Preppify Privacy Policy

Version: 1.3 Effective date: 2026-10-16

This Privacy Policy explains what information Preppify collects, how we use it, who we share it with, and the choices and rights you have. It applies to the Preppify mobile application, the Preppify web console for teachers and schools, and related services (together, the "Service").

Preppify is operated by NST EdTech, a sole proprietorship based in Erode, Tamil Nadu, India ("Preppify", "we", "us").

Our role. For accounts opened directly with us — parents, guardians, and independent students — NST EdTech is the data controller for the personal information described in this policy. Where a school or teacher uses Preppify to assess their own students, the school or teacher (or the institution they represent) is the controller of that classroom's and school's learning records, and Preppify acts as a processor / service provider, handling that information only on their documented instructions and under our data-processing terms. In the United States, in that role we act as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA).

Preppify is an education platform where parents, teachers, and schools create curriculum-aligned assessments that children complete. Because children use the Service, we hold ourselves to a strict standard: we collect only what the Service needs, we do not show advertising, and we never sell personal information. Our Children's Privacy Notice explains our practices for children in plain language and should be read together with this policy.

Contents

1. Information we collect
2. Information we do not collect
3. How we use information
4. Legal bases for processing
5. Children's information
6. Voice features
7. Artificial intelligence
8. Who we share information with
9. Data retention
10. Deleting your account and data
11. Storage and security
12. International data transfers
13. Cookies
14. Communications
15. Your rights and choices
16. Region-specific information
17. Changes to this policy
18. Contact us
19. Change log

1. Information we collect

Account information

When you sign in with Google, Apple, or an email address and password and complete onboarding, we collect:

• your name and email address;
• your profile photo, if your sign-in provider shares one (not stored for student accounts);
• which sign-in provider you used (not stored for student accounts);
• your country;
• your date of birth (collected for parent and teacher accounts and for students 18 or older; not collected for school administrator accounts, or from students under 18 — a parent or guardian provides their child's date of birth);
• your account role (for example parent, student, teacher, or school administrator);
• optional answers you give during onboarding — your learning goals, your biggest challenge and the outcome you want or, for teachers and schools, your curriculum, grades and subjects — used to tailor your first experience.

If you sign in with an email address and password, your password is handled by our sign-in provider (Firebase Authentication). We never see it or store it ourselves.

Child profile information

A parent or guardian creates and controls each child profile. For each child we collect:

• the child's name;
• the child's date of birth;
• grade, education board, medium of instruction, and country (used to align assessments with the right curriculum);
• optionally, a contact email address if the parent chooses to let the child link their own student sign-in;
• the learning permissions the parent sets for the child.

We do not collect the name of the child's school for family accounts.

Assessment and learning data

When assessments are created and completed, we collect:

• the assessments created for a child (subject, chapters, topics, difficulty, language);
• the questions attempted, the answers selected, and whether they were correct;
• scores, time spent overall and per question, and progress through an assessment;
• learning analytics derived from this activity, such as strengths and weaknesses by topic and difficulty, a learning tree of the topics covered, Smart Practice suggestions and a weekly plan, shown to the child's parent (and teacher, for classroom assessments);
• a device identifier for the device on which an attempt was started, used to support resuming an attempt across devices and to prevent conflicting simultaneous attempts.

Communication preferences and consent records

If you choose to provide them, we collect an optional mobile phone number and your communication preferences, including whether you opt in to receive messages over WhatsApp and which categories of communication you consent to. Providing a phone number is optional, and we do not currently verify it.

We also keep records of your consent — including the version of this policy you accepted, when you accepted it, and the platform you used — so we can demonstrate what you agreed to.

Purchase information

Purchases and subscriptions are processed by the Apple App Store or Google Play. We never receive or store your card or bank details. We receive purchase and subscription status (such as which plan or credit pack you bought, and store transaction references) through our subscription-management provider so we can activate what you paid for and keep your balance correct, including after refunds.

Notifications and invitations

• If you allow push notifications on your device, we store the notification tokens needed to deliver them to your devices.
• If you invite a co-parent, a teacher to a school, or students to a classroom (by entering their parent's or guardian's email address, one at a time or from a CSV file), we process the invitee's email address to deliver the invitation.
• If a student under 18 asks a parent or guardian to approve their account, we email the request to the parent or guardian, and email the student if the request is declined.
• If we add a trial plan to your account, we may email you about it.

