Privacy policy
This policy explains what personal data TestPlatform collects, why we collect it, who can see it, how long we keep it and what you can do about it.
1Who we are
TestPlatform is run by [legal entity name: to be added]. Our registered address is [registered address: to be added]. In this policy, "we", "us" and "our" mean [legal entity name: to be added]. "You" means the person whose account it is.
India's Digital Personal Data Protection Act, 2023 (the "DPDP Act") calls us the Data Fiduciary for accounts on TestPlatform. This means we decide why and how the personal data in these accounts is used. We are responsible for it.
Organisations
- Schools, coaching institutes, tuition centres and other organisations can use TestPlatform for their own papers.
- If you are a member of an organisation, that organisation's administrators and teachers can see your profile and your exam work.
- The organisation decides how it uses the results it sees. The organisation is responsible for that use.
To contact us, write to newshiksha@iitmandi.ac.in. For privacy complaints, see Questions and complaints.
2Who this policy is for
This policy is for everyone with a TestPlatform account. TestPlatform is used by:
- students of Class 5 to 12. Most of them are under 18.
- their teachers, and the administrators of their organisations (schools, coaching institutes, tuition centres and others).
- students who register on their own. We call them "individual students".
- visitors who take the practice test without an account.
3Students under 18
When you register, you must confirm one of these two things:
- you are 18 or older, or
- you are under 18, and your parent or guardian has agreed to you using TestPlatform and to this privacy policy.
We record this declaration, with the date and the version of this policy.
If you are under 18, you also give your parent's or guardian's email. We email them a link where they agree or say no, and record their answer and its date. You can use TestPlatform while they decide. If they say no, the account is switched off at once and deleted. They can change their answer from the same link.
Students under 18 get no invite codes or rewards for inviting others, and their shared scorecards carry no invite code.
Parents and guardians: you can contact us to ask what we hold about your child, or to have your child's account deleted. Write to newshiksha@iitmandi.ac.in.
4How you sign in
TestPlatform does not use passwords. To sign in, you get a one-time code (OTP) by email. If you added a WhatsApp mobile number, the code can be sent to you on WhatsApp instead.
5What we collect and why
Your account
| What we collect | Why we collect it |
|---|---|
| Email address (you must give this) | To send you sign-in codes and notices. |
| WhatsApp mobile number (optional, Indian numbers starting +91 only) | To send you sign-in codes on WhatsApp. |
| Full name, class (Class 5 to 12) and roll number (roll number is optional) | To show on your exam work and results, so your teachers can tell whose work it is. |
| Organisation (optional) | So your organisation's teachers and administrators can see your work. Joining an organisation needs approval from that organisation's administrator. You can leave an organisation, or ask to move to another one. |
| If you register an organisation: its name, type, city and state, roughly how many students it has, what it will use TestPlatform for and a contact phone number | To set up the organisation's account and to contact you about it. Its name, type, city and state are shown in the list people choose from when they ask to join. |
| If you ask for an organisation that is not listed: its name, city, type and any contact details or note you give | So that we can add it and tell you when it is added. |
| Profile photo (optional) | To show on your profile. |
| Invite code you used when you signed up (optional) | To record which invite you joined through. |
| The date and version of the terms and privacy policy you accepted, and your age declaration | To show what you, or your parent or guardian, agreed to and when. |
| If you are under 18: your parent's or guardian's email, and their answer with its date | To ask them to agree to you using TestPlatform, and to show that they did. It is not used for anything else. |
Your exam work
- your answers and typed responses
- photos of handwritten answers that you upload
- the time you spend on each question
- your marks, and your teacher's checked copies and comments
- requests you make to review your marking
- reports you make about a question or a problem
- feedback you give after a test: a rating, your text and any screenshots you add. When you report a bug, we also record your browser name, operating system and screen size.
We use these to mark your papers, show you your results and fix problems.
Exam integrity events
Only while an exam is running, we record these events:
- switching away from the exam tab
- opening developer tools
- right-clicking
- pressing keyboard shortcuts that are blocked during the exam
- the same account being signed in on two devices
- losing the internet connection (how many times, and for how long)
Teachers see these events to judge whether the exam was fair. We do not use your camera or microphone.
Before an exam, a device check runs in your browser. It only contacts our server to test your connection.
The practice test without an account
- Your answers stay in your browser tab. They are sent to our server only to be marked. They are not stored.
- If you send feedback after it, we store your rating, the version of the test, what you liked and what could be improved.
- We also store a one-way code made from your network address (not the address itself), so that one network cannot send feedback many times an hour. No name or contact details are asked for.
Sign-in history
Each time you sign in, we record the time, your IP address, your device type, your operating system, your browser and your browser's user-agent string. (This is a short line of text your browser sends that names the browser and system.) We use this to keep accounts secure. We also use it so administrators can spot misuse.
