MastaPrep Privacy Policy

Information you provide to us. Personal information you may provide to us through the Service or otherwise includes:

• Contact and account data, such as your email address, sign-in information, and the name or profile image supplied through an optional sign-in provider.
• Eligibility data, such as your age group, country and guardian authorisation status, supplied by you, your guardian or your sign-in provider. We do not need a precise birth date where an age band and verification result are sufficient.
• Profile data, such as the nickname you choose, and any study preferences you add to your account (optional target score, planned exam date, study preferences).
• Communications data based on our exchanges with you, including when you contact us through the Service, report a question, or otherwise.
• Subscription data, such as information relating to or needed to service your subscription to the Service, including plan, amount, currency, subscription and payment references, status, dates, invoices and cancellation/refund records.
• Marketing data, such as your preferences for receiving our marketing communications.
• User-generated content data, such as your answers and attempts, practice results and scores, review schedule, vocabulary progress, streaks, XP and estimates; comments, questions and messages, including with the Masta tutor when available; and other content or information that you generate, transmit, or otherwise make available on the Service, as well as associated metadata.
• Social data, such as friend relationships, challenges, visibility choices, reports and blocks, where you choose to use social features.
• Relationship and payer data, such as a parent or payer's email, relationship or authority verification where needed, the student-account connection and billing communications.
• Payment data needed to complete transactions is collected directly by our payment processor; we do not receive your full card number or card security code.
• Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Third-party sources. We may receive limited personal information from:

• Service providers that provide services on our behalf or help us operate the Service or our business (for example, payment confirmation from our payment processor).
• Third-party sign-in services, such as Google, that you use to log into the Service.
• This data may include your name, email address and profile picture, based on your account settings on that service.

Automatic data collection. We and our service providers may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, such as:

• Device data, such as your computer or mobile device's operating system type and version, browser type, screen size, device type, IP address, language settings and general location information such as country.
• Online activity data, such as pages or screens you viewed, access times, error and security logs, and whether you have opened our emails or clicked links within them.

Data about others. Our social features let you invite friends who already use the Service, and our parent-payer feature lets you send a payment link to an adult. Please do not share someone's contact details with us unless you have their permission to do so.

Cookies and other technologies. Some of our automatic data collection is facilitated by cookies and similar browser storage. We use them to keep you signed in, remember necessary settings and protect the Service. We do not currently use optional analytics or marketing cookies, so there is no cookie consent panel; if optional technologies are ever added, they will be listed in the Cookie notice below and will run only after any permission the law requires. See the Cookie notice for the inventory.

Artificial intelligence ("AI") technologies. We use AI services provided by the AI providers listed in "How we share your personal information" to draft and check our practice content, to operate the Masta tutor when it is available, and to assist support and quality checks. When you use an AI-powered feature, the text you enter and the context needed to answer (for example, the question you are working on and your answer) are sent to the AI provider to generate the response. AI providers act as our service providers under contract; we do not permit them to use your personal information to train their models, and we do not train AI models on your personal information. and restrict the data

• sent to what the feature needs.]

Practice questions, answer explanations, vocabulary material, skill introductions and full-length practice tests on MastaPrep are drafted with AI tools against the published skill taxonomy of the relevant exam and checked by editorial review before publication. They are original MastaPrep material, not official exam questions. AI and statistical models also select your next questions, set difficulty, schedule review and produce your practice estimate. These are automated educational recommendations and may be wrong. They do not decide admission, issue official exam scores or establish a student's ability for a school or employer, and they produce no legal or similarly significant effect on you. You can contact us about an incorrect record or an estimate you do not understand, and every question carries a report control.

We assess the additional protections required for children's profiling before enabling personalised features. We do not use a child's learning history for targeted advertising, and we do not use anyone's personal information to train AI models.