Classroom and school information

For teachers and schools we additionally process classroom names and settings, classroom enrollment records (which child is enrolled in which classroom, with parental approval), and school details such as school name, city, and a school contact email and phone number.

Information stored on your device

To keep the Service working offline, the app stores data locally on your device: the curriculum catalog, downloaded questions, and in-progress and completed attempt answers. When you sign out, your local data stays on the device so you can pick up unsynced work when you sign back in; other people who sign in on the same device cannot see it. It is removed when you delete your account or uninstall the app, and when another person signs in on the device after your data has been unused for 30 days.

Crash and diagnostic data

To keep the Service reliable, we use Firebase Crashlytics (part of our Google Cloud / Firebase infrastructure). When the app crashes or encounters a fatal error, we may receive technical diagnostic information such as stack traces, device model and OS version, and app version. Where you are signed in, this may be associated with your account identifier so we can investigate issues. Crash reports are used only to fix bugs and improve stability — not for advertising or profiling.

Web console error reports. When the web console for teachers and schools hits an error, it sends us an error report with the error details (including the stack trace), the page you were on, the console version, and your account identifier. We use these reports only to fix bugs.

Security information

To protect the Service from abuse and fraud, we process:

• device-integrity checks from Apple, Google and Google reCAPTCHA, which confirm that requests come from a genuine copy of our app or web console;
• IP addresses and email addresses in hashed (scrambled) form, to limit repeated attempts — these records are deleted within a few days;
• logs of requests to our servers, which include IP addresses and are kept for 30 days.

Sources of information

Most of the information we hold comes from you. Some comes from other people: a parent or guardian enters their child's profile; a parent, co-parent, teacher or school administrator may enter someone's email address to invite them; and a student under 18 enters their parent's or guardian's email address to ask for approval. Invitations that are not accepted are deleted about 7 days after they expire (about 14 days after they are sent). When you sign in with Google or Apple, we also receive your name, email address and, if shared, profile picture from them.

2. Information we do not collect

We believe it is just as important to tell you what we do not do. Preppify does not:

• show advertising or use advertising identifiers;
• use third-party advertising or product-analytics trackers in the app (we do use Firebase Crashlytics for crash diagnostics as described above);
• collect your precise location;
• collect biometric information;
• record, store, or upload audio (see Voice features);
• collect or store card or bank details;
• sell personal information, yours or your child's, to anyone.

3. How we use information

We use the information described above to:

• create and deliver curriculum-aligned assessments, including AI-assisted question generation and translation;
• save answers and progress, including offline, and let attempts resume across devices;
• produce learning analytics for parents and teachers;
• authenticate you and keep accounts and family, classroom, and school boundaries secure;
• process purchases, subscriptions, credits, and refunds;
• send the communications described in Communications;
• prevent fraud and abuse of the Service, including abuse of AI features;
• respond to support requests;
• comply with legal obligations.

We do not use your information for advertising, and we do not build advertising profiles.

4. Legal bases for processing

Where laws such as the EU/UK GDPR apply, we rely on the following legal bases:

• Performance of a contract — providing the Service you signed up for: accounts, assessments, analytics, purchases, and support.
• Consent — optional communications (including the optional phone number and WhatsApp opt-in), and a parent's or guardian's consent for the processing of their child's information. You can withdraw consent at any time.
• Legitimate interests — keeping the Service secure, preventing fraud and abuse, and improving the Service, balanced against your rights and freedoms.
• Legal obligation — retaining certain records where the law requires it.

In India, we process personal information in accordance with the Digital Personal Data Protection Act, 2023, on the basis of your consent and for the legitimate uses the Act recognizes. We ask a parent or guardian to approve a child's use of Preppify and to provide the child's information; before that approval we collect only what we need to ask for it (see Children's information).

5. Children's information

Children use Preppify under a parent's or guardian's account. The parent or guardian is the account holder: they create the child's profile, decide what is collected, control the child's permissions, and can deactivate the family account. By default, children complete assessments on the account holder's device without their own sign-in. A parent may optionally allow an older child to link their own student sign-in; the parent's controls still apply.

