Privacy Policy

1. Who we are

Practivia is operated by a sole proprietor based in Kolkata, West Bengal, India. For the purposes of the Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

This policy covers the Practivia mobile app and the services behind it.

2. What we collect

Your account, and how you sign in:

• Your email address, and whether you have verified it.
• Your password, stored only as a salted hash by our authentication provider. We never see it.

Profile details you choose to enter:

• Your name, years of experience, preferred technologies, current company, designation, location and LinkedIn URL.
• Your mobile number, if you give us one. It is optional, you can add or remove it at any time in Profile → Edit, and its only use is to fill in your details on the payment page. We do not send you SMS.
• The role and company you are targeting, your target interview date, and your timezone.

What you upload and paste:

• Resume and job-description files, together with the file name, type and size.
• Job-description text you paste in directly.
• A structured summary our AI extracts from your resume — a headline, seniority signal, skills, domains, notable projects and gaps — which is stored with the question set it produced.

What you do in the app:

• Your written answers, and the scores, matched points and coaching produced for them.
• Multiple-choice attempts and whether they were correct, bookmarks, your private notes on questions, and which questions you have already seen.
• Progress: experience points, streaks, badges, revision schedule and weekly readiness snapshots.

Billing:

• Your plan, the amount, currency and period, and the payment and event identifiers our payment provider gives us.
• The confirmation payload our payment provider sends when a payment succeeds, kept so payments can be reconciled and disputes answered.

Service usage, so we can meter plans and keep the service running:

• Which AI features you used and when, the token counts and estimated cost of each call, and your credit ledger.
• Which notifications we have sent you, so we do not send them twice.

Notifications, if you allow them:

• A push token for your device and which platform it is, plus your per-notification preferences.

Support requests:

• Your message and the topic you picked, plus your app version, platform, OS version and device model, which are attached automatically so we can reproduce problems.
• Support requests are emailed to us and are not stored in our database.

3. What we do not collect

• No access to your camera, microphone, contacts, photo library, calendar or device location. The app has no audio recording or transcription anywhere in it.
• The only permission the app asks for at runtime is permission to send notifications, and you can refuse it and keep using everything else.
• We do not read anything on your device other than the files you explicitly pick for upload.
• We never sell your personal data, and we do not share it for advertising.

4. Why we use it

• To run your account and keep you signed in.
• To generate question sets tailored to your resume and target role, and to grade the answers you write.
• To measure your plan's credits and limits, which is what makes free and paid tiers possible.
• To take payment and to keep the records the law requires us to keep.
• To send transactional email — verification codes, password resets and receipts — and the notifications you have switched on.
• To answer your support requests.
• To detect and prevent abuse, fraud and attempts to defeat plan limits.

We do not make any decision about you by automated means that has a legal effect on you.

5. Consent, and taking it back

We process your data on the consent you give when you create an account, and again each time you choose to upload a document or switch on a notification type. Consent is not bundled: you can use most of the app without ever uploading a resume, and notification preferences are per-type and reversible at any time in Profile → Notifications.

Withdrawing consent for the processing that the service itself depends on means closing the account — see “Your rights” below, and write to us and we will do it.

6. What is sent to the AI, and what is not

Question generation, explanations and grading are done by Google's Gemini API. This is the part of the app that matters most for your privacy, so here is exactly what crosses that boundary.

Sent to the AI provider:

• The contents of the resume and job-description files you upload for a question set.
• Job-description text you paste, and the target role, company, experience level and difficulty you chose.
• The text of an answer when you ask for it to be graded.
• A multiple-choice question and the option you picked, when you ask for an explanation.

Never sent to the AI provider:

• Your email address, your name or your login details.
• Your payment details, your plan or your billing history.
• Your notes, bookmarks, streaks or progress.

Practice questions generated outside a prep set carry no personal data at all — the request contains a category, a difficulty and an experience level, and nothing else. Our AI key lives only on our servers and is never in the app.

7. Who else handles your data

We keep this list short on purpose. Each of these does one job for us:

• Supabase — hosting, database, authentication and file storage. Everything described above lives here.
• Google (Gemini API) — question generation, explanations and grading, receiving only what section 6 lists.
• Razorpay — payments. They receive your name, your email address, your mobile number if you have given us one, and the amount, and they handle the card details we never see.
• Brevo — transactional email. They receive your email address and the contents of the message.
• Expo's push notification service — delivery of notifications, receiving your push token and the text of the notification.

We may also disclose data where the law requires it, or to establish or defend a legal claim. If the business is ever transferred, your data would move with it and you would be told first.

8. Comparisons with other users

Some screens show how you compare with other people practising the same material. Those figures are only ever computed over a large enough group of users, and only once you have enough attempts of your own for the number to mean anything. They never identify another user, and nobody can see your answers, scores or profile but you.

9. How we protect it

• Uploaded documents go to a private bucket. The storage rules only let you read and write files under your own folder, and there are no public links.
• Every table is protected by row-level security scoped to its owner, so one account cannot read another's data even through the API.
• Payment confirmations are signature-verified before they can change anything, and a plan can only be granted by that verified path.
• Traffic is encrypted in transit. Your session is stored on your own device.
• Secrets — the AI key, the payment keys, the email keys — exist only on the server and are never shipped in the app.

No system is perfectly secure. If a breach ever affects your personal data we will notify you and the Data Protection Board as the DPDP Act requires.

10. How long we keep it

• Uploaded documents: kept only if you left “Keep my files” switched on when you generated the set. If you switched it off, they are deleted from storage as soon as the questions are written. Either way you can delete a stored document yourself at any time.
• Your account, profile and practice history: kept while the account exists, because that history is the product.
• Billing records: kept for 8 years even after an account is deleted, because tax and accounting law requires it.
• Support emails: kept in our support mailbox for as long as needed to resolve the request and handle any follow-up.

11. Your rights

Under the DPDP Act, 2023 you can ask us to:

• give you a summary of the personal data we hold about you and who we have shared it with;
• correct or complete anything inaccurate — most of it you can edit yourself under Profile → Edit profile;
• erase your data and close your account;
• nominate someone to exercise these rights on your behalf if you die or become incapacitated;
• raise a grievance about how we have handled any of the above.

Write to support.practivia@gmail.com from the address on your account. We respond within 7 business days.

12. Children

The app is for adults preparing for professional interviews and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, tell us and we will remove it.

13. Processing outside India

Some of the providers listed in section 7 process data on servers outside India. Where that happens we rely on the provider's contractual commitments to protect it, and we only use providers that offer them.

14. Cookies and tracking

The app uses no cookies and no tracking technologies. The hosted copies of these policy pages are plain static documents: they set no cookies, load nothing from anywhere else, and do not know who is reading them.

15. Changes to this policy

Every version of this policy is numbered and dated at the top. If we make a change that materially affects what we collect or who we share it with, we will tell you in the app before it takes effect.

16. Grievance Officer

Grievance Officer: the operator of Practivia, Kolkata, West Bengal, India. Email support.practivia@gmail.com. We acknowledge every grievance within 48 hours and aim to resolve it within 30 days.

If you are not satisfied with how we have handled it, you may complain to the Data Protection Board of India.