Privacy Policy

1. Who we are

SmartPrep CBSE (“SmartPrep,” “we,” “our”) is an assessment platform built for schools affiliated with the Central Board of Secondary Education (CBSE) in India. We help teachers generate worksheets, grade student work — including handwritten answers — and analyse student performance using artificial intelligence.

SmartPrep CBSE is an EdTech product owned and operated by Telique EdTech Pvt Ltd.

SmartPrep CBSE is not affiliated with or endorsed by the Central Board of Secondary Education (CBSE).

We are a small founding team. You can reach us at contactus@smartprepcbse.com or +91 93987 63261. This policy explains what information we collect, how we use it, and the choices you have.

2. Scope

This policy applies to everyone who uses smartprepcbse.com and the SmartPrep service. That includes:

• School administrators who sign up their school
• Teachers who use SmartPrep to create and grade assessments
• Students who complete assignments on the platform
• Visitors who browse the public website or our blog

3. The data we collect

3.1 Account information

For every user who signs in, we store:

• Name and email address
• Password (stored only as a one-way cryptographic hash — we cannot read it)
• Role on the platform (school admin, teacher, or student)
• The school the account is associated with
• An optional profile image, if you upload one

3.2 Student information

For each student account, we additionally store:

• Roll number (optional)
• Classes the student is enrolled in
• Optional parent or guardian contact details — name, phone number, and preferred communication language — provided only when entered by the student, teacher, or school. These are used to send academic updates and weekly summaries to the parent or guardian by WhatsApp (see Section 6).

We do not collect Aadhaar numbers, PAN, financial information, biometric data, or government-issued identifiers of any kind. We do not collect a student's home address or date of birth.

3.3 Academic content

When teachers and students use SmartPrep, we collect:

• Worksheets and questions generated by teachers
• Student answers — both typed responses and uploaded photographs of handwritten work
• Marks awarded, teacher feedback, and any annotations made on student work
• Submission metadata: when an assignment was started, completion duration, and when it was submitted
• Screen-leave records: during online tests, SmartPrep records when a student switches tabs or leaves the window, and for how long. The teacher sees this while grading. It is stored with that submission only, and it is not used to build a profile of the student. A school administrator can switch this recording off for the whole school.
• Performance summaries derived from completed work (topic strengths, weak areas, trends)

3.4 Technical information

We collect basic technical information automatically:

• Anonymised usage statistics through Vercel Analytics — page views, performance metrics, browser type. This data does not include personal identifiers.
• Secure authentication cookies that keep you signed in, managed via Supabase Auth
• Error monitoring and crash telemetry via Sentry to diagnose runtime bugs and ensure platform reliability
• Server logs of API requests, which include the requesting account and the action taken, retained for diagnostic purposes

We do not use third-party advertising trackers, Google Analytics, Meta Pixel, or similar cross-site advertising technologies.

4. How we use information

We use the data we collect only for the following purposes:

• To operate the SmartPrep service — letting teachers generate worksheets, grade submissions, and review analytics
• To authenticate users and maintain account security
• To provide AI-assisted grading and feedback on student work, as described in Section 5
• To generate performance analytics scoped to the requesting teacher, school admin, or student
• To communicate with users about their account, important service updates, or pilot programs they have opted into
• To improve the service — for example, by understanding which features are used and where the application is slow or broken

We do not sell personal data. We do not share personal data with advertisers. We do not use student work to train or improve AI models, ours or anyone else's.

5. Our use of artificial intelligence

SmartPrep uses Google's Gemini AI models (the Flash and Flash-Lite families) to generate worksheet questions, grade subjective answers, transcribe handwritten work, and suggest feedback.

When an AI feature is invoked, the relevant content (a worksheet prompt, a student's answer, or a photograph of handwritten work) is sent to Google's Gemini API for processing. Per Google's published terms for the paid Gemini API, content sent through the paid API is not used to train Google's AI models.

Google is the only AI provider that receives student data. We do not send it to any other AI service.

All AI-suggested marks and feedback are reviewed and editable by the teacher. The teacher remains the final authority on every grade — the AI cannot publish a mark on its own.