Payments
When you buy a pass, we record the order, the amount, the pass you bought, the dates it is valid and any invite credit you used. We also record the payment reference and payment method that Razorpay reports to us.
You type your card, UPI or bank details into Razorpay's own window. These details never reach us.
Messages we send you
- Sign-in codes. These are always sent when you sign in.
- Notices by email. For example: a test being scheduled for you, results being published and announcements from your organisation or from us.
- Notifications inside TestPlatform.
Every notice email has an unsubscribe link. Sign-in codes and payment receipts are always sent while your account exists.
6Who can see your information
| Who | What they can see |
|---|---|
| You | Your own account, exam work and results. |
| Teachers who created a paper, or were given access to it | The attempts on that paper: name, roll number, class, answers, photos, marks and integrity events. |
| Your organisation's administrators | The members of their own organisation, and the people asking to join it: profile, contact details, account status, sign-in history, results and requests. |
| Our own staff | The accounts they need to run and support TestPlatform. The platform owner can see all accounts. |
| Other students | When a teacher publishes results, students who sat the same paper in the same class can see a ranked list with name, roll number, class and score. |
| Anyone with a scorecard link you share | The details listed under Scorecard links. |
| Authorities | What the law requires us to give them. |
Scorecard links
You can choose to share a link to your scorecard. Anyone who has the link can see:
- your first name and the first letter of your last name
- your class
- the paper and its subject
- your score, accuracy, rank, percentile and how many students sat the paper
- the date you submitted it
- your invite code, if the invite programme is on
You can stop sharing a link at any time.
7Service providers and where your data is stored
These companies process data for us, so that TestPlatform can run:
| Company | What they do for us |
|---|---|
| Neon | Hosts our database, on Amazon Web Services in the United States (the us-east-1 region). |
| Google (email sent over SMTP) | Sends our emails. |
| Meta (WhatsApp Business Platform) | Sends sign-in codes on WhatsApp, only if you gave a mobile number. |
| Razorpay | Handles payments. |
Your data is stored outside India. Our database is in the United States.
We do not sell personal data. We do not show advertising. We do not use analytics or tracking tools.
Our fonts are served from our own server, so opening TestPlatform does not contact any font or analytics company.
8How long we keep your data
| Data | How long we keep it |
|---|---|
| Account data | While your account exists. |
| Registration details and sign-in codes, once they have expired | Deleted within two days. |
| Sign-in history and access checks | About 13 months, then deleted. |
| Activity (audit) log | Up to 3 years. |
| Payment and invoice records | As long as Indian tax and accounting laws require, up to 8 years. If you delete your account, these records are no longer linked to it. |
| Exam records after you delete your account | Kept only without your name or contact details, so your organisation's past results stay correct. |
| Feedback on the practice test | 12 months, then deleted. It has no name or contact details and is not linked to any account. |
9Your rights
The DPDP Act gives you the rights below. They apply as the Act and its rules come into force.
- See your data. Ask us for a summary of the personal data we hold about you. Write to newshiksha@iitmandi.ac.in.
- Correct your data. Changes to your email address or mobile number are checked with a one-time code. To change your name, class or roll number, send a request from your Account page. Your organisation's administrator, or we, will approve it.
- Delete your data. Students: use "Delete my account" on the Privacy and data tab of the Account page. Teachers and administrators: write to newshiksha@iitmandi.ac.in. We complete the deletion within 30 days. Some records are kept, as explained in How long we keep your data.
- Withdraw your consent. This works the same way as deleting your account. Withdrawing does not affect what we did with your data before you withdrew.
- Nominate someone. You can name a person to use these rights for you if you die or cannot act for yourself. Email us at newshiksha@iitmandi.ac.in to do this.
- Complain. See Questions and complaints.
A parent or guardian can contact us to ask what we hold about their child, or to have their child's account deleted.
10Questions and complaints
If you have a question or a complaint about your personal data, write to our Grievance Officer:
- Grievance Officer
- [Grievance Officer name: to be added]
- [Grievance Officer email: to be added]
- Post
- [legal entity name: to be added], [registered address: to be added]
We reply within 30 days.
If you are not satisfied with our reply, you can complain to the Data Protection Board of India.
For anything else, write to newshiksha@iitmandi.ac.in.
11How we keep your data safe
- You sign in with one-time codes, not passwords.
- Your sign-in cookies cannot be read by scripts on the page. (They are "HttpOnly" cookies.)
- Your session ends after 30 minutes without activity, and after 2 hours at most.
- Contact details from registrations that were not finished are encrypted.
- People can only see what their role and their organisation allow.
No system is perfectly secure. If a data breach affects you, we will tell you and the Data Protection Board of India, as the law requires.
13Changes to this policy
When we change this policy, we update the date and version number at the top of this page. When you accept the policy, we record which version you accepted. If a change matters for how we use your data, we ask students to read and accept the new version the next time they open TestPlatform.