Privacy Policy

XYIEO is an online education platform operated by ARVIND KUMAR, an individual based in India (“XYIEO”, “we”, “us”, or “our”). We operate a dedicated NEET UG examination simulation, diagnostic analytics, and NCERT-grounded learning platform. “XYIEO”, “we”, “us”, and “our” refer to the XYIEO platform and its operator. This Privacy Policy describes how personal and educational data is collected, processed, protected, and managed when you use our web application, in accordance with applicable laws of India including the Information Technology Act, 2000, Consumer Protection (E-Commerce) Rules, 2020, and foundational frameworks of the Digital Personal Data Protection (DPDP) Act, 2023.

1. Information We Process

We collect and process only the information strictly necessary to provide authentication, deliver mock examinations, track educational progress, provide AI tutoring, and administer subscriptions:

• Account & Profile Information: Full name, registered email address, securely hashed password (using industry-standard bcrypt with 12 salt rounds; plaintext passwords are never stored), target examination year, and optional profile preferences.
• Age Classification & Date of Birth: Date of birth is collected to determine age classification (student under 18 vs. adult 18+). For minor accounts purchasing paid tiers, parent or lawful guardian contact information is collected for commercial billing approval.
• Educational Activity & Test Data: Mock examination attempts, selected answers, section timings, scores, accuracy metrics, topic drill history, PYQ (previous year question) attempts, saved notes, bookmarks, and mistake notebook entries.
• AI Tutor Interactions: Student questions submitted to the AI Tutor and session transcripts. The AI Tutor processes educational queries alongside relevant NCERT textbook evidence to generate synthesized explanations. No student personal identifiers are transmitted to third-party AI models.
• Payment & Transaction Records: Transaction identifiers, subscription plan tiers, billing cycles, coupon codes, and payment status returned by our payment gateway. We do not store raw credit/debit card numbers or UPI PINs.
• Technical & Security Logs: Authentication session tokens, HTTP request logs, optional aggregate website telemetry (strictly opt-in via Google Analytics 4 with zero student personal identifiers), IP addresses used ephemerally for rate limiting and fraud prevention, and device browser headers necessary for service security. All server logs automatically redact sensitive tokens, passwords, and secrets.

2. Educational Access & Minor Data Protection

XYIEO operates a student-first model designed to support medical aspirants:

• Educational Access: Students below 18 years of age have full access to standard educational features, including mock tests, practice questions, PYQs, and the NCERT AI Tutor.
• Commercial Approval for Paid Plans: Purchasing a paid subscription for a minor account requires authorization from a parent or lawful guardian. The guardian's email address is designated as the billing contact for that subscription, while the educational entitlement remains with the student.
• Zero Behavioral Advertising: We do not sell student personal data, engage in cross-site behavioral profiling, or display third-party advertisements on the platform.
• DPDP Future Readiness: Our parental consent workflow represents an engineering readiness control aligned with future technical standards prescribed under the Digital Personal Data Protection Act, 2023.

3. AI Tutor & External Processing

Our AI Tutor feature provides automated explanations grounded in NCERT curriculum source material. When an AI Tutor query is generated, the query text and relevant NCERT excerpts are processed by our backend AI provider (Google Gemini). We do not transmit student names, email addresses, dates of birth, guardian contact details, or payment records to external AI model providers.

4. Service Providers & Third-Party Processing

We share data with trusted technical infrastructure providers solely to operate the platform:

• Payment Gateway: Cashfree Payments processes digital subscription transactions securely under Reserve Bank of India (RBI) regulations and PCI-DSS standards.
• Transactional Email: Resend delivers essential account emails such as email verification, password reset, guardian commercial consent confirmation, grievance acknowledgements, and billing receipts.
• Cloud Hosting & Database: Vercel and Neon/PostgreSQL provide secure application hosting and encrypted database storage.
• Website Telemetry & Performance Analytics: Google Analytics 4 (Google LLC) is used strictly on an explicit opt-in basis to evaluate aggregate website traffic, application performance, and navigational uptime. Student names, email addresses, dates of birth, test answers, question content, guardian records, and payment tokens are strictly excluded. Advertising features, Google Signals, and cross-site remarketing are permanently disabled.

5. Data Retention & Permanent Account Deletion

We retain personal and educational data for as long as your account remains active or as needed to maintain academic test records, comply with financial accounting obligations, or resolve disputes.

You can permanently delete your account and all associated test data at any time directly through your Profile Settings. Deleting your account automatically cancels active recurring payment mandates at the gateway and cascades deletion across all test attempts, mistake records, bookmarks, notes, and AI chats.

6. Statutory Grievance Redressal Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Consumer Protection (E-Commerce) Rules, 2020, our designated Grievance Officer details are published below:

7. Customer Care Contact