We may use your personal information for the following purposes or as otherwise described at the time of collection:

Service delivery and operations. We may use your personal information to:

• provide the Service and operate our business;
• enable security features of the Service;
• establish and maintain your user profile on the Service, determine eligibility and provide the correct authorisation process;
• facilitate social features of the Service, such as leagues, friend challenges and visibility choices you make;
• deliver paid access, manage renewals, resolve billing issues and meet recordkeeping duties;
• communicate with you about the Service, including by sending Service-related announcements, updates, security alerts, and support and administrative messages; and provide support for the Service, and respond to your requests, questions and feedback.

Service personalization, which may include using your personal information to:

• estimate your current practice level, select questions, schedule reviews and display progress;
• personalize your experience with the Service and our Service-related communications;
• and remember your selections and preferences as you navigate webpages.

Service improvement and analytics. We may use your personal information to analyze your usage of the Service, improve the Service, and help us understand user activity on the Service. We do not currently use third-party analytics tools; if we add one, it will be listed in the Cookie notice and will run only with the permissions the law requires.

Marketing. We may send you direct marketing communications, with the consent the law requires, and may personalize these messages based on your study preferences. You may opt-out of our marketing communications as described in the Your choices section below. Optional marketing is not a condition of using the learning service. We do not engage in interest-based advertising and we do not share information about our users with advertising companies.

Compliance and protection. We may use your personal information to:

• comply with applicable laws, lawful requests, and legal process, such as to respond to requests from government authorities;
• protect our, your or others' rights, privacy, safety or property (including by making and defending legal claims);
• audit our internal processes for compliance with legal and contractual requirements or our internal policies;
• enforce the terms and conditions that govern the Service; and prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks, identity theft and abuse of the free plan or the free trial.

To create aggregated, de-identified or anonymized data. We may create aggregated, de-identified or anonymized data from your personal information and other individuals whose personal information we collect. We make personal information into de-identified or anonymized data by removing information that makes the data identifiable to you and we will not attempt to reidentify any such data. We may use this aggregated, de-identified or anonymized data for our lawful business purposes, including to analyze and improve the Service (for example, question difficulty calibration) and to publish content statistics. We do not use it to train AI models.

Lawful basis. We use information where permitted by the law that applies: to provide a contracted service to the appropriate contracting party; with valid consent where required (including verifiable guardian consent for students under 18); to meet legal obligations; and, where available and appropriate, for legitimate interests such as proportionate security, fraud prevention and support. We assess those interests against users' rights, with particular care for children. We do not assume that a contract with a parent supplies a lawful basis for every use of the child's information.

Further uses. In some cases, we may use your personal information for further uses, in which case we will ask for your consent to use your personal information for those further purposes if they are not compatible with the initial purpose for which information was collected. New uses requiring consent will not rely solely on posting an updated notice.

We may share your personal information with the following parties (or as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection).

Service providers. Third parties that provide services on our behalf or help us operate the Service or our business (such as hosting, authentication and database services, AI providers, email delivery and, if added, website analytics). They receive information needed for their role, subject to applicable contracts and safeguards. Our verified provider list is:

• Supabase — authentication, database and file storage for accounts and learning records. supabase.com/privacy
• Vercel — hosting and delivery of the Service, including server logs. vercel.com/legal/privacy-policy
• Anthropic — the AI model behind the Masta tutor, where offered; it receives the question, your answer and your message, never your name or contact details. anthropic.com/privacy
• Resend — delivery of transactional email (receipts, reminders, parent and deletion notices). resend.com/legal/privacy-policy
• Google — sign-in with Google, only if you choose it. policies.google.com/privacy
• Razorpay and PayPal — payment processing (below).

Payment processors. Any payment card, UPI or bank information you use to make a purchase on the Service is collected and processed directly by our payment processors: Razorpay for payments in India, PayPal elsewhere. They may use your payment data in accordance with their privacy policies, razorpay.com/privacy and paypal.com/legalhub/privacy-full. We receive limited payment-method and transaction details required to reconcile payments.

