Privacy Policy

1. About this policy

This Privacy Policy ("Policy") describes how OlympAI ("we," "us," or "our"), a sole-proprietorship business based in Gurugram, Haryana, India, collects, uses, stores, and shares information when you use the OlympAI website at olympai.in and the learner application at learner.olympai.in (together, the "Platform").

This Policy is published in compliance with:

• The Information Technology Act, 2000 ("IT Act")
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
• The Digital Personal Data Protection Act, 2023 ("DPDPA") and rules thereunder

By accessing or using the Platform, you agree to this Policy. If you do not agree, please discontinue use immediately.

2. Who we are

OlympAI is an AI-powered Olympiad preparation platform designed for students in Classes 6–8 across India. We provide adaptive practice questions, chapter notes, concept explanations, and progress analytics to help students excel in school-level Olympiad examinations.

Data Fiduciary: OlympAI
Contact: contact@olympai.in
Address: Gurugram, Haryana, India

3. Information we collect

3.1 Information You Provide

• Account information: Full name, email address, class/grade, school name (optional)
• Parent/guardian information: Parent name, email address (for weekly progress reports and notifications)
• Payment information: For paid plans, we collect billing details. Card data is processed directly by our payment gateway (Razorpay) and is never stored on our servers.
• Communications: Any messages you send us at contact@olympai.in or support@olympai.in

3.2 Information Collected Automatically

• Practice activity: Questions answered, accuracy rates, time spent, topic performance, streaks
• Device & technical data: IP address, browser type, operating system, device identifiers
• Usage data: Pages visited, features used, session duration, referral source
• Cookies and local storage: Session tokens, theme preferences (light/dark mode)

3.3 Sensitive Personal Data or Information (SPDI)

Under the SPDI Rules, we may collect financial information (for payment processing). We do not collect passwords in plain text, biometric data, health data, or sexual orientation. All SPDI is handled with enhanced security measures as required by law.

4. How we use your information

• Provide, operate, and improve the Platform and its AI features
• Generate personalised practice questions adapted to your skill level
• Send weekly progress reports to linked parent email addresses
• Send transactional emails (account confirmation, payment receipts, subscription alerts)
• Process payments and manage subscriptions
• Detect and prevent fraud, abuse, and technical issues
• Comply with applicable legal obligations
• Respond to support queries
• Conduct aggregate, anonymised analytics to improve our AI models (no individual is identifiable in these analyses)

We do not use your data for targeted advertising to third parties, and we do not sell personal data.

5. Children's privacy

Our Platform is designed for students in Classes 6–8, who are typically between 11 and 14 years of age. Under the Digital Personal Data Protection Act, 2023, processing personal data of children (persons under 18 years) requires verifiable parental consent.

• When a student account is created, we collect and verify a parent/guardian email address.
• We send a consent notification to the parent email before activating the account.
• Parents may withdraw consent at any time by emailing contact@olympai.in, which will result in the account being deactivated and data deleted within 30 days.
• We do not serve behavioural advertising to children.
• We do not enable social features that allow children to share content publicly.

6. Sharing of information

We share personal data only in the following circumstances:

• Service providers: We use Firebase (Google LLC) for authentication and database, Google Analytics for usage analytics, and Razorpay for payment processing. These providers act as data processors and are contractually bound to use data only as instructed.
• Legal requirements: When required by law, court order, or government authority in India.
• Business transfers: In the event of a merger or acquisition, subject to the same privacy protections.
• With your explicit consent: For any purpose not described here.

We do not sell, rent, or trade personal data to advertisers or data brokers.

7. Data Retention

• Active accounts: Data is retained for as long as the account is active.
• Deleted accounts: Personal data is purged within 30 days of a deletion request, except where retention is required by law (e.g., financial records retained for 7 years as required under the Companies Act / accounting standards).
• Anonymised data: Aggregate, anonymised practice data may be retained indefinitely for AI model improvement.

8. Data security

We implement industry-standard security practices including:

• TLS/HTTPS encryption for all data in transit
• Firebase Security Rules restricting data access to authenticated users
• Role-based access controls limiting internal data access to authorised personnel
• Regular security reviews of third-party integrations

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify affected users and the relevant authority as required by the DPDPA.

9. Cookies

We use essential cookies for session management and user preferences (e.g., dark/light mode). We use Google Analytics cookies to understand platform usage. You may disable non-essential cookies in your browser settings; this may affect Platform functionality.

10. Your rights

Under the DPDPA 2023 and applicable Indian law, you have the right to:

• Access: Request a copy of personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal retention requirements).
• Withdrawal of consent: Withdraw consent for data processing at any time; this does not affect the lawfulness of processing before withdrawal.
• Nominate: Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Grievance redressal: Lodge a complaint with our Grievance Officer (see Section 12).

To exercise these rights, email contact@olympai.in with the subject line "Data Rights Request." We will respond within 30 days.

11. Third-party links

Our Platform may contain links to third-party websites (e.g., Olympiad body websites). This Policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to read their privacy policies.

12. Grievance Officer

In accordance with the Information Technology Act, 2000, and the DPDPA 2023, the following person has been designated as the Grievance Officer:

If you are not satisfied with the resolution provided by the Grievance Officer, you may escalate to the Data Protection Board of India once it is constituted under the DPDPA 2023.

13. Changes to this policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required, notify you by email. Continued use of the Platform after changes constitutes acceptance of the revised Policy.

14. Contact us

For any questions about this Privacy Policy or our data practices:

• Email: contact@olympai.in
• Support: support@olympai.in
• Address: Gurugram, Haryana, India