Privacy Policy

Last updated: July 3, 2026

Operated by Rankify, India.

1. Introduction

Rankify (“we,” “us,” or “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our mock test platform (collectively, the “Platform”).

This Privacy Policy is drafted in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000 (IT Act), and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

Please read this policy carefully. By using the Platform, you confirm that you have read, understood, and agree to the data practices described herein. If you do not agree, please discontinue use of the Platform immediately.

2. Information We Collect

We may collect the following categories of personal information:

2.1 Information You Provide Directly:

  • Account Data: Full name, email address, and password (stored as a salted hash) when you register;
  • Profile Data: Target examination (NEET, JEE Main, JEE Advanced) and target year, display name;
  • Payment Data: When you make a purchase, Razorpay (our payment processor) collects your payment card details, billing address, and phone number. We do not store full payment card numbers on our servers;
  • Communication Data: Information you provide when contacting support, including email correspondence and any attachments.

2.2 Information Collected Automatically:

  • Usage Data: Test attempts, answers submitted, scores, accuracy metrics, time spent per question, and navigation patterns within the Platform;
  • Device & Browser Data: IP address, browser type and version, operating system, device type, screen resolution, and referring URL;
  • Analytics Data: Page views, session duration, and interaction events collected via PostHog and Vercel Analytics (see Section 8 for details);
  • Cookie Data: Session tokens and preference settings stored as cookies (see Section 9).

2.3 Information from Third Parties:

  • If you log in using Google OAuth, we receive your name, email address, and Google profile picture from Google;
  • Payment confirmation details (order ID, payment status, masked card details) from Razorpay.

3. How We Use Your Information

We use your personal information for the following purposes:

  • To Provide and Maintain the Platform: Creating and managing your account, authenticating your login sessions, delivering mock tests, scoring answers, and generating performance analytics;
  • To Process Payments: Facilitating transactions through Razorpay, generating GST invoices, and managing subscriptions;
  • To Improve the Platform: Analyzing usage patterns to enhance the user experience, fix bugs, and develop new features;
  • To Communicate with You: Responding to support inquiries, sending transactional emails (verification emails, password reset links, payment confirmations), and notifying you of material changes to our Terms or Privacy Policy;
  • To Ensure Security: Detecting and preventing fraudulent activity, unauthorized access, and violations of our Terms;
  • To Comply with Legal Obligations: Maintaining records as required by Indian tax and data protection laws.

4. Legal Basis for Processing

Under the DPDP Act 2023, we process your personal data on the following lawful bases:

  • Consent: By registering for an account and accepting this Privacy Policy, you provide your consent to the processing of your personal data for the purposes described herein;
  • Contractual Necessity: Processing necessary to perform our obligations under the Terms of Service, including account management, payment processing, and service delivery;
  • Legal Obligation: Processing required to comply with Indian tax laws (Income Tax Act, GST laws), data protection laws (DPDP Act, IT Act), and lawful government requests;
  • Legitimate Interests: Processing for fraud prevention, network security, and platform improvement, provided such interests do not override your fundamental rights.

5. Information Sharing & Third Parties

We do not sell, trade, or rent your personal information to third parties. We may share your data with the following categories of recipients for the purposes described:

  • Appwrite (appwrite.io): Authentication services, user account storage, and application database. Appwrite hosts data on Google Cloud Platform (us-east-1). See Appwrite Privacy Policy;
  • Razorpay (razorpay.com): Payment processing and order management. We share your name, email, and phone number with Razorpay for invoice generation. See Razorpay Privacy Policy;
  • Vercel Inc. (vercel.com): Hosting provider for the marketing website. See Vercel Privacy Policy;
  • Cloudflare Inc. (cloudflare.com): Hosting provider for the application and content delivery network. See Cloudflare Privacy Policy;
  • PostHog (posthog.com): Product analytics platform. PostHog is self-hosted on our infrastructure, meaning analytics data remains under our control. See PostHog Privacy Policy;
  • jsDelivr (jsdelivr.com): Content delivery network for encrypted test data files. No personal data is shared with jsDelivr.

We may also disclose your information if required to do so by law or in response to valid legal process by a government authority.

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Indian law:

  • Account Data: Retained until you request account deletion. Upon deletion request, personal data will be permanently deleted within 30 days;
  • Test Performance Data: Retained for the duration of your account. Deleted within 30 days of account deletion;
  • Payment Records & Invoices: Retained for 8 years as required under the Income Tax Act, 1961 and GST laws, even after account deletion;
  • Support Correspondence: Retained for 3 years from the date of last communication;
  • Analytics Data (PostHog): Retained for 26 months;
  • Vercel Analytics Data: Retained in accordance with Vercel’s data retention policy.