Third parties designated by you. We may share your personal information with third parties where you have instructed us or provided your consent to do so — for example, an adult you ask to pay for your subscription sees the plan, price and renewal terms and receives the receipt; paying does not give them access to your learning or social records.

Linked third-party services. If you log into the Service with a third-party sign-in service, that service knows you signed in. The third party's use of the information it holds is governed by its privacy policy and the settings associated with your account with the third-party service.

Professional advisors. Professional advisors, such as lawyers, accountants and auditors, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the Compliance and protection purposes described above.

Business transferees. If the business changes ownership, personal information may be transferred to a successor subject to applicable law, confidentiality protections and appropriate notice.

Other users. Social participation is optional. Before you enable it, we explain which nickname, results or activity your selected audience can see. Your email and private account details are not your public profile. If you choose to export or share a result, people receiving it may save or share it outside MastaPrep, beyond our control. Reports and blocking information are handled for safety and are not public.

We do not sell personal information, we do not share it for targeted advertising, and we do not share children's information with advertisers.

Access or update your information. If you have registered for an account with us through the Service, you may review and update certain account information by logging into the account.

Opt-out of communications. You may opt-out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us. Please note that if you choose to opt-out of marketing-related emails, you may continue to receive service-related and other non-marketing emails.

Withdraw consent. Where processing depends on consent, you or the appropriately authorised guardian may withdraw it through the relevant control or by contacting us. Withdrawal does not affect lawful processing already carried out; if the information is essential to a feature, that feature may no longer work.

Cookies and other technologies. See the Cookie notice below.

Declining to provide information. We need to collect personal information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.

Linked third-party platforms. If you choose to connect to the Service through your Google account or another third-party platform, you may be able to use your settings in your account with that platform to limit the information we receive from it. If you revoke our ability to access information from a third-party platform, that choice will not apply to information that we have already received from that third party.

The Service may contain links to websites, mobile applications, and other online services operated by third parties. These links and integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites, mobile applications or online services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and online services you use.

We employ technical, organizational and physical safeguards designed to protect the personal information we collect, including appropriate access restrictions and secure transmission. However, security risk is inherent in all internet and information technologies, and we cannot guarantee the security of your personal information. If an incident requires notification, we will notify affected people and authorities as the applicable law requires.

Our business is based in India and we may use service providers that operate in other countries. Your personal information may be transferred to India or other locations where privacy laws may not be as protective as those in your country. Our providers process data in India, the United States and the European Union (see the provider list below). Where law requires a transfer mechanism, we use the appropriate mechanism and supporting assessment. Contact us for information about safeguards and how to obtain a relevant copy, with necessary confidential details protected.

MastaPrep is intended for students aged at least 14. Students under 18 use MastaPrep with the agreement of a parent or legal guardian, confirmed when the account is created. A guardian can also record permission through the optional guardian process in Settings; where local law requires verifiable parental consent, we ask for it and keep a record of the outcome and permission given.

If you are a parent or guardian of a child from whom you believe we have collected personal information in a manner prohibited by law, please contact us. If we learn that an account does not meet our age requirements or lacks required authorisation, we will restrict the relevant processing and arrange an appropriate response, which may include deletion, in compliance with applicable legal requirements. A parent or guardian may contact us about their child's information. We verify identity and authority before disclosure or changes and consider the child's rights under applicable law. Paying for a student does not automatically give the payer access to the student's learning or social records.

