Privacy Policy

1. About this policy

This Privacy Policy ("Policy") describes how OlympAI ("we," "us," or "our"), a sole-proprietorship business based in Gurugram, Haryana, India, collects, uses, stores, and shares information when you use the OlympAI website at olympai.in and the learner application at learner.olympai.in (together, the "Platform").

This Policy is published in compliance with:

• The Information Technology Act, 2000 ("IT Act")
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
• The Digital Personal Data Protection Act, 2023 ("DPDPA") and rules thereunder

By accessing or using the Platform, you agree to this Policy. If you do not agree, please discontinue use immediately.

2. Who we are

OlympAI is an AI-powered Olympiad preparation platform designed for students in Classes 6–8 across India. We provide unlimited, freshly generated practice questions, chapter notes, concept explanations, and progress analytics to help students excel in school-level Olympiad examinations.

Data Fiduciary: OlympAI
Contact: contact@olympai.in
Address: Gurugram, Haryana, India

3. Information we collect

3.1 Information You Provide

• Account information: Full name, email address, class/grade, school name (optional)
• Account details: the parent or guardian's name and mobile number, and an email address where one is provided. The mobile number is required to create an account and is verified by a one-time password sent over SMS. An email address is optional on mobile sign-up and required on the other sign-up routes.
• Payment information: For paid plans, we collect billing details. Card data is processed directly by our payment gateway (Razorpay) and is never stored on our servers.
• Reward orders: if you order a mug with your Rewards balance, the name to print on it (usually the student's first name), and the delivery name, phone number and postal address (address lines, city, state and PIN code).
• Message choices: when you agreed to our Terms and this Policy at registration, which covers our messages (Terms, Section 3.4), and your WhatsApp, email and app-notification settings, including any STOP reply or email unsubscribe.
• WhatsApp verification: if you send OlympAI the start message on WhatsApp to verify your number, the number it came from and when you sent it, which we keep as the record of that verification.
• Communications: Any messages you send us at contact@olympai.in or support@olympai.in

3.2 Information Collected Automatically

• Practice activity: Questions answered, accuracy rates, time spent, topic performance, streaks
• Device & technical data: IP address, browser type, operating system, device identifiers
• Usage data: Pages visited, features used, session duration, referral source
• Cookies and local storage: Session tokens, theme preferences (light/dark mode)
• Invite code: if you open OlympAI through an invite link, we store the invite code on your device, in the browser's local storage on our website and in the learner app, for 30 days. Its only use is to credit the family that invited you when you register. It is deleted from the device after 30 days, or once you have registered.

3.3 Sensitive Personal Data or Information (SPDI)

Under the SPDI Rules, we may collect financial information (for payment processing). We do not collect passwords in plain text, biometric data, health data, or sexual orientation. All SPDI is handled with enhanced security measures as required by law.

4. How we use your information

• Provide, operate, and improve the Platform and its AI features
• Generate fresh practice questions matched to your child's grade, subject and chapter, and flag chapters that need another look
• Send weekly progress reports to linked parent email addresses
• Send transactional emails (account confirmation, payment receipts, subscription alerts)
• Process payments and manage subscriptions
• Run the Rewards balance: work out what your family has earned, including whether a family you invited has met the condition for the invite to count; keep your balance and its history; and apply it at checkout
• Make and deliver mug orders placed with the Rewards balance: we print and dispatch them ourselves, through PrintU, OlympAI's own fulfilment service, and share the delivery details with the courier that delivers them (Section 6)
• Send you, the parent or guardian, messages on WhatsApp and by email — account and payment updates, your child's progress reports and practice reminders, exam reminders, and information about OlympAI PRO, offers and the Rewards balance — and send app notifications about practice, exams and the Rewards balance to the student's device if notifications are allowed there, unless you have switched them off. You can switch each one off in the app's Settings, reply STOP to a WhatsApp message, or use the unsubscribe link in an email. Messages we must send about your account, payments or security still reach you
• Detect and prevent fraud, abuse, and technical issues
• Comply with applicable legal obligations
• Respond to support queries
• Conduct aggregate, anonymised analytics to improve our AI models (no individual is identifiable in these analyses)

We do not use your data for targeted advertising to third parties, and we do not sell personal data.

5. Children's privacy

Our Platform is designed for students in Classes 6–8, who are typically between 11 and 14 years of age. Under the Digital Personal Data Protection Act, 2023, processing personal data of children (persons under 18 years) requires verifiable parental consent.

