PrepAI Privacy Policy

Effective Date: 1st October 2026
Last Updated: 23rd September 2026

PrepAI is operated by DataToBiz Private Limited (“DataToBiz”, “PrepAI”, “we”, “us” or “our”). This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you visit our websites or use PrepAI products and services.

This Privacy Policy should be read together with the PrepAI Terms & Conditions, Cancellation & Refund Policy, Service Fulfillment & Delivery Policy, and any applicable institutional agreement, Order Form or data-processing agreement.

1. Who We Are

DataToBiz Private Limited operates PrepAI, an AI-assisted assessment platform that may include websites, web applications, APIs, integrations, assessment creation and delivery, grading, analytics, community features and customer-support services.

• Legal Entity: DataToBiz Private Limited
• Registered/Principal Office: F-429, Industrial Area, Phase 8B, Mohali, PB 160059, Punjab, India
• CIN: U72900PB2020PTC051668
• Privacy Contact: [email protected]

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

• www.prepai.io and associated PrepAI websites
• PrepAI web applications
• PrepAI APIs and integrations
• PrepAI Community
• Assessments, quizzes or tests delivered through PrepAI
• Customer-support and business communications
• Other PrepAI services that link to this Privacy Policy

collectively, the “Services.”

“Personal Data” means information relating to an identified or identifiable individual, or such equivalent term as may be defined under applicable privacy or data-protection law.

3. Our Role in Processing Personal Data

Depending on the context, DataToBiz may process personal data in different capacities.

3.1 DataToBiz as Data Fiduciary / Controller

DataToBiz generally determines the purposes of processing for information used to manage:

• PrepAI user accounts
• Website visitors
• Billing and payments
• Customer support
• Service communications
• Security and fraud prevention
• Product analytics
• Marketing activities
• DataToBiz’s own legal and business operations

3.2 DataToBiz as Processor / Service Provider

Schools, universities, employers, training providers and other organisations may use PrepAI to administer assessments or process information relating to their students, employees, candidates or participants.

Where such an organisation determines why and how that information is processed and DataToBiz processes it on its behalf, DataToBiz acts as a processor or service provider, subject to the applicable agreement and law.

The relevant institutional customer remains responsible for providing required notices, establishing an appropriate lawful basis, and obtaining any consent or authorisation required for the information it provides to PrepAI unless otherwise stated in our written agreement.

4. Personal Data We May Collect

The information we collect depends on how you interact with PrepAI.

4.1 Information You Provide Directly

We may collect:

Account and identity information, including:

• Name
• Email address
• Account identifier
• Organisation
• Role or designation
• Profile information
• Authentication-related information

Contact and professional information, including:

• Telephone number
• Business address
• University, school or employer
• Department
• Designation
• Information you submit through forms or support requests

Customer Content, including:

• Documents
• Text
• URLs
• Images
• Audio
• Video
• Prompts
• Quizzes
• Questions
• Question banks
• Assessment materials
• Other content uploaded, imported, created or entered into PrepAI

Assessment and participant information, which may include:

• Participant names or identifiers
• Email addresses
• Assessment responses
• Marks
• Scores
• Feedback
• Performance information
• Test activity

Payment and transaction information, including:

• Selected plan
• Order details
• Transaction amount
• Currency
• Invoice information
• Tax information
• Payment status
• Refund history

Payment-card information may be processed directly by authorised payment-service providers.

Support and communication information, including:

• Emails
• Support tickets
• Complaints
• Feedback
• Survey responses
• Attachments or information you voluntarily provide

4.2 Information Collected Automatically

When you use PrepAI, we may automatically collect:

• IP address
• Browser type
• Operating system
• Device type
• Language
• Approximate network location
• Login time
• Session activity
• Referring and exit pages
• Pages or features used
• Quiz-generation activity
• Test activity
• Diagnostic information
• Security events
• Error logs
• Interaction data

4.3 Information Received From Third Parties

We may receive information from:

• Educational institutions
• Administrators or educators
• Payment processors
• Authentication providers
• LMS platforms
• Integrated applications
• API partners
• Analytics providers
• Communication providers
• Security providers
• Support providers

5. Information You Should Avoid Uploading

Users should provide only information reasonably necessary for the relevant educational, assessment or business purpose.

Unless specifically required for a supported feature, users should not submit:

• Passwords
• Private authentication keys
• API secrets
• Complete payment-card information
• Government identification numbers
• Medical records
• Highly sensitive financial information
• Other highly sensitive personal information

6. How We Use Personal Data

We may use personal data to:

• Create and administer PrepAI accounts
• Authenticate users
• Provide and secure the Services
• Process Customer Content
• Generate quizzes and assessments
• Conduct tests
• Provide grading and feedback
• Provide analytics and reporting
• Administer institutional workspaces
• Manage user permissions
• Operate APIs and integrations
• Process payments, refunds and credits
• Maintain account entitlements
• Provide customer support
• Investigate errors and incidents
• Detect fraud or abuse
• Maintain security
• Monitor service reliability
• Understand product usage
• Improve service performance and usability
• Communicate service and policy updates
• Send billing or security notifications
• Provide educational or marketing communications where permitted
• Maintain records required by law
• Comply with regulatory or governmental requirements
• Respond to lawful requests
• Enforce our Terms and policies
• Protect our rights and the rights of users and third parties
• Establish, exercise or defend legal claims
• Carry out other purposes disclosed when information is collected or otherwise permitted by law

Where required by applicable law, we process personal data based on consent or another lawful ground recognised under that law.

