Privacy Policy

1. Who we are

This Privacy Policy (the "Policy") describes how Aide Tech Systems, a sole-proprietorship enterprise registered as a Micro/Small Enterprise under the Udyam Registration Portal of the Ministry of Micro, Small and Medium Enterprises, Government of India (the "Enterprise", "we", "us", or "our"), collects, uses, discloses, retains, and protects personal data of users (each, a "User" or "you") of ProjectsPilot (the "Product"), made available through the website projectspilot.com, its sub-domains, and any related mobile or progressive-web application (collectively, the "Platform").

ProjectsPilot is a product offering of Aide Tech Systems. Aide Tech Systems is the legal entity that contracts with you, processes your personal data, and is accountable to regulators and consumer forums. Aide Tech Systems is not yet incorporated as a private limited company under the Companies Act, 2013; should the Enterprise be converted to a company or otherwise restructured in future, this Policy will be updated to reflect the successor entity and you will be notified per Section 15.

For the purposes of the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Enterprise is the Data Fiduciary in respect of personal data of Users. You are the Data Principal.

2. Scope

This Policy applies to personal data collected through the Platform from Users located in India. We extend equivalent rights to Users outside India to the extent applicable laws so require (including, where relevant, the EU General Data Protection Regulation).

This Policy does not cover personal data processed by third-party services that you may reach through links on the Platform; their processing is governed by their own privacy notices.

3. Categories of personal data we collect

We collect the following categories of personal data:

3.1 Account data — name (and optional name in Devanagari script), mobile phone number, email address, target exam, target year, attempt number, medium of instruction, hours of daily study, postal address (city, state, country), and a profile photograph (when sourced from Google sign-in).

3.2 Authentication data — Google subject identifier (you sign in with Google), session tokens, timestamps of sign-in and sign-out events, and any time-bound one-time password (OTP) used to verify your mobile number.

3.3 Study activity data — your interactions with study material, AI Tutor conversation transcripts, mock-test attempts and scores, spaced-repetition flashcard reviews, plan-item completion timestamps, current affairs you marked read, notes you authored, and audio-narration preferences.

3.4 Payment data — billing name, subscription plan, amount paid, currency, payment instrument type (UPI, card, net banking, wallet), provider order and payment identifiers (from Razorpay), and invoice records. We do not store full card numbers, CVVs, UPI PINs, or net-banking credentials; these remain with our PCI-DSS compliant payment processor.

3.5 Device and network data — IP address, approximate geographic region inferred from IP, browser type and version, operating system, device type, screen resolution, language preference, time-zone, and crash diagnostics.

3.6 Communications data — emails, in-app support messages, and Grievance Officer correspondence that you initiate with us.

We do not knowingly collect financial information beyond what is described above, biometric data, health data, sexual orientation, religious or political beliefs, or any other category designated as Sensitive Personal Data or Information ("SPDI") under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, except to the limited extent the payment categories above qualify.

4. Purposes for which we use your personal data

We process your personal data for the following purposes:

• To provide the Platform — authenticate you, deliver the AI Tutor responses, generate your personalised study plan, track your progress, and surface tailored content.
• To process payments — accept your subscription payments, issue invoices, manage cancellations, process refunds, and prevent fraud.
• To improve the Platform — analyse aggregated, de-identified usage patterns to refine our content curriculum, AI models, and product experience.
• To communicate with you — send service-related notices (subscription renewals, password resets, security alerts), respond to your support requests, and, with your separate consent, send promotional emails or notifications.
• To comply with legal obligations — including tax law, MSME reporting, payment-aggregator law, and any lawful order from a court or government authority.
• To enforce our terms — investigate suspected breaches of our Terms of Service, prevent abuse, and protect the rights of other Users.

