1. Personal Data We Collect

2. How We Use Your Data

We collect and process personal data for the following purposes:

• Account creation, authentication, and management of your profile;

• Delivering AI-generated study content, assessments, certifications, and interview simulations personalised to you;

• Processing subscription payments and issuing receipts through Razorpay;

• Calculating and enforcing subscription credit limits and plan entitlements;

• Tracking your learning progress, XP, streaks, and certifications for in-platform gamification;

• Sending transactional communications: subscription confirmations, renewal reminders, and security alerts;

• Sending marketing communications if you have explicitly opted in (you may opt out at any time);

• Improving and monitoring platform performance, detecting abuse, and ensuring security;

• Complying with applicable Indian laws, including tax obligations under GST and the Income Tax Act.

3. Legal Basis for Processing

Under the DPDP Act, 2023, we process your personal data on the following bases:

• Consent — for account registration, marketing communications, and optional features;

• Contractual necessity — to deliver the Services you subscribe to;

• Legitimate purpose — for platform security, fraud prevention, and aggregate analytics;

• Legal obligation — to comply with Indian tax, financial reporting, and regulatory laws.

4. Data Sharing and Processors

We do not sell your personal data. We share personal data only with the following processors and only to the extent necessary to provide the Services:

We may also disclose your data if required by Indian law, court order, or a competent government authority, or to protect the rights and safety of users and the public.

5. Data Retention

6. Your Rights as a Data Principal

Under the DPDP Act, 2023, you have the following rights regarding your personal data:

• Right to Access — Request a summary of personal data we hold about you (email privacy@Nuroversity.com, response within 30 days);

• Right to Correction — Request correction of inaccurate or incomplete data;

• Right to Erasure — Request deletion of your personal data (subject to retention obligations);

• Right to Data Portability — Request a machine-readable export of your data;

• Right to Withdraw Consent — Withdraw marketing or optional feature consent at any time via Account Settings;

• Right to Grievance Redressal — Lodge a complaint with our Grievance Officer at grievance@Nuroversity.com;

• Right to Approach DPBI — Lodge a complaint with the Data Protection Board of India if your grievance is unresolved.

We will not discriminate against you for exercising any of these rights.

7. Security Measures

• All data transmitted between your device and our servers is encrypted using TLS 1.3;

• Sensitive data is encrypted at rest using AES-256;

• Passwords are stored as bcrypt hashes (cost factor ≥ 12) — plaintext passwords are never stored;

• Role-Based Access Control restricts internal access to personal data on a strict need-to-know basis;

• All API endpoints require authenticated tokens with rate limiting and input validation;

• In the event of a reportable breach, we will notify the DPBI within 72 hours and affected users without undue delay.

8. Cookies

We use cookies for:

• Session and authentication state (essential — cannot be disabled without losing login);

• Remembering your in-app preferences such as dark/light mode (functional);

• Aggregate, anonymised usage analytics (no PII shared with third parties);

• Recording your consent choices (compliance).

We do not use cookies or tracking pixels for targeted advertising, behavioural profiling, or selling data to advertisers.

9. Privacy Contact

For privacy-related requests or complaints, contact our Data Protection contact:

• Privacy enquiries: privacy@Nuroversity.com

• Grievances: grievance@Nuroversity.com (acknowledged within 24 hours, resolved within 30 days)

• All legal matters: legal@Nuroversity.com

If your grievance is unresolved, you may file a complaint with the Data Protection Board of India (DPBI) once its formal complaint mechanism is operational.

10. Updates to This Policy

We may update this Privacy Policy when there are changes to our data practices or applicable law. Material changes will be communicated via email and in-app notification at least 15 days before taking effect, and will require your re-confirmation via an in-app consent gate.