Privacy Policy

1. About this policy

This Privacy Policy ("Policy") describes how OlympAI ("we," "us," or "our"), a sole-proprietorship business based in Gurugram, Haryana, India, collects, uses, stores, and shares information when you use the OlympAI website at olympai.in and the learner application at learner.olympai.in (together, the "Platform").

This Policy is published in compliance with:

• The Information Technology Act, 2000 ("IT Act")
• The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules")
• The Digital Personal Data Protection Act, 2023 ("DPDPA") and rules thereunder

By accessing or using the Platform, you agree to this Policy. If you do not agree, please discontinue use immediately.

2. Who we are

OlympAI is an AI-powered Olympiad preparation platform designed for students in Classes 6–8 across India. We provide unlimited, freshly generated practice questions, chapter notes, concept explanations, and progress analytics to help students excel in school-level Olympiad examinations.

Data Fiduciary: OlympAI
Contact: contact@olympai.in
Address: Gurugram, Haryana, India

3. Information we collect

3.1 Information You Provide

• Account information: Full name, email address, class/grade, school name (optional)
• Parent/guardian information: Parent name, email address (for weekly progress reports and notifications)
• Payment information: For paid plans, we collect billing details. Card data is processed directly by our payment gateway (Razorpay) and is never stored on our servers.
• Communications: Any messages you send us at contact@olympai.in or support@olympai.in

3.2 Information Collected Automatically

• Practice activity: Questions answered, accuracy rates, time spent, topic performance, streaks
• Device & technical data: IP address, browser type, operating system, device identifiers
• Usage data: Pages visited, features used, session duration, referral source
• Cookies and local storage: Session tokens, theme preferences (light/dark mode)

3.3 Sensitive Personal Data or Information (SPDI)

Under the SPDI Rules, we may collect financial information (for payment processing). We do not collect passwords in plain text, biometric data, health data, or sexual orientation. All SPDI is handled with enhanced security measures as required by law.

4. How we use your information

• Provide, operate, and improve the Platform and its AI features
• Generate fresh practice questions matched to your child's grade, subject and chapter, and flag chapters that need another look
• Send weekly progress reports to linked parent email addresses
• Send transactional emails (account confirmation, payment receipts, subscription alerts)
• Process payments and manage subscriptions
• Detect and prevent fraud, abuse, and technical issues
• Comply with applicable legal obligations
• Respond to support queries
• Conduct aggregate, anonymised analytics to improve our AI models (no individual is identifiable in these analyses)

We do not use your data for targeted advertising to third parties, and we do not sell personal data.

5. Children's privacy

Our Platform is designed for students in Classes 6–8, who are typically between 11 and 14 years of age. Under the Digital Personal Data Protection Act, 2023, processing personal data of children (persons under 18 years) requires verifiable parental consent.

• When a student account is created, we collect and verify a parent/guardian email address.
• We send a consent notification to the parent email before activating the account.
• Parents may withdraw consent at any time by emailing contact@olympai.in, which will result in the account being deactivated and data deleted within 30 days.
• We do not serve behavioural advertising to children.
• We do not enable social features that allow children to share content publicly.

6. Sharing of information

We share personal data only in the following circumstances:

• Service providers: We use Firebase (Google LLC) for authentication and database, Google Analytics for usage analytics, and Razorpay for payment processing. These providers act as data processors and are contractually bound to use data only as instructed.
• Legal requirements: When required by law, court order, or government authority in India.
• Business transfers: In the event of a merger or acquisition, subject to the same privacy protections.
• With your explicit consent: For any purpose not described here.

We do not sell, rent, or trade personal data to advertisers or data brokers.

7. Data Retention

• Active accounts: Data is retained for as long as the account is active.
• Deleted accounts: Personal data is purged within 30 days of a deletion request, except where retention is required by law (e.g., financial records retained for 7 years as required under the Companies Act / accounting standards).
• Anonymised data: Aggregate, anonymised practice data may be retained indefinitely for AI model improvement.

8. Data security

We implement industry-standard security practices including:

• TLS/HTTPS encryption for all data in transit
• Firebase Security Rules restricting data access to authenticated users
• Role-based access controls limiting internal data access to authorised personnel
• Regular security reviews of third-party integrations

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your rights, we will notify affected users and the relevant authority as required by the DPDPA.

9. Cookies and tracking

Cookies and tracking work on a two-tier consent model, shown as a banner on your first visit:

• Essential cookies always run — session state, theme preference, dismissed banners. No consent required.
• Non-essential cookies (marketing measurement) run only if you choose “Accept all” in the consent banner. If you choose “Essential only” or “Reject non-essential,” these tools do not load.

You may revisit this choice at any time by clearing your browser's local storage for this site, which re-shows the consent banner. We honour the Digital Personal Data Protection Act 2023's parental-consent requirement for users under 18 by making non-essential cookies opt-in.

Third parties that may process data through this site:

• Google Analytics 4 (Google LLC) — pageview and traffic measurement. Runs in a cookieless, consent-denied mode by default; full attribution only after you accept.
• PostHog (PostHog Inc.) — first-party product analytics and browser error tracking, used to understand how the site is used and to fix bugs. Does not power ad targeting or cross-site tracking, so it runs regardless of the cookie banner choice, the same as essential cookies.
• Meta Pixel (Meta Platforms, Inc.) — marketing/remarketing measurement. Only loads after you choose “Accept all.”

10. Your rights

Under the DPDPA 2023 and applicable Indian law, you have the right to:

• Access: Request a copy of personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (subject to legal retention requirements).
• Withdrawal of consent: Withdraw consent for data processing at any time; this does not affect the lawfulness of processing before withdrawal.
• Nominate: Nominate another individual to exercise your rights on your behalf in the event of your death or incapacity.
• Grievance redressal: Lodge a complaint with our Grievance Officer (see Section 12).

To exercise these rights, email contact@olympai.in with the subject line "Data Rights Request." We will respond within 30 days.

11. Third-party links

Our Platform may contain links to third-party websites (e.g., Olympiad body websites). This Policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to read their privacy policies.

12. Grievance Officer

In accordance with the Information Technology Act, 2000, and the DPDPA 2023, the following person has been designated as the Grievance Officer:

If you are not satisfied with the resolution provided by the Grievance Officer, you may escalate to the Data Protection Board of India once it is constituted under the DPDPA 2023.

13. Changes to this policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where required, notify you by email. Continued use of the Platform after changes constitutes acceptance of the revised Policy.

14. Contact us

For any questions about this Privacy Policy or our data practices:

• Email: contact@olympai.in
• Support: support@olympai.in
• Address: Gurugram, Haryana, India