Student registration requests. A student under 18 may start signing up on their own device, but cannot finish without a parent or guardian. Before a parent or guardian approves, we collect only what we need to ask them: the student's name, the email address the student signed in with, and the parent's or guardian's email address. We use the parent's email only to send the approval request. We do not ask the student for their date of birth, school details, or anything else, and the student does not agree to this policy or our Terms of Service — the parent or guardian provides the child's details and agrees on the child's behalf when approving. If the parent or guardian does not approve within 7 days, declines, or the request is cancelled, we delete the request and this information within 14 days. Our sign-in service also receives whatever Google or Apple shares when the student signs in, such as a profile picture link; we don't save it to the student's profile.

We collect from children only what the Service needs (see Child profile information above), we do not show children advertising, we do not use children's information for marketing, and we never sell it. We analyse a child's answers only to show learning progress to their parent and teacher. We don't track children across other apps or websites, we don't direct advertising at children, and we don't build profiles of children for advertising or for any purpose other than their learning.

Our Children's Privacy Notice describes these practices in detail, including parental consent, classroom features, and how to review or delete a child's information.

6. Voice features

Preppify offers optional voice features: questions can be read aloud, and answers can be given by speaking.

• Preppify does not record, store, or upload audio. Speech is converted to text, and text to speech, using your device's operating-system speech services.
• Depending on your device settings, those operating-system speech services (provided by Apple or Google) may process audio on their servers under their own privacy policies.
• We store only limited operational information about the use of voice features — such as whether voice mode was used during an attempt — never recordings and never transcripts.

7. Artificial intelligence

AI is central to how Preppify generates educational content. We want to be transparent about what it does and does not do.

What AI is used for. Generating assessment questions aligned to your child's curriculum, validating custom topics, translating questions into other languages, and producing explanations of questions and of mistakes made in an attempt.

What is shared with AI providers. AI processing runs on our servers, not on your device, and uses specialist third-party AI service providers — currently OpenAI and Google (Gemini) — where necessary to provide the Service. Requests to these providers contain the educational context needed for the task: subject, grade, curriculum details, topics, difficulty, question and answer content, and the language requested. They do not contain your child's name, contact details, or account identity. We apply data minimization so AI providers receive only what the educational task requires.

Custom topics. If you type a custom topic, that text is sent to our AI providers to check it and suggest improvements. Please don't include personal information in a custom topic.

Quality and review. Generated questions pass automated quality and validation checks before they are used, and content that fails these checks is discarded. Parents and teachers review and control the assessments children take. Our staff may review AI-generated content for quality assurance and to investigate reports.

Limitations. AI-generated content can contain errors or inaccuracies. Preppify is a learning aid: AI-generated questions, explanations, and recommendations support practice and understanding, and are not professional educational, psychological, or medical advice, and are not formal academic evaluations of your child.

No significant automated decisions. We do not use AI to make decisions about you or your child that have legal or similarly significant effects. AI recommendations (for example, suggested practice areas) only inform learning and are always subject to parent and teacher judgment.

Reporting problems. You can flag a problematic question directly in the app, or contact us at info@nstedtech.com. Flagging may be rate-limited to prevent abuse.

8. Who we share information with

We share personal information only with the service providers we need to run Preppify, and never for their own advertising purposes:

Each provider processes personal information under its own privacy and security commitments, and under contracts that restrict use of your information to providing services to us. A current list of our service providers is available on request from info@nstedtech.com. We may also disclose information where required by law, to protect the rights and safety of users and the public, or as part of a corporate transaction such as a merger or acquisition (in which case this policy's protections continue to apply to the transferred information).

We do not sell personal information and we do not share it with third parties for advertising.

9. Data retention

• Active accounts. We keep your account information, child profiles and learning records while your account is open, because the Service needs them to show progress, resume work and suggest practice. We do not delete accounts automatically because they are inactive; you can delete your account at any time (see Deleting your account and data).
• Closed family accounts. After the 7-day grace period, the family account closes; about 30 days later we redact and delete personal identifiers from its records.
• Consent records. We keep records of your consent for as long as your account exists, so we can demonstrate what you agreed to.
• Student registration requests. If a parent or guardian does not approve a student's registration request, we delete the request and the student's sign-in within 14 days after the request ends (see Children's information).
• Archived attempt records. We keep a copy of completed attempts in an analytics archive to support your history and to improve the service, for no longer than 400 days. When the family account's data is deleted, or you delete an individual account, we delete these archived copies within 7 days.
• Invitations. Invitations that are not accepted are deleted about 7 days after they expire (about 14 days after they are sent).
• Security records. Hashed records used to limit repeated attempts are deleted within a few days, and server request logs are kept for 30 days.
• Purchase records. We keep purchase and billing records as long as needed for accounting, tax, and audit obligations.
• After account deletion. See Deleting your account and data for what is deleted and when.
• Legal holds. Where the law requires it, or where records are needed for an active dispute or investigation, deletion may be delayed until the requirement ends.

