Privacy Policy
What we hold about you, why we hold it, who can see it, and how to make us delete it.
Only you see it
Your tests and pages are yours alone
No model training
Your work never trains public AI models
Private storage
Pages served only to your session
You can end it
Ask us and it is deleted
1. Who we are, and what we are to you
This policy covers the PrepitUp account you created for yourself. The platform is run by PrepitUp, operated by Vinayak Gupta ("PrepitUp", "we", "us").
Under the Digital Personal Data Protection Act, 2023, PrepitUp is the Data Fiduciary for your account. Nobody instructs us on your behalf and nobody else decides what happens to your data. That means we answer to you directly for everything in this policy — what we collect, why, and when it is deleted.
2. What we collect
We ask for as little as we can. This is all of it:
A. Your account
Your email address and display name, taken from Google sign-in or from the sign-in link we email you, and the sign-in identifier Firebase Authentication gives us. Also the class level you pick when you start, so the papers match what you are studying.
B. Your tests
The chapters, length and marks of each paper you set yourself, the questions we wrote for it, when you started and finished, and the paper itself.
C. Your answers
The photographs or PDFs of your handwritten pages, the text we read from them, and the marks, comments, reports and practice questions produced from them.
D. Technical logs
IP address, browser user agent and session timestamps, kept for security and to work out what went wrong when something fails.
We do not ask for and do not store your home address, phone number, government ID, or any payment details.
3. Why we process it
- To sign you in and keep your session secure.
- To write your papers on the chapters you chose.
- To read and mark your handwriting and draw the marks and comments onto your pages.
- To show you your progress across the tests you have taken, and to suggest what to practise next.
- To keep the service safe — rate limits, abuse prevention and fault diagnosis.
The legal basis is your consent, given when you created the account, and — where you are a child — the consent of your parent or guardian. Section 8 explains how to take it back.
4. How the AI part works
Said plainly
- What runs: we send your pages to Google Gemini multimodal models, through Google Cloud Vertex AI, to read your handwriting and mark it against the marking scheme we wrote with the paper.
- Nobody reviews it: the marks and comments you see are generated and shown to you without a person checking them. Section 3 of the Terms explains what that means for how much weight to put on them.
- Not training data: your submissions and the marks made on them are NOT used to train or improve general-purpose public AI models.
5. Who can see your work
You, and nobody else. A test you set yourself, the pages you uploaded for it and the marks made on them are readable only by your own signed-in account. They appear in no other account, no shared list and no report about anyone else. Every database read is scoped to the account that owns the row, and your uploaded pages are stored privately and served only through an authenticated request from your own session.
We do not sell your data, we do not share it for advertising, and we do not pass it to anyone except the providers in Section 6, who process it only to run the service for you.
6. The providers we use
| Provider | What it does | What it handles |
|---|---|---|
| Google Cloud Platform (Vertex AI, Cloud Tasks, Cloud Run) | Writes your papers, reads and marks your pages, hosts the app | Your answer pages and the papers written for you |
| Cloudflare (R2 Storage) | Encrypted file storage | Your uploaded pages and PDF downloads |
| Neon (PostgreSQL) | The database | Your account, your tests, your marks |
| Firebase Authentication (Google) | Signing you in | Your email address and sign-in identifier |
7. How long we keep it, and how it is protected
- While your account is open: your tests, pages and results are kept so that you can look back at them and so your progress means something.
- When you close it: on a verified request, everything in the account is permanently deleted within 90 days, except anything a law requires us to keep for longer.
- Backups: encrypted backups rotate and overwrite on their own automatic cycle.
- In transit: everything between your browser, our servers and our providers travels over TLS 1.3.
- In our logs: names, tokens and raw AI payloads are stripped out before anything is written to a log.
8. Your rights, and how to use them
There is nobody in between, so you ask us directly. Write to the Grievance Officer below, from the email address on your account, or as the parent or guardian who gave consent. Once we are satisfied the request is genuine, you may:
- See what we hold about you.
- Correct anything that is wrong.
- Get a copy of your tests and results.
- Delete the account and everything in it (Section 7).
- Withdraw consent — yours, or your parent's or guardian's. Withdrawing it closes the account. It does not undo processing that already lawfully happened.
- Complain to us first, and to the Data Protection Board of India if we do not put it right.
Grievance Officer
Grievance & Privacy Officer: Vinayak Gupta
Privacy & data: privacy@prepitup.in
Support: support@prepitup.in
9. Changes to this policy
We may update this policy. When a change is material we will tell you in the app and move the version number at the top of this page.
© 2026 PrepitUp, operated by Vinayak Gupta. All rights reserved.