Privacy Policy

1. Introduction & Consent

ACEx Technologies ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy details how we collect, process, utilize, and safeguard your personal data when you use the ACEx study companion application and website (the "Platform").

By using ACEx, you consent to the collection and use of your personal data as described in this Privacy Policy. You have the right to withdraw your consent to data processing at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal, but may limit your access to Platform features.

2. Information We Collect

We only collect data necessary to deliver and improve our study services. The categories of information we collect include:

• Account Data: Name, username, email address, and phone number (optional).
• Academic Data: Educational grade level, active courses, and study subjects (optional).
• Usage Data: Features accessed, time spent on the Platform, and practice queries/questions asked.
• Technical Data: IP address, browser type and version, device type, and operating system.
• Payment Data: Transaction amount, billing address, and subscription record. All payment cards and banking transactions are processed securely via our payment gateway partner, Razorpay. We do not collect, view, or store your credit/debit card numbers or CVV.

Data We Do Not Collect: We DO NOT collect biometric data, precise GPS location, file contents, or any personal data unrelated to study assistance.

3. How We Use Your Data

Your personal data is processed for the following educational and legal purposes:

• Service Delivery: Managing user accounts, rendering AI explanations, and tracking study progress.
• Platform Improvement: Analyzing aggregated usage metrics to debug software and enhance learning features.
• Communication: Responding to user support inquiries, sending updates, and delivering system emails.
• Legal Compliance: Maintaining tax records, adhering to corporate audits, and complying with regulatory laws in India.

No Data Selling: We do not sell, rent, or lease your personal data to third parties for advertising or any marketing purposes.

4. Legal Basis for Processing (DPDP Act 2023)

Under the Indian Digital Personal Data Protection (DPDP) Act, 2023, we process your personal data under the following legitimate legal bases:

• Consent: Clear and affirmative consent given by you at registration.
• Performance of Contract: Processing necessary to fulfill our service contract (providing study responses and account management).
• Legal Obligation: Compliance with applicable Indian statutory guidelines (e.g., maintaining billing ledger history).

5. Data Storage & Retention

Server Location: Your account information and usage logs are hosted on secure, cloud-based databases located within servers in India.

Retention Periods: We store your personal data only as long as required for the purposes set out in this Policy. Account data is retained for the active lifetime of your account. Transaction ledgers are retained for 7 years to meet tax obligations.

Account Deletion: If you delete your account, we delete all associated account credentials and active study history within 30 days of the request, except where legally required to retain transaction ledger items.

6. Third-Party Data Sharing

We share specific, limited data with third-party service providers (data processors) who assist in executing our services. These processors are contractually bound by data processing agreements:

• Cloud Infrastructure: Supabase (data storage and account indexing).
• AI API Providers: Anthropic, OpenAI, and Google (processing prompts to provide explanations).
• Payment Gateway: Razorpay (processing subscription transactions).
• Email Deliverability: Resend (transmitting verification and transaction emails).

7. User Rights (DPDP Act 2023)

In accordance with the DPDP Act, 2023, you have the following rights regarding your personal data:

• Right to Access: Request a summary of the personal data we process and the processors we share it with.
• Right to Correction: Update or correct inaccurate account details.
• Right to Erasure: Request the deletion of your personal data when no longer needed.
• Right to Grievance Redressal: Direct complaints to our Grievance Officer or the Data Protection Board of India.
• Right to Nominate: Nominate an individual to exercise your rights in the event of death or incapacity.

To exercise any of these rights, email us at support@acex.wtf. We will respond to and resolve all verified requests within 30 days.

8. Data Security & Breach Notification

We protect your data using robust technical measures, including TLS 1.3 encryption for data in transit and AES-256 encryption at rest. Access controls restrict data access only to authorized personnel.

Breach Notification: In the highly unlikely event of a security breach involving your personal data, we will report the incident to the Indian Computer Emergency Response Team (CERT-In) and notify impacted users via email within 72 hours of discovering the breach.

9. Children's Privacy

ACEx is intended for users who are at least 13 years old. Users under the age of 18 require verifiable consent from a parent or legal guardian to register.

If a parent or guardian discovers that their child has registered and shared personal data without consent, they can contact us at support@acex.wtf to request immediate erasure of the child's account and data.

10. Cookie Policy

We use cookies and equivalent local storage tokens to handle core website functionality:

• Essential Cookies: Cookies used to maintain your logged-in authentication token.
• Functional Cookies: Cookies storing layout properties, user settings, and theme preferences.

No Tracking Cookies: We do not deploy third-party advertising, retargeting, or behavioral tracking cookies. You can disable cookies in your browser settings, though doing so may prevent account login functionality.

11. Grievance Officer

If you have questions about your privacy rights or wish to register a formal data complaint, you may contact our designated Grievance Officer:

12. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of India, specifically the Digital Personal Data Protection Act, 2023, and the Information Technology Act, 2000. Any legal actions or disputes related to data privacy shall be resolved exclusively in the courts of Bengaluru, Karnataka, India.

13. Contact Information

For privacy inquiries or support, please reach out to us: