payments.
• Your browser’s push service (for example Google, Mozilla or Apple), if you turn on push notifications: it carries each notification to your device, encrypted so that it cannot read it.
• Your parent or guardian, if they are linked to your account: a read-only view of your plan, tests and progress, and a weekly digest.
• Other students see only what you make public, by the handle you choose — and a student under 18 cannot make anything public.
• Authorities, when the law requires it, for example under a court order.

Our staff use an AI service to help draft practice questions. No student’s personal data is sent to it.

Your data is stored in India. If a processor handles it outside India, we do so only as the Act permits, and never to a country the Central Government has restricted.

We take reasonable security safeguards, as the Act and Rule 6 require:

• Every connection is encrypted (HTTPS). Passwords are stored only as Argon2id hashes; two-factor secrets are encrypted with AES-256-GCM.
• Staff see only what their role needs, and staff accounts can be required to use two-factor sign-in.
• Staff actions on accounts and content are recorded in an audit log, kept for at least a year.
• Sign-in attempts are rate-limited, and you are emailed when your account is used from a new browser.
• The database is backed up regularly, so data can be restored if it is lost or damaged.

If a personal data breach affects you, we will tell you without delay: what happened, what it means for you, what we are doing about it, what you can do, and who to contact. We will report it to the Data Protection Board of India as the Rules require, including a detailed report within 72 hours of becoming aware of it.

We use the cookies needed to run the site: to keep you signed in, protect forms, remember your light or dark theme, and recognise a browser you have used before. With your consent in the cookie banner, and only then, we also measure visits to the public website, sign-up and checkout (including with Google Analytics). That never happens on study, test or results pages, and never for a student under 18; no answers, marks or account details are shared. Change your choice at any time with Cookie settings at the bottom of every page. The cookie notice lists each cookie.

Under the Act you have the right to:

• Access — a summary of the personal data we hold about you, what we do with it, and who we have shared it with. Download it any time from Settings → Privacy & data.
• Correction, completion and updating — most details can be changed in settings; ask us for anything else.
• Erasure — of data no longer needed, or on withdrawing consent, except what the law makes us keep.
• Grievance redressal — a response from us within 90 days at the latest.
• Nomination — to name someone to exercise your rights if you die or become unable to.

Make any request from settings or the grievance page. Each gets a reference number. We may need to confirm who you are before we disclose or erase anything.

The Act also sets duties for you: give accurate information, do not impersonate anyone, and do not file false or frivolous complaints.

You can withdraw consent as easily as you gave it. Marketing email is one switch in settings. To withdraw consent for your account as a whole, use the grievance page; we then stop processing, close the account and erase your data, except what the law makes us keep. Withdrawal does not affect processing that happened before it.

Please come to us first — our Grievance Officer answers within 90 days. If you are not satisfied, you may complain to the Data Protection Board of India, in the manner the Board specifies.

When you write to us through the contact form, we use your name and email only to reply, keep the message for 180 days after we answer, and record that you agreed to this.

When we change what we collect or why, we update this notice and its date, tell you by email or in the app, and ask for your consent again where the law requires it. Your consent is recorded against the version you were shown.