5. Legal basis for processing

Under the DPDP Act, we process your personal data on the following lawful grounds:

• Your consent — given freely, specifically, and unambiguously at signup and when you opt in to specific features (such as Google sign-in or promotional communications). This is our primary ground for processing.
• Certain legitimate uses under Section 7 of the DPDP Act — including where you voluntarily provide data for a specified purpose, to perform the subscription and services you have purchased, to comply with a legal obligation (such as retaining tax records or responding to a lawful order), and to prevent fraud.

Where consent is the basis, you have the right to withdraw it at any time through the mechanism described in Section 11 below. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

6. Third parties who process your personal data

We engage the following categories of Data Processors to process personal data on our behalf, under binding contractual obligations equivalent to or stricter than this Policy:

• Cloud hosting and infrastructure — primarily Indian data-centre regions of major cloud providers. Personal data resides in India by default.
• AI inference — Anthropic, PBC (provider of Claude) and OpenAI, LLC (provider of GPT) process AI Tutor messages, mock-test generation prompts, and other AI-feature payloads. We have contractual commitments from these providers that they will not use your personal data to train their models. We log AI requests for up to 30 days for debugging and abuse-prevention, then delete them.
• Payments — Razorpay Software Private Limited processes all payment-instrument data per its own RBI-licensed payment-aggregator policy.
• Authentication — Google LLC, where you sign in with Google. Google's privacy practices apply to the data they process.
• Communications — email-delivery, transactional-SMS, and (where used) WhatsApp Business API providers.
• Analytics and crash reporting — Google LLC (Google Analytics 4, in a measurement-only configuration — see Section 7) and our error-monitoring provider, both limited to de-identified usage data; we do not embed third-party advertising cookies, behavioural-tracking pixels, or social-media tracking widgets.

We do not sell, rent, or trade your personal data with any third party for that party's marketing purposes — not to coaching institutes, not to recruiters, not to publishers, not to any other commercial entity.

7. Cookies and similar technologies

We use a minimal set of strictly-necessary cookies and local-storage entries to authenticate your session, remember your language and text-scale preferences, and store transient state (e.g., last-read scroll position on a study material). For audience measurement we run our own first-party, cookieless analytics that count page views and approximate unique visitors using a one-way hash that rotates every day (so visits cannot be linked across days); it stores no IP address, device identifier, or other personal data.

We additionally use Google Analytics 4 (provided by Google LLC) in a measurement-only configuration to understand, in aggregate, how visitors find and use the Platform: IP anonymisation is enabled, advertising-personalisation signals are disabled, and we do not use Google Signals, remarketing, or audience export. Google Analytics sets its own cookies and may process the data on servers outside India under Google's Privacy Policy. You can opt out at any time with the Google Analytics opt-out browser add-on or any standard tracking-prevention / ad-blocking feature of your browser — the Platform works identically either way. We do not use third-party advertising cookies, and we do not deploy Facebook Pixel, LinkedIn Insight Tag, or equivalent advertising-tracking technologies.

Your browser controls cookies; disabling strictly-necessary cookies will prevent the Platform from functioning correctly.

8. International transfers

Your personal data is primarily processed and stored in India. AI inference is performed by Anthropic and OpenAI on servers that may be located outside India. Where such transfer occurs, the receiving processor is bound by contractual safeguards designed to provide a level of protection materially equivalent to that under Indian law, and the transfer is conducted only to the extent necessary to provide the AI features you have opted into.

We will comply with any restrictions on cross-border transfer of personal data notified by the Central Government under Section 16 of the DPDP Act, and will update our Processors and routing arrangements as required.

9. Data retention

We retain personal data for as long as needed to fulfil the purposes for which it was collected, including any legal, accounting, or reporting obligations. Specific retention periods include:

• Account data — until you delete your account; thereafter retained for 7 days for reversibility, then permanently erased.
• Study activity data — until you delete your account or initiate erasure under Section 11 below; thereafter erased within 7 days.
• Payment records and invoices — 8 years from the financial year in which the transaction was completed, to comply with the Indian Income-tax Act, 1961.
• AI request logs — 30 days, then permanently erased.
• Audit logs — 3 years, then archived in an irreversibly de-identified form.
• Device and network telemetry — 90 days.
• Communications — 3 years from the date of communication.

