Legal & Trust

Privacy Policy

Effective and last updated: 30 August 2026

This policy explains how Exampay ("Exampay", "we", "us" or "our") handles personal data when schools, students, parents, professors, Test Series learners and administrators use our services and website.

Children's privacy notice: School Programme student accounts must be created or authorised through a school or authorised administrator. The separate Test Series may permit learner registration. A minor must use the Test Series only with the permission and involvement required from a parent or lawful guardian. No person should submit a child's data without the authority, notices and consents required by applicable law.

1. Data we may process

Identity and account data: name, email address, phone number, role, account identifier, school and class details, and authentication records. We do not store your Google password.
Student, test and academic data: roll number, grade and section, subjects, attendance, test assignments, selected answers, marked-for-review state, attempt start and submission times, scores, study resources, timetable and related records.
Fee, order and service data: fee schedules, Test Series product and order identifiers, amount, payment status, provider references and offline payment receipts. Payment-card and UPI credentials are entered with and processed by the payment provider, not stored in the Exampay database.
Communications: announcements, notifications, support requests, appointment requests and information sent through the partnership enquiry form.
Technical and security data: session details, timestamps, browser visibility changes, full-screen exits during an active test, browser and device information made available by service providers, security events and diagnostic logs needed to operate and protect the service.

2. How we receive data

We receive data directly from users, from authorised schools and administrators, through Google sign-in, from activity within Exampay and from a payment provider's signed server notification. A school may act as the primary decision-maker for records it asks us to process; contact the school as well as Exampay if your request concerns school-controlled records.

3. Why we use data

We use personal data to authenticate users; assign and enforce role-based access; deliver academic, attendance, fee, test, notification and support features; respond to enquiries; keep records; detect abuse; protect users and the platform; comply with law; and improve reliability. We process data on consent or other lawful grounds available under applicable Indian law, as appropriate to the context.

4. Children and students

The service is intended for use in an authorised educational relationship. Schools and authorised adults must provide appropriate notices, obtain verifiable parental or guardian consent where required, and avoid unnecessary collection. Exampay does not knowingly use children's data for targeted advertising, behavioural monitoring for advertising, or practices likely to cause a detrimental effect on a child's wellbeing. Contact us promptly if a student account was created without proper authority.

5. Sharing and service providers

We may share the minimum data needed with the relevant school and authorised users; infrastructure, database, authentication and hosting providers such as Supabase and Hostinger; Google when Google sign-in or Google-hosted resources are used; the displayed payment provider to create and verify a Test Series transaction; professional advisers; and authorities when lawfully required. We do not sell personal data. We do not share student data for third-party advertising.

6. Storage and international processing

Our providers may process or back up data in locations outside your state or India, subject to their contractual terms and applicable restrictions. Schools should confirm that their deployment and provider-region choices meet their obligations before onboarding users.

7. Retention

We retain records while an account or school relationship is active and afterwards only for legitimate operational, security, dispute-resolution or legal needs. Retention can vary by record type and school requirements. We delete or anonymise data when it is no longer required, subject to backups, legal holds and records that must be retained. Schools should define and operate an approved retention schedule for production deployments.

8. Your choices and rights

Subject to applicable law and verification, you may ask for information about processing, correction, completion, erasure, withdrawal of consent, grievance handling or nomination. Withdrawal does not invalidate earlier lawful processing and may make some services unavailable. For a child's or school-managed record, we may refer the request to the school or ask for proof of parental, guardian or authorised status.

9. Security

We use role-based access, authenticated database controls, private file access, transport security, session safeguards, validation, security headers and audit procedures. No online service is risk-free. Keep credentials confidential, sign out on shared devices and report suspected unauthorised access immediately. See our Data Security and Responsible Disclosure page.

10. Grievances, requests and contact

Send privacy requests or grievances to info@exampay.in or call +91 97176 20933. Postal contact: Exampay, Berger Delhi One, Sector 16B, Noida, Uttar Pradesh 201301, India. Include enough information to identify the account and request; do not send passwords, one-time codes or unnecessary student records by email.

11. Updates

We may revise this policy as our service or law changes. We will post the updated date and, for material changes, provide an appropriate notice through the service or school relationship.