Privacy Policy

1. Information We Collect

• Account details: your name, email address, selected avatar, sign-in/verification data and notice-acceptance records. If you sign in with Google, we receive your name, email and profile picture from Google. Passwords are stored only as a one-way hash. Authentication secrets and recovery codes require protection; never send them to support or AI tools.
• Study content: the questions, topics, notes, and any images or PDFs you submit to our AI tools, together with the material those tools generate for you.
• Usage data: which features you use, your generation history, test scores, learning-journey progress, XP and rewards.
• Payment records: subscription status, plan, billing dates, amount, currency, transaction identifiers and financial ledger records. Card, UPI and bank credentials are entered with the payment provider, not in our own payment form. Provider responses or dispute records may contain limited payment metadata; do not send full financial credentials to us.
• Device and login data: a push-notification token if you enable notifications, IP address, login time, device type and approximate location derived from network information, used for security and account information.
• Support data: feedback, privacy-rights requests, nominations, complaint responses, bug reports and crash details, which may include device information or diagnostic text.

2. How We Use Your Data

• To generate AI answers, notes, tests and study plans for you
• To personalise your learning journey and track progress
• To manage your account, subscription and billing
• To send promotional notifications or emails only when you opt in
• To protect the service against abuse, fraud and automated attacks
• To diagnose faults and improve features

We do not sell your personal data. We do use analytics and advertising measurement tools on our website — see section 5.

Authorised Graspify administrators may review account, study and support records to provide support, investigate misuse and operate the service. Access should be limited to people who need it.

3. AI Processing and Third Parties

Graspify's AI features are powered by OpenAI. When you use a tool such as the doubt solver, notes generator, mock tests or the learning journey, the content you submit is sent to OpenAI so a response can be generated and returned to you. We do not send your study content to advertising platforms.

Please do not enter passwords, financial details, identity-document numbers, or personal information about other people into the AI tools.

4. Who Else Receives Data

• OpenAI — to generate the outputs you request
• Razorpay — to process payments made on graspify.in
• Google Play Billing — to process subscriptions bought inside the Android app
• Google Firebase — to deliver push notifications
• Cloudflare Turnstile — to check for automated abuse on website forms and Android email signup. The security check processes connection and browser/device signals, including your IP address. Graspify does not put your password or study content into the security-check page.
• Analytics and advertising providers (Google, Meta, Vercel) — as described in section 5
• Hosting, database and email providers — to run the service, keep records/backups and deliver verification, account and support messages
• Legal authorities — only where required by law or valid legal process

Some providers may process or store data outside India. We must assess applicable transfer restrictions and provider contracts; this policy is not a claim that every copy is stored in India. Provider retention and deletion depend on the applicable service settings and legal duties.

5. Cookies, Analytics and Advertising

Analytics and advertising cookies only load if you accept them. On your first visit we ask, and our Google Analytics, Google Ads and Meta scripts do not load unless you agree and declare you are 18 or older. Declining changes nothing about how you can use Graspify. Your answer is remembered for six months, and you can change it any time via "Cookie Settings" in the footer.

Our website uses cookies and similar technologies for three purposes:

• Essential: to keep you signed in and to protect forms against automated abuse. These cannot be turned off without breaking the site.
• Analytics: Google Analytics and Vercel Analytics, to understand which pages and features are used.
• Advertising measurement: Google Ads conversion tracking and the Meta (Facebook) Pixel, which tell us when someone who saw one of our ads went on to sign up. These providers may also use this data for their own advertising purposes, in line with their policies.

You can block or delete cookies in your browser settings, and use Google's and Meta's own opt-out controls. Blocking analytics and advertising cookies does not affect your access to Graspify.

The Android app does not carry these advertising trackers. It uses Google Firebase only to deliver the notifications you opt into. Email signup also opens a dedicated Cloudflare security check inside the app; this is separate from website analytics and advertising.

6. Data Retention

We keep your account and study content for as long as your account exists. If you ask us to delete your account, deletion is scheduled for 30 days later. The account remains usable during that grace period, and signing in cancels the request. After that we remove your account and study content from the active Graspify database. Payment processors may separately retain payment records under their own legal obligations. Our financial ledger and restricted privacy-request records may also remain after active-account deletion where needed for legal, dispute or accountability purposes. Closed privacy-request records have a one-year retention period unless a legal hold applies. Retention must be reviewed and cannot justify indefinite storage of all study content. Backup copies may persist until the hosting provider's backup retention period ends.

7. Data Security

Data is transmitted over encrypted connections and passwords are stored hashed. We apply rate limiting, bot protection and access controls. No system can be guaranteed completely secure, and we cannot promise absolute security.

If a breach affects personal data, we investigate, contain it and make the user and authority notifications required by applicable law. CERT-In incident reporting and DPDP breach notification are distinct duties; DPDP obligations have phased commencement. We do not claim that every DPDP provision is already in force or that every live safeguard has been independently certified.

8. Students Under 18

We intend to support students under 18 with suitable safeguards, but a verified-parent onboarding integration is not yet available. A cookie age checkbox, parent email, payment or acceptance of Terms is not verified parental consent. We do not claim that the child-account flow has been completed. Parents may contact us about an existing child account; do not upload identity documents to an AI tool or ordinary feedback form.

A parent or guardian may contact us at founder@graspify.in to review, correct or delete a child's data, and we will act on such a request.

9. Your Rights

• Access: request a copy of the personal data we hold about you
• Correct: update or correct inaccurate information
• Delete: request deletion of your account and data
• Withdraw consent: immediately change optional marketing preferences or website Cookie Settings; submit a withdrawal request for other processing through Privacy & your data. Withdrawal may prevent a feature whose processing is necessary, and does not erase processing already lawfully performed or override required retention.

To exercise these rights or raise a privacy grievance, open Account Settings → Privacy & your data while signed in, or email founder@graspify.in if you cannot sign in. We may verify your identity before sharing or changing data. Requests are reviewed by our team; submitting one does not instantly change or erase your data. We respond to privacy grievances within 90 days, without replacing a shorter consumer or other statutory deadline. You may also request to nominate a person as permitted by applicable law. See Complaints & grievance redressal for escalation, including official Data Protection Board channels when applicable.

10. Changes to This Policy

We may update this policy and change the "last updated" date above. If a change requires a new consent, we will ask you for it separately.