Where law requires longer retention (e.g., tax or AML), the longer period prevails. Where you exercise your right of erasure, we will erase or de-identify the data subject to lawful retention obligations.

10. Security measures

We implement reasonable security practices and procedures appropriate to the nature of the personal data being protected, in compliance with Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, including:

• Encryption in transit (TLS 1.2 or higher) for all client-server traffic.
• Encryption at rest for the production database.
• Role-based access control for our personnel; principle of least privilege.
• We do not use passwords; sign-in is via Google or a one-time password, and we do not store the OTP itself after verification.
• Periodic vulnerability assessments and prompt security patching.
• Auditable change-control on production systems.
• Restricted physical access to data-centre infrastructure (handled by our cloud provider per its own published controls).

No method of internet transmission or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

11. Your rights under the DPDP Act

As a Data Principal under the DPDP Act, you have the following rights:

• Right to access — to obtain a summary of the personal data we process about you and the categories of processing activity.
• Right to correction and erasure — to have inaccurate or misleading personal data corrected, completed if incomplete, and to have your personal data erased except where retention is required by law.
• Right to grievance redressal — to lodge a complaint with our Grievance Officer (see Section 14) and, if unsatisfied, with the Data Protection Board of India.
• Right to nominate — to nominate any individual who shall, in the event of your death or incapacity, exercise these rights on your behalf.
• Right to withdraw consent — at any time, for any processing based on consent, with effect from the time of withdrawal.
• Data export (offered voluntarily) — although the DPDP Act does not require data portability, we let you export the personal data you have provided, in a structured, machine-readable format (JSON).

To exercise any of these rights, write to privacy@projectspilot.com or follow the steps on our account-deletion page. We will respond within thirty (30) days of receiving a verifiable request, in line with DPDP Act timelines. If we cannot honour the request in whole or in part, we will explain why and inform you of your right to complain to the Data Protection Board of India.

12. Children's data

The Platform is not directed at children under the age of eighteen (18) years. Under Section 9 of the DPDP Act, processing personal data of children requires verifiable parental consent and is subject to additional restrictions. We do not knowingly create accounts for children. If you believe a child has provided us with personal data, please contact our Grievance Officer and we will delete the account.

13. Data breach notification

In the event of a personal data breach that is likely to result in significant harm to affected Users, we will, within the timeframe required by the DPDP Act and any rules made thereunder, notify the Data Protection Board of India and the affected Users by email and prominent in-Platform notice.

14. Grievance Officer and Data Protection Officer

Pursuant to Rule 5(9) of the Information Technology (Reasonable Security Practices) Rules, 2011 and Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, our designated Grievance Officer is:

A Data Protection Officer is mandatory only for a Significant Data Fiduciary designated under Section 10 of the DPDP Act. We do not currently meet that threshold, but we have voluntarily designated a contact for data-protection queries, reachable at dpo@projectspilot.com.

We acknowledge grievances within twenty-four (24) hours and aim to resolve them within fifteen (15) days, as required by Rule 3(2) of the Intermediary Guidelines Rules.

15. Updates to this Policy

We may amend this Policy from time to time to reflect changes in law, our operations, our entity structure (including any future incorporation of Aide Tech Systems as a company), or the categories of data we process. Material changes will be notified to Users by email and a prominent in-Platform banner at least fifteen (15) days before they take effect. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

16. Governing law

This Policy is governed by the laws of India. Any dispute concerning your personal data may be raised with our Grievance Officer in the first instance and, failing satisfactory resolution, before the Data Protection Board of India or the competent courts at the principal place of business of Aide Tech Systems, as recorded in our Udyam Registration.

17. Contact

For privacy-related questions, write to privacy@projectspilot.com. For account or product support, write to help@projectspilot.com.