10. Deleting your account and data

How deletion works depends on the type of account you have.

Family accounts (accounts with child profiles). When you request permanent deactivation of a family account, a 7-day grace period begins, during which you can change your mind and reactivate. After the grace period, the family account is closed: family members lose access and child profiles are deactivated. Approximately 30 days after closure, we redact and delete personal identifiers from the family's records — including child names and dates of birth — and delete per-child question history and pending invitations. Some learning records may be retained after this process in a form that no longer directly identifies you or your child. The individual sign-in accounts of parents and co-parents are not deleted by family deactivation; each person can separately delete their own account (below) once they are no longer part of a family.

Individual accounts (no family). If your account has no family attached, account deletion is immediate and permanent: your profile, your consent records, your account-linked learning data, and your sign-in account are deleted, and this cannot be undone. Archived copies of your learning records are deleted within 7 days. If you belong to a school, you must first leave or dissolve the school.

Linked student sign-ins. A parent can remove a linked student's sign-in from the app. This deletes the student's sign-in and their personal sign-in profile (such as their name and email address). A student who uses a linked sign-in can also delete it themselves from their profile; we then tell the parent. In both cases the child's profile and learning history stay in the family account until the parent deletes the family account or asks us to erase them. To have a child's learning history erased, contact info@nstedtech.com and we will complete the request within 30 days.

What deletion cannot remove. Purchase records held by Apple or Google are governed by their policies. We retain minimal billing and audit records where the law requires.

Teacher and school accounts. Teachers and school administrators delete their accounts the same way as individual accounts. A teacher must first leave their school, and a school owner must first dissolve the school. To exercise deletion, use the account deletion option in the app. Whatever type of account you have — parent, co-parent, student, teacher or school administrator — you can also email info@nstedtech.com from the account's email address; we will verify the request and complete it within 30 days.

11. Storage and security

Your information is stored in cloud infrastructure operated by our service providers. Our infrastructure runs on Google Cloud and Firebase, which maintain independent security certifications (ISO/IEC 27001) and undergo SOC 2 examinations. Information is encrypted in transit and encrypted at rest as provided by that infrastructure. Access is restricted by authentication and server-side authorization rules that enforce family, classroom, and school boundaries — for example, one family cannot read another family's data, and classroom rankings shown to families do not reveal other children's names.

No system can be perfectly secure, and we cannot guarantee absolute security; we work to protect your information with measures appropriate to the sensitivity of the data, particularly children's data. If a breach affecting your personal information occurs, we will notify you and the relevant authorities as required by applicable law.

12. International data transfers

Our production database and server infrastructure is located in India. Development and testing environments, and some supporting service providers, may process information in the United States or other countries. Authentication and push delivery use globally distributed infrastructure. This means your information may be processed outside the country where you live. Where your information is transferred internationally, we rely on the safeguards required by applicable law — including standard contractual clauses and, where a provider offers it, the EU-US Data Privacy Framework or equivalent mechanisms.

13. Cookies

The Preppify mobile app does not use cookies. Our web console for teachers and schools uses browser storage that is necessary to keep you signed in, and stores data in your browser so pages load faster; this stored data is cleared when you sign out and expires after 24 hours. To protect the console from abuse, we use Google reCAPTCHA, which may set cookies and collect device and usage information under Google's Privacy Policy and Terms of Service. We do not use advertising or analytics cookies, and we do not use tracking cookies on our informational web pages. If this changes, we will update this policy first.

14. Communications

• Service communications. We send communications needed to run the Service — for example, invitation emails when you invite a co-parent, teacher or student, parent-approval requests and decisions for students under 18, plan trial notices, and sign-in–related emails.
• Push notifications. Once you allow them on your device, push notifications are on by default. We send them about activity in your account, including a weekly progress summary for parents and co-parents. You can turn them off in the app's notification settings or in your device settings.
• Optional messages. If you provided a phone number and opted in, we may in the future send you messages over WhatsApp in the categories you consented to. This messaging is not yet active; we collect your preference now so that, when it launches, we contact only people who opted in. You can change or withdraw these preferences at any time in your profile settings.