7. Minors & Children’s Data

7.1 Age Restriction.The Platform is intended for students preparing for competitive examinations. Given the nature of these examinations (NEET, JEE Main, JEE Advanced), many of our users are between the ages of 13 and 18 years (“Minor Users”).

7.2 Parental Consent (DPDP Act 2023). Under Section 9 of the DPDP Act 2023, we are required to obtain verifiable consent from a parent or legal guardian before processing the personal data of any user under the age of 18. By registering, Minor Users confirm that they have obtained such consent. The parent or guardian, by providing consent, accepts this Privacy Policy on behalf of the Minor User.

7.3 What We Collect from Minors.We collect the same categories of data from Minor Users as from adult users (name, email, test performance data). We do not knowingly collect sensitive personal data from minors beyond what is necessary for the Platform’s educational purpose.

7.4 Guardian Rights. A parent or legal guardian may, at any time:

  • Review the Minor User’s personal data held by us;
  • Request correction or deletion of the Minor User’s data;
  • Withdraw consent previously given for processing of the Minor User’s data.

Such requests may be sent to legal@rankify.qzz.io. We will respond within 30 days.

8. Your Rights

Under the DPDP Act 2023 and IT Act 2000, you have the following rights regarding your personal data:

  • Right to Access: Request a summary of your personal data we hold;
  • Right to Correction: Request correction of inaccurate or incomplete data;
  • Right to Deletion: Request deletion of your personal data (subject to legal retention requirements such as 8-year tax record retention);
  • Right to Withdraw Consent: Withdraw your consent to processing at any time. Note that withdrawal may affect our ability to provide the Platform to you;
  • Right to Grievance Redressal: File a complaint regarding our handling of your personal data;
  • Right to Nominate: Under Section 14 of the DPDP Act 2023, you have the right to nominate a person who may exercise your data protection rights in the event of your death or incapacity.

To exercise any of these rights, please contact us at legal@rankify.qzz.io. We will respond to your request within 30 days as required by the DPDP Act. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India.

9. Cookies & Tracking

We use cookies and similar tracking technologies to operate and improve the Platform. Specifically:

  • Essential/Strictly Necessary Cookies: Session cookies required for authentication and to maintain your login state. Sidebar state cookie to remember your sidebar preference. These cannot be disabled;
  • Analytics Cookies: PostHog uses cookies to track page views, sessions, and user interactions. Vercel Analytics uses cookies for aggregate page view counting;
  • Third-Party Cookies: Razorpay may set cookies during the payment process on their checkout page.

You may configure your browser to reject cookies. However, essential cookies are required for the Platform to function, and rejecting them may prevent you from logging in or using key features. For more information about controlling cookies, visit aboutcookies.org.

10. Data Security

We implement reasonable security practices and procedures as required under Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. These include:

  • Encryption of data in transit using TLS 1.3;
  • Passwords securely hashed using industry-standard algorithms (bcrypt);
  • Encrypted storage of test question data using AES-256-GCM;
  • Regular security audits of our codebase and dependencies;
  • Access controls limiting internal access to personal data;
  • Cloudflare DDoS protection and Web Application Firewall (WAF).

While we take these measures seriously, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security of your data.

11. International Data Transfers

Your personal data is primarily stored and processed on servers located in the United States (via Appwrite’s Google Cloud Platform us-east-1 region and Vercel’s infrastructure). By using the Platform, you consent to the transfer of your data to the United States for processing.

We ensure that such transfers are made subject to appropriate safeguards, including contractual obligations with our service providers that require them to protect your data to standards substantially similar to those required under Indian data protection law.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational requirements. We will notify users of material changes by posting the updated policy on the Platform and updating the “Last updated” date at the top of this page. For significant changes, we may also send an email notification to active users. Your continued use of the Platform after changes take effect constitutes your acceptance of the updated policy.

13. Grievance Officer & Contact

Under Rule 5 of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and Section 15 of the DPDP Act 2023, we have appointed a Grievance Officer:

  • Name: Support Team
  • Email: legal@rankify.qzz.io
  • Response Time: All grievances will be acknowledged within 24 hours and resolved within 15 days as required by applicable law.

For general support inquiries (not privacy-related), please contact support@rankify.qzz.io.

Address: India