Legal

Privacy Policy

Last updated: 16 October 2026

This policy explains, in plain language, what personal data PYQKart (“we”, “us”) collects when you use pyqkart.com, why we collect it, who else handles it, how long we keep it, and what you can do about it. We handle your data in line with the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 and its Rules. For this policy, PYQKart is the “Data Fiduciary”: we decide why and how your data is used.

By creating an account, verifying your phone number or buying from us you agree to this policy. Our Terms & Conditions apply alongside it.

1. What we collect, and why

• Account details — your name and email address (from Google sign-in) and an account ID. Used to create and secure your account and to show you what you own.
• Mobile number — if you verify one. We send a one-time password (OTP) by SMS to confirm each account belongs to a real person, and the verified number stays linked to your account. We do not use it for marketing or calls.
• Orders and payments — what you bought, the amount, any coupon, order and payment reference numbers, and the dates. Used to deliver your purchase, restore your access, send your invoice, handle payment problems and meet tax and accounting rules. Your card, UPI and bank details are entered with our payment gateway (Razorpay) and are never seen or stored by us.
• Study activity — your mock-test attempts, answers, scores and progress, so you can resume a paper and see your result. Some of this is kept in your own browser; some may be saved against your account.
• Usage and device data — pages visited, approximate location, device, browser and similar information, collected through Google Analytics (see section 4), and your IP address and device signals that our security checks use to stop abuse.
• Support messages — if you email us, we keep the conversation so we can help you.

We collect only what is needed for these purposes, and we do not ask for information we have no use for.

2. What we do not do

• We do not sell or rent your personal data.
• We do not show advertising, build advertising profiles, or share your data with advertisers.
• We do not use your mobile number or email for marketing unless you separately and clearly agree to it.

3. Why we may use your data

• To create and secure your account, and to check that accounts belong to real people;
• To deliver what you buy, grant and restore access, and send invoices and service messages;
• To process payments, prevent fraud and resolve payment disputes;
• To understand, in aggregate, how the site is used so we can fix and improve it;
• To answer your questions and complaints;
• To comply with the law, for example tax, accounting and legal requests.

4. Cookies, local storage & analytics

• Essential — sign-in and security, your cart, your light/dark theme, and your mock-test progress are kept in cookies or your browser’s local storage. The site cannot work without them.
• Analytics — we use Google Analytics 4 to count visits and see which pages and features are used. It sets cookies and receives your IP-derived approximate location, device and browser details and the pages you view. We use the reports to improve the site, not to identify you or to advertise to you.
• Security — Google reCAPTCHA runs when you verify your phone, to tell people from bots.

You can block or delete cookies and local storage in your browser settings, and opt out of Google Analytics with Google’s browser add-on. Blocking essential storage may stop sign-in, the cart or your progress from working.

5. Who else handles your data

We use service providers who process data for us, under their own security obligations, and only to provide their service:

• Google (Firebase Authentication, Cloud Firestore, Cloud Functions, Analytics, reCAPTCHA, SMS verification) — sign-in, our database, phone verification and analytics;
• Razorpay — payment processing;
• Cloudflare — secure delivery of the site and files, and abuse protection;
• Our email provider — sending your invoice and service emails.

We share personal data with anyone else only if the law requires it, for example a lawful order from a court or authority, or to protect our rights or users from fraud or abuse.

6. Where your data is stored

Our database is hosted in India (Delhi). Some of the providers above, such as Google Analytics and SMS delivery, may process data on servers outside India. We transfer personal data abroad only as the Digital Personal Data Protection Act allows.

7. How long we keep it

• Account and study data — for as long as your account is active, and until you ask us to delete it.
• Order and payment records — for as long as tax, accounting or other laws require us to keep them, even after you delete your account.
• Security and access logs — for the minimum period the law and our security needs call for.
• Analytics data — according to Google Analytics’ retention settings for our property.

When data is no longer needed for its purpose and no law requires us to keep it, we erase it.

8. Security

We use reasonable technical and organisational safeguards, including encryption in transit, access controls and server-side checks of payments. No system is perfectly secure. If a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.

9. Your rights

Under the Digital Personal Data Protection Act, 2023 you may:

• ask for a summary of the personal data we hold about you and how it is used, and who it has been shared with;
• ask us to correct, complete or update it;
• ask us to erase it, unless we must keep it by law;
• withdraw a consent you gave, which is as easy to do as giving it — withdrawing does not undo what we lawfully did before, and some features (such as buying or taking a mock test) need certain data to work;
• nominate another person to exercise these rights for you if you die or become unable to; and
• have any complaint about your data handled by us.

To use a right, email [email protected] from your registered address, saying what you want. We may ask you to confirm who you are. Deleting your account removes your personal details and study data, except records we are required to retain.

10. Children

PYQKart is meant for adults preparing for placements. If you are under 18, a parent or guardian must create the account and agree to this policy for you. We do not knowingly collect a child’s data without that consent, and we do not track children’s behaviour for advertising or send them targeted advertising. If you believe a child’s data has been given to us without a parent’s consent, write to us and we will delete it.

11. Grievances & complaints

For any concern about your personal data, contact our Grievance Officer first:

• Grievance Officer: PYQKart Grievance Cell
• Email: [email protected]

We acknowledge a complaint within 48 hours and reply within the time the law prescribes. If you are not satisfied with our reply, you may complain to the Data Protection Board of India.

12. Changes to this policy

We may update this policy as our service or the law changes. The new version will be posted here with a revised date, and if a change materially affects how we use your data we will tell you clearly, and ask for your consent again where the law requires it.

13. Contact

Questions about privacy? Email us at [email protected].