• When a student account is created, we collect and verify a parent/guardian email address.
• We send a consent notification to the parent email before activating the account.
• Parents may withdraw consent at any time by emailing contact@olympai.in, which will result in the account being deactivated and data deleted within 30 days.
• We do not show advertising from other companies, and we do not use a student's data to target anyone else's advertising. Inside the app we do show our own offers — OlympAI PRO and the Rewards balance — and some of them appear after a milestone, such as a practice streak or a paper score.
• We do not offer public profiles, feeds, or messaging between users, and nothing a student does on OlympAI is published. The app does offer an invite option, on screens a parent or a student may see: tapping it opens the messaging app, email or share menu on that device, with an invite link or code ready to send. We do not send invites ourselves, we do not read your contacts, and we do not learn who an invite went to; we record only that the invite button was used and which way it was shared. If you choose to share a result card, it shows the student's first name and the score you chose to share.
• If your family joined through an invite, the family that invited you can see that you joined, a first name and initial, and how many of the practice days needed for their invite to count have been met. They cannot see scores, subjects or anything else about your account.

6. Sharing of information

We share personal data only in the following circumstances:

• Service providers: We use Firebase (Google LLC) for authentication and database, Google Analytics for usage analytics, and Razorpay for payment processing. These providers act as data processors and are contractually bound to use data only as instructed.
• Messages: MSG91 sends our WhatsApp messages, emails and SMS, including the one-time passwords, and receives the phone number or email address and the message content to do so. PostHog helps us decide which message to send and when; for this it receives only account IDs, dates and app events, never phone numbers, email addresses or names.
• Mug orders: when you order a mug with your Rewards balance, we share the name to print and the delivery name, phone number and postal address with PrintU, OlympAI's own fulfilment service, which prints and dispatches the mug, and the delivery name, phone number and address with the courier that delivers it. The courier uses these details only to deliver your mug.
• Legal requirements: When required by law, court order, or government authority in India.
• Business transfers: In the event of a merger or acquisition, subject to the same privacy protections.
• With your explicit consent: For any purpose not described here.

We do not sell, rent, or trade personal data to advertisers or data brokers.

7. Data Retention

• Active accounts: Data is retained for as long as the account is active.
• Deleted accounts: Personal data is purged within 30 days of a deletion request, except where retention is required by law (e.g., financial records retained for 7 years as required under the Companies Act / accounting standards).
• Mug delivery details: the name printed, and the delivery name, phone number and address, are deleted 90 days after the order is delivered or closed, including in PrintU's records. A record that the order was placed, what it cost in balance and when, is kept with your Rewards balance history.
• Rewards balance history: kept for as long as the account is active. If you delete your account, the unspent balance is lost (see our Terms, Section 4.5) and the history is deleted or de-linked from you with the rest of the account.
• Anonymised data: Aggregate, anonymised practice data may be retained indefinitely for AI model improvement.

8. Data security

We implement industry-standard security practices including:

• TLS/HTTPS encryption for all data in transit
• Firebase Security Rules restricting data access to authenticated users
• Role-based access controls limiting internal data access to authorised personnel
• Regular security reviews of third-party integrations

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify affected users and the relevant authority as required by the DPDPA.

9. Cookies and tracking

Cookies and tracking work on a two-tier consent model, shown as a banner on your first visit:

• Essential cookies always run — session state, theme preference, dismissed banners. No consent required.
• Non-essential cookies (marketing measurement) run only if you choose “Accept all” in the consent banner. If you choose “Essential only” or “Reject non-essential,” these tools do not load.

You may revisit this choice at any time by clearing your browser's local storage for this site, which re-shows the consent banner. We honour the Digital Personal Data Protection Act 2023's parental-consent requirement for users under 18 by making non-essential cookies opt-in.

Third parties that may process data through this site:

• Google Analytics 4 (Google LLC) — pageview and traffic measurement. Runs in a cookieless, consent-denied mode by default; full attribution only after you accept.
• PostHog (PostHog Inc.) — first-party product analytics and browser error tracking, used to understand how the site is used and to fix bugs. Does not power ad targeting or cross-site tracking, so it runs regardless of the cookie banner choice, the same as essential cookies.
• Meta Pixel (Meta Platforms, Inc.) — marketing/remarketing measurement. Only loads after you choose “Accept all.”

10. Your rights

Under the DPDPA 2023 and applicable Indian law, you have the right to:

• Access: Request a copy of personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal retention requirements).
• Withdrawal of consent: Withdraw consent for data processing at any time; this does not affect the lawfulness of processing before withdrawal.
• Nominate: Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Grievance redressal: Lodge a complaint with our Grievance Officer (see Section 12).

To exercise these rights, email contact@olympai.in with the subject line "Data Rights Request." We will respond within 30 days.

11. Third-party links

Our Platform may contain links to third-party websites (e.g., Olympiad body websites). This Policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to read their privacy policies.

12. Grievance Officer

In accordance with the Information Technology Act, 2000, and the DPDPA 2023, the following person has been designated as the Grievance Officer:

If you are not satisfied with the resolution provided by the Grievance Officer, you may escalate to the Data Protection Board of India once it is constituted under the DPDPA 2023.

13. Changes to this policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required, notify you by email. Continued use of the Platform after changes constitutes acceptance of the revised Policy.

14. Contact us

For any questions about this Privacy Policy or our data practices:

• Email: contact@olympai.in
• Support: support@olympai.in
• Address: Gurugram, Haryana, India