Where consent applies, you may withdraw it using the means made available to you. Withdrawal does not affect processing lawfully carried out before withdrawal.

7. AI Processing and Automated Features

PrepAI uses artificial intelligence and automated technologies to provide features such as:

• Question generation
• Content transformation
• Grading support
• Feedback
• Assessment analysis
• Recommendations

Information submitted to an AI-enabled feature may be processed by DataToBiz and authorised AI, cloud or infrastructure providers as reasonably necessary to provide, secure, monitor and maintain the requested functionality.

Users and institutional customers are responsible for ensuring that they have the right and authority to submit personal data or third-party content to an AI-enabled feature.

AI systems may sometimes produce inaccurate, incomplete, unexpected or inappropriate results. Educators, institutions and other users remain responsible for appropriate human review before relying on AI-generated information in decisions materially affecting a person.

Student Data and AI

For Student Data processed on behalf of an educational institution, PrepAI does not:

• Sell Student Data
• Use Student Data for targeted advertising
• Build unrelated commercial profiles of students

PrepAI will not use Student Data for general-purpose AI-model training or materially unrelated purposes unless such processing is lawfully permitted and appropriately authorised.

8. Aggregated and De-Identified Information

We may create aggregated or de-identified information that does not reasonably identify an individual. Subject to applicable law, we may use such information for:

• Analytics
• Product measurement
• Research
• Security
• Service improvement
• Performance analysis
• Business operations

9. Institutional and Student Data

Schools, universities and other organisations may use PrepAI to create and conduct assessments. In these situations, the institution may determine:

• What participant information is collected
• Why it is collected
• How long it is retained
• Who may access results
• How assessment information is used

Where DataToBiz acts as a processor/service provider for an institution, we process the relevant information to:

• Provide the contracted Services
• Support the institution
• Maintain security
• Troubleshoot technical problems
• Comply with applicable law

We do not independently determine unrelated purposes for Student Data merely because the information is processed through PrepAI.

If you are a student or participant and an educational institution provided your assessment or account, requests concerning your institutional records may need to be directed first to that institution. We will reasonably assist institutional customers where required by law or contract.

10. Children and Minors

PrepAI is used in educational settings and may process information relating to minors. Individual users who enter into a contract directly with PrepAI must have legal capacity to do so.

Students and minors may participate in institution-managed assessments where authorised by an appropriate:

• Institution
• Educator
• Parent
• Lawful guardian

Where applicable law requires:

• Parental consent
• Guardian consent
• Age verification
• Institutional authorisation
• Other safeguards

The party responsible for collecting the information must ensure those requirements are satisfied. PrepAI may introduce age-verification, parental-consent or institutional-control measures where required by law.

Under India’s Digital Personal Data Protection Act, 2023, a “child” is defined as an individual who has not completed eighteen years of age. Applicable obligations relating to children’s Personal Data are subject to statutory commencement, prescribed conditions and exemptions.

11. Cookies and Similar Technologies

PrepAI may use cookies, local storage, pixels and similar technologies. These may include:

Strictly Necessary Cookies

Used for:

• Authentication
• Account security
• Session management
• Fraud prevention
• Core Service functionality

Functional Cookies

Used to:

• Remember preferences
• Personalise functionality
• Improve usability

Analytics Cookies

Used to understand:

• Website traffic
• Product usage
• Feature performance
• Technical errors
• Usage trends

Marketing Technologies

Where used and legally permitted, these may help:

• Measure campaigns
• Understand marketing performance
• Provide relevant communications

Where consent is required for non-essential technologies, PrepAI will provide an appropriate preference or consent mechanism.

Acceptance of PrepAI’s Terms does not itself constitute consent to optional advertising or marketing cookies.

12. Marketing Communications

Where permitted by law, PrepAI may send:

• Product updates
• Educational information
• Event information
• Newsletters
• Promotional communications

You may unsubscribe using the mechanism included in the communication or by contacting us.

Opting out of marketing does not prevent us from sending important non-marketing communications, including:

• Security alerts
• Billing notices
• Account notices
• Policy updates
• Legally required communications

13. How We Share Personal Data

We do not sell personal data for monetary consideration. We may disclose information to the following recipients where reasonably necessary and permitted by law.

