Privacy Notice

1. Who is responsible for your data

Subhash Kumar Sharma (trading as Exavora) decides why and how your personal data is processed and is the Data Fiduciary under the DPDP Act. You can reach us at subhash.imp01@gmail.com.

2. What we collect

We collect only what we need to run Exavora:

• Account details: your name, email address and, if you add them, organisation and job role.
• Sign-in and security data: a salted hash of your password (never the password itself), session records, one-time codes, and the IP address of requests, used in counters that block repeated sign-in or form attempts.
• Learning data: practice answers, timed test attempts and scores, free-test answers, bookmarks, readiness results, and the interview-practice answers and self-review checkpoints you choose to save.
• Purchases: what you bought, the price, order and refund records. Card and bank details are handled by the payment provider and never reach us.
• Course requests made while online payment is paused: your name, phone number, email and any note you add.
• Messages you send us: support requests, team enquiries (including your company and team size) and password-reset help requests.
• Feedback: your ratings and comments, and, only if you agree, the display name and role to show with a published testimonial. Visitors may leave feedback with an optional name and email.
• Records of actions on your account (for example sign-ins, purchases and admin changes), kept for security and accountability.

3. Why we use it

We use your data only for these purposes:

• To create and secure your account and sign you in.
• To provide the courses: practice, timed exams, scoring, readiness analytics, interview practice and study-material downloads (files are marked with your account details to protect our licence).
• To process purchases, refunds and course requests, and to contact you about them, including by phone if you gave us your number for a course request.
• To answer your support messages and enquiries.
• To improve Exavora using your feedback, and to publish a testimonial only when you have said we may.
• To send service emails you need, such as receipts, password resets and replies. We do not send marketing emails.
• To protect the platform against abuse and to meet legal duties, such as keeping tax and accounting records.

4. Our legal basis

We process your data on the basis of your consent, which you give when you create an account or submit a form after reading this notice, and for legitimate uses allowed by Section 7 of the DPDP Act: where you voluntarily give us data for a specific purpose (for example, a course request or support message) and where the law requires us to keep records.

You can withdraw your consent at any time by emailing us or deleting your account. Withdrawal is as easy as giving consent. It does not affect processing already done, and some features (such as your account and courses) cannot work without the data they need.

5. What we don't do

• We do not sell or rent your personal data.
• We do not show advertising or use advertising or analytics trackers.
• We do not use your learning data to make decisions about you outside Exavora.

6. Who we share it with

We share personal data only with service providers that process it on our instructions (Data Processors under the DPDP Act), and only as much as each needs:

• Vercel Inc.: website hosting.
• Neon: database hosting, in its Singapore region.
• An email delivery provider (Brevo or Resend), once email sending is switched on, to deliver service emails.
• A payment provider, once online payment is switched on, to take payments securely.
• If your organisation gives you access to Exavora, its administrators can see your course access and learning progress, but not your written interview answers.
• Government authorities, regulators or courts, when the law requires us to.

7. Where your data is stored

Our database is hosted in Singapore and our website runs on servers that may be outside India, including in the United States. The DPDP Act allows this, except to countries the Government of India restricts by notification; we will not transfer data to any restricted country.

8. How long we keep it

• Account and learning data: for as long as your account exists. When you delete your account, your profile, learning history, interview answers, bookmarks and sessions are deleted.
• Order and payment records: for the period Indian tax and accounting law requires, even after you delete your account.
• Course requests, support messages and enquiries: until they are resolved and for up to 24 months afterwards, so we can refer back to them. Ask us and we will delete them sooner unless the law requires us to keep them.
• Feedback: until you ask us to remove it. You can withdraw permission for a published testimonial at any time from the Feedback page.
• Copies of service emails we send you: kept as a record of what we sent.
• Security counters that include IP addresses: deleted within 2 days.
• Security and audit records, which can include your email address (for example, a record that an account was deleted): kept to protect the platform and to show what happened on an account.

9. Your rights

Under the DPDP Act you have the right to:

• Get a summary of the personal data we hold about you and how we use it, and the identities of those we have shared it with. You can also download your data from Profile → Download my data.
• Have inaccurate or incomplete data corrected, completed or updated. You can edit most details in your Profile.
• Have your data erased when it is no longer needed for the purpose you gave it for, or when you withdraw consent, unless the law requires us to keep it. You can delete your account from Profile → Delete account.
• Nominate another person to exercise your rights if you die or become unable to do so.
• Have your grievances addressed by our Grievance Officer, and then complain to the Data Protection Board of India.

10. How to use your rights or complain

Email subhash.imp01@gmail.com from the address on your account, or tell us how to verify it is you. We acknowledge every request within 48 hours and respond within 30 days.

Grievance Officer: Subhash Kumar Sharma, Founder and Grievance Officer, subhash.imp01@gmail.com. If you are not satisfied with our response, you can complain to the Data Protection Board of India once you have used our grievance process.

11. Children

Exavora is intended for adults preparing for professional exams. We do not knowingly process the personal data of anyone under 18 without verifiable consent from a parent or lawful guardian. If you believe a child has given us data, email us and we will delete it.

12. How we protect your data

Passwords are stored only as salted hashes. Connections are encrypted (HTTPS), sign-in uses a secure, HTTP-only session cookie, access to admin functions is restricted and logged, and repeated attempts are rate-limited. If a personal data breach occurs, we will inform the Data Protection Board of India and the people affected, as the DPDP Act requires.

13. Cookies and browser storage

We use one strictly necessary cookie to keep you signed in. Your browser also stores small settings on your device, such as whether the feedback prompt has already been shown in this session. We use no advertising or analytics cookies, so no cookie consent is needed for these.

14. If you are outside India

If you use Exavora from the EU, the UK or another country, you may have additional rights under your local law, such as the GDPR. Contact us and we will help you exercise them.

15. Changes to this notice

We will update this notice when our processing changes and show the new date at the top. If a change affects how we use data you have already given us, we will tell you before it takes effect and ask for your consent where needed.