6. Where data is stored

SmartPrep relies on the following infrastructure and sub-processors:

• Supabase (PostgreSQL) — our primary database and authentication provider, hosted in the AWS Asia Pacific (Mumbai) region (ap-south-1). Supabase is SOC 2 Type II and ISO 27001-aligned, with row-level security (RLS) isolating each school and user. Data is encrypted at rest (AES-256) and in transit (TLS).
• Vercel — our application hosting and serverless compute runtime, deployed in the Mumbai region (bom1). Vercel holds SOC 2 Type 2 certification.
• Vercel Blob — used to store uploaded files such as photographs of handwritten answer sheets and school logos.
• Google Cloud (Gemini API) — used only when AI features are invoked, as described in Section 5. Calls are processed via Google's enterprise paid API.
• WhatsApp (Meta Cloud API) — used to deliver periodic academic updates and weekly summary reports to the parent or guardian phone number held for a student.
• Email providers (ZeptoMail by Zoho) — used to send transactional emails such as account setup and password resets.
• Sentry — used for application error diagnostics and uptime monitoring.

Our primary database and application hosting are located in India (Mumbai). Processing by AI and communication sub-processors (Google Cloud, Meta) may occur in secure data centers globally. If your school has specific geographic data residency mandates, please contact us.

7. Who can see what

SmartPrep is multi-tenant: every school's data is isolated by school identifier. The specific access rules are:

• A student can see only their own submissions, marks, feedback, and performance analytics.
• A teacher can see submissions, marks, and analytics for the classes they teach — and nothing outside those classes, even within the same school.
• A school administrator can see school-wide reports for their own school. They cannot see another school's data.
• A small number of SmartPrep founders have engineering access to production systems for debugging and operational purposes. We do not browse student work for any other reason and we will not do so without a documented support request.

8. How long we keep data

We retain account and academic data for as long as the school's account remains active. If a school discontinues using SmartPrep, we will work with the school administrator to either export or delete the school's data within 30 days of the request.

Server logs are retained for 90 days for operational and security purposes, then deleted automatically.

Individual deletion requests — for example, a parent requesting that a student's data be removed — should be sent to contactus@smartprepcbse.com. We will respond within 7 working days and process valid requests within 30 days.

9. Your rights

Depending on the jurisdiction where you live, you may have specific rights regarding your personal data. SmartPrep aims to honour these rights for all users, regardless of location:

• The right to access the personal data we hold about you
• The right to correct inaccurate personal data
• The right to request deletion of your personal data
• The right to receive a copy of your personal data in a portable format
• The right to object to specific uses of your data
• The right to lodge a complaint with the relevant data protection authority

To exercise any of these rights, email us at contactus@smartprepcbse.com. We may need to verify your identity before acting on a request.

10. Children and student data

SmartPrep is designed for use in educational institutions and is used by students who are under 18 years of age (“children” under Indian law). We process student data solely to deliver the educational assessment services commissioned by affiliated schools.

Affiliated schools onboard student rosters and are responsible for obtaining any necessary parental or guardian consents required under Indian law, including under Section 9 of the Digital Personal Data Protection Act, 2023 (DPDP Act).

Children's data (DPDP Act Section 9): We do not show advertising to children and do not sell or share their data with advertisers. During online tests we record when a student leaves the test screen (see Section 3.3) so the teacher can judge whether the work is the student's own. It is kept with that submission, is not sent to AI services, and is not used to build a profile. Your school can switch it off. Separately, to personalise Compass help we keep a learning profile of each student's topic strengths and weak areas and the way they write. It is used only to help that student and their teachers, and is never used for advertising.

11. Security & Breach Notification

We take reasonable technical and organisational security measures to protect personal data, including:

• HTTPS / TLS encryption for all traffic between users and SmartPrep
• Encrypted storage at rest in Supabase (AES-256) and Vercel Blob
• Password hashing using bcrypt — we never store plaintext passwords
• Multi-tenant Row-Level Security (RLS) enforcing strict tenant isolation in PostgreSQL
• Restricted production access limited to authorized engineering personnel

In the event of a confirmed personal data breach affecting users, SmartPrep will notify the Data Protection Board of India (DPBI) in accordance with Section 8(6) of the Digital Personal Data Protection Act, 2023, and notify affected school administrators and users without unreasonable delay.

12. Data Processing Agreements

Schools that need a formal Data Processing Agreement (DPA) before signing up can request one from contactus@smartprepcbse.com. We are happy to execute a standard or school-specific DPA outlining respective roles as Data Fiduciary and Data Processor.

13. Changes to this policy

As SmartPrep grows, this policy will evolve. When we make material changes — for example, adding a new sub-processor or updating data handling practices — we will update the “Last updated” date at the top of this page and, for significant changes, notify school administrators by email. Older versions are available upon request.

14. Grievance Redressal & Contact

In accordance with Section 13 of the Digital Personal Data Protection Act, 2023, SmartPrep has designated a Grievance Officer to address any privacy questions, data requests, or complaints:

If your grievance is not resolved satisfactorily through our Grievance Redressal Mechanism, you have the statutory right to lodge a complaint with the Data Protection Board of India.