Service Providers and Subprocessors

These may support:

• Hosting
• Cloud infrastructure
• AI processing
• Analytics
• Communications
• Email
• Customer support
• Security
• Payments
• Related operations

Institutions and Administrators

Where you participate in a test or programme administered by an organisation, relevant data may be shared with the institution, educator or administrator responsible for that activity.

Professional Advisers

We may share information with:

• Lawyers
• Accountants
• Auditors
• Insurers
• Consultants
• Other professional advisers

Legal and Regulatory Authorities

We may disclose information where:

• Required by law
• Required by a court
• Required by a competent authority
• Reasonably necessary to protect users or third parties
• Reasonably necessary to investigate unlawful conduct

Corporate Transactions

Information may be reviewed or transferred in connection with a proposed or completed:

• Investment
• Financing
• Merger
• Restructuring
• Acquisition
• Licensing arrangement
• Sale of business
• Transfer of assets

Any such processing will remain subject to applicable legal and confidentiality requirements.

At Your Direction

We may disclose information where you instruct us to do so or otherwise provide valid consent.

14. Third-Party Service Providers

Service providers processing personal data on our behalf are expected to:

• Process data for authorised purposes
• Maintain appropriate safeguards
• Comply with applicable contractual and legal obligations

Where appropriate, DataToBiz may maintain or provide information concerning material service providers or subprocessors.

15. International Processing

PrepAI and its authorised service providers may process personal data in India and other countries in which they operate. Where applicable law imposes restrictions or requirements relating to international transfer or processing, we will take reasonable steps to comply with those requirements.

16. Data Retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected or as otherwise required or permitted by law.

Retention may depend on:

• Whether an account remains active
• Whether an institutional relationship continues
• The nature and sensitivity of the information
• Customer instructions
• Contractual requirements
• Security requirements
• Fraud-prevention needs
• Backup cycles
• Legal requirements
• Tax and accounting obligations
• Applicable limitation periods
• The need to establish, exercise or defend legal claims

When information is no longer required, we may:

• Delete it
• Anonymise it
• Otherwise securely dispose of it

Deletion from active systems may not immediately remove information from all backups. Backup copies are ordinarily removed or overwritten through the applicable backup lifecycle unless further retention is necessary.

17. Security

We use reasonable technical and organisational safeguards designed to protect personal data against:

• Unauthorised access
• Disclosure
• Alteration
• Misuse
• Loss
• Destruction

These safeguards may include:

• Authentication
• Access controls
• Logging
• Backups
• Network safeguards
• Security monitoring

No internet-based service can guarantee absolute security. Users are responsible for:

• Protecting their credentials
• Maintaining secure devices
• Informing PrepAI promptly about suspected unauthorised access

18. Personal Data Breaches

Where we become aware of a personal-data breach, we will take reasonable measures to:

• Investigate
• Contain
• Mitigate
• Remediate

the incident. Where required by applicable law, we will notify:

• Affected individuals
• Institutional customers
• Competent authorities

19. Your Privacy Rights

Depending on applicable law and your relationship with PrepAI, you may have rights to:

• Obtain information about personal data processed about you
• Access personal data or information about its processing
• Correct inaccurate data
• Complete incomplete data
• Update data
• Request erasure where applicable
• Withdraw consent where processing is based on consent
• Raise a grievance
• Nominate another individual to exercise applicable rights in the event of death or incapacity, where law provides that right
• Exercise other statutory privacy rights

Requests may be submitted to: [email protected]

We may verify your identity or authority before acting on a request.

Certain information may need to be retained despite a request where necessary for:

• Compliance with law
• Security
• Contractual requirements
• The establishment, exercise or defence of legal claims

20. Account Closure and Deletion

Users may request account closure through available account controls or customer support.

Closing an account may result in loss of access to:

• Quizzes
• Assessments
• Analytics
• Reports
• Participant data
• Other Customer Content

Where an institutional customer controls relevant information, the institution’s instructions or contract may govern deletion and retention.

21. Third-Party Services and Links

PrepAI may integrate with or link to services operated independently by third parties. These may include:

• LMS systems
• Payment providers
• Authentication providers
• AI providers
• External websites
• Other software platforms

Independent third parties operate under their own terms and privacy practices. PrepAI is not responsible for independent data processing outside DataToBiz’s control.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in:

• Applicable law
• Our Services
• Technology
• Security practices
• Data-processing activities

Material changes may be communicated through:

• The PrepAI website
• The WebApp
• Registered account email
• Another reasonable channel

The Effective Date at the top identifies the version currently in effect.

23. Contact and Grievance Redressal

Privacy Contact

• Name/Designation: Ankush Sharma, Co-Founder & CEO
• Email: [email protected]

Consumer Grievance Officer

• Name: Ankush Sharma
• Designation: Co-Founder & CEO
• Email: [email protected]
• Phone: +91-7009935623

We aim to acknowledge consumer grievances within 48 hours and redress them within one month, or within another period required by applicable law. Privacy grievances will be handled within the time required under applicable data-protection law as those requirements become applicable.