We do not send marketing communications to children.

15. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and your child;
• Correct inaccurate information (much of your information can be edited directly in the app);
• Delete your account and data (see Deleting your account and data);
• Export a copy of your information;
• Withdraw consent you previously gave (for example, communication preferences in your profile settings);
• Object to or restrict certain processing;
• Complain to your data protection authority.

Access and export. You can download a copy of your account information at any time from Settings → Privacy & legal → Download my data. The download is a JSON file you can save or share from your device. It includes your account profile, communication preferences, consent records, and (for family accounts) child profile information and high-level learning summaries. It does not include assessment questions, individual attempt answers, academic-challenge details, billing transaction history, or invitations. If you need help exercising another right, or want information that is not in the self-service export, contact us at info@nstedtech.com from the email address associated with your account so we can verify your request.

Other rights. You can correct much of your information directly in the app, withdraw communication consent in your profile settings, and delete your account as described in Deleting your account and data. We respond to verified requests we cannot fulfil in the app within 30 days, or sooner where applicable law requires. A parent or guardian may exercise these rights on behalf of their child.

16. Region-specific information

• India. We process personal information in accordance with the Digital Personal Data Protection Act, 2023. Grievances may be addressed to our Grievance Officer: NST EdTech, info@nstedtech.com; we respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India. You may also nominate another person to exercise your rights on your behalf if you die or become unable to act — contact us to do so. Where the Act requires mechanisms such as consent managers, we will support them as they become applicable to us.
• European Union / United Kingdom. The legal bases in Legal bases for processing apply. For information-society services offered to children, we ask a parent or guardian to approve a child's use of Preppify below the age set by your country's law (which ranges from 13 to 16 across the EU/UK). Where information is transferred to service providers outside the EU/UK, we rely on standard contractual clauses and, where a provider offers it, the EU-US Data Privacy Framework (see International data transfers). Where we are required to appoint a local representative, details will be published in this policy. You may lodge a complaint with your supervisory authority.
• United States. Preppify is designed to honor parental control over children's information consistent with the Children's Online Privacy Protection Act (COPPA): we ask a parent or guardian to approve a child's use of Preppify and to provide the child's information. Before that approval we collect only what we need to ask for it (the child's name and sign-in email and the parent's email), and we delete it if approval is not given. A parent or guardian can review the child's information and have it deleted. We do not show children advertising and do not sell children's information.
  • Schools and teachers (FERPA). When a school or teacher uses Preppify to assess their students, we handle student "education records" only as a service provider acting as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA). We use those records solely to provide the Service to the school, do not use them for our own purposes, do not sell them, and return or delete them under our agreement with the school. Parents may exercise access and correction rights through the school.
  • California (CCPA/CPRA). In the past 12 months we collect these categories of personal information: identifiers (such as name and email), education information (child profile, assessments, and learning results), commercial information (your purchase and subscription status), internet or network activity (how the app is used to deliver and resume assessments, and security logs), inferences (learning strengths and areas to improve, drawn from assessment results), and sensitive personal information (your account login and password, used only to sign you in). We use them for the business purposes described in How we use information. We do not sell or share personal information, and we do not use it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics. California residents may request to know, delete, or correct their personal information; the right to opt out of sale or sharing does not apply because we do not sell or share. You may use an authorized agent, and we will not discriminate against you for exercising these rights. Because we do not sell or share, no opt-in is required for California residents under 16.
• Other regions. We extend the same core protections — parental control, data minimization, no advertising to children, deletion on request — to all users, and address additional local obligations as they apply.

17. Changes to this policy

When we make material changes to this policy, we will publish the updated version at this address with a new version number and ask you to review and accept it in the app where required. The version you accepted, and when, is recorded in your consent records. Continued use of the Service after a new version takes effect constitutes acceptance where permitted by law.

18. Contact us

NST EdTech Erode, Tamil Nadu, India

• Privacy requests: info@nstedtech.com
• Support (including deletion and refund questions): info@nstedtech.com
• India Grievance Officer: NST EdTech, info@nstedtech.com
• Website: https://nstedtech.com

19. Change log