We keep account and learning information while needed to provide your active account. When you request deletion, we explain the scheduled deletion date and stop future subscription renewal. We delete or anonymise information no longer needed, subject to limited records we must retain for billing, legal obligations, security or resolving a dispute. Our verified schedule is:

• Account and learning records (profile, answers, mastery, study plan, mistakes, vocabulary, games, friends and challenges, tutor exchanges, consent records): kept while the account is active; erased in full on the scheduled deletion date. Basis: providing the service.
• Deletion request log (when deletion was asked for, scheduled and completed, and whether renewal was cancelled): removed with the account's sign-in record at erasure. Basis: carrying out your request.
• Billing records (subscriptions, purchases, refunds, receipts): plan and refund rows are erased with the account; the payment provider's transaction records and our raw payment-event receipts (provider reference, amount, status) are kept for up to 7 years after the transaction as required for accounting and tax. Basis: legal obligation.
• Withdrawal statements (a cancellation notice filed under consumer law): kept for 7 years with the student reference removed at erasure. Basis: legal obligation.
• Deleted-account fingerprint (a one-way hash of the sign-in email or phone, the deletion date, and whether the account had paid or used the free trial): 24 months, then purged automatically. Basis: preventing repeat use of one-per-account allowances.
• Operational logs (server errors and security events, which may include an account identifier): held by our hosting provider for a short period, days not months. Basis: security and reliability.
• Support correspondence: kept for up to 2 years after the last message. Basis: handling and evidencing your request.

Restricted retained records are not used to continue an unwanted learning profile or marketing. We may retain minimal trial-eligibility evidence only where lawful and necessary to administer the once-per-account free trial and the free allowances: after deletion we keep a one-way hash of the sign-in email address or phone number (a fingerprint that cannot be turned back into the address), the deletion date, and whether the account had paid or used the free trial, for 24 months. This is used only to recognise a new account created with the same sign-in details, so that the free full-length test and the free trial are not granted twice; it is never used for marketing or to rebuild a learning profile.

Depending on applicable law, you may request access or a copy, correction, deletion, restriction or portability; object to certain processing; nominate a person to exercise your rights if you are unable to; and withdraw consent. You can manage available settings in your account or write to support@mastaprep.com. We may request proportionate verification, but not unnecessary personal information. We will explain any lawful exception and respond within applicable time limits.

Grievance and complaints. Our grievance officer's details are in Section 13 of the Terms of Use and on the Contact page; we acknowledge grievances within 48 hours and seek to resolve them within one month. You may complain to the Data Protection Board of India or the privacy authority or other regulator competent for your location. Contacting us first can help resolve an issue but does not remove that right.

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service or other appropriate means. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). New uses requiring consent will not rely solely on posting an updated notice.

• Email: support@mastaprep.com

We save your answers and progress so you can continue learning and practice things again later. Your practice estimate is our best current guess, not an official exam result. Our questions and explanations are written with AI tools and checked by people; if one looks wrong, use the report button.

You must be at least 14 to use MastaPrep. If you are under 18, read the Terms with a parent or legal guardian first; they agree on your behalf. Paying for an account and giving permission are separate steps.

You choose whether to join social features. Pick a nickname that does not reveal your full name, school or contact details. Before sharing a result, check who and what it shows. You can use the report or block controls if someone makes you uncomfortable.

You do not have to receive promotional emails to study here. You can ask about your information, request corrections or ask for deletion at support@mastaprep.com. Please never send us your password or full card details.

Read the full Privacy Policy above for the details, including information we may need to keep for billing or legal reasons after account deletion.

MastaPrep uses cookies and similar browser storage to keep you signed in, remember necessary settings and protect the service. We do not currently use optional analytics or marketing cookies, so there is no cookie consent panel; if optional technologies are ever added, they will be listed here and will run only after any permission the law requires.

• Sign-in session (cookies set by Supabase, names beginning sb-): keep you signed in; necessary; cleared on sign-out, otherwise renewed while you use the Service.
• Essential preferences (browser storage on your device: ascent_active_exam, ascent-autoadvance, mastaprep_exam_pause, and "seen" markers for one-time explainers): remember the exam you chose, game auto-advance, a paused test and which tips you have dismissed; necessary; stay until you clear your browser data.
• Analytics or advertising cookies: none. We do not use third-party analytics or advertising cookies.

For our Terms of Use, please see mastaprep.com/legal/terms.

======================================================================