Privacy Policy
Effective date: 30 October 2026
TestAspirant ("we", "us") runs this service. This policy explains what personal data we collect, why, and your rights under India's Digital Personal Data Protection Act 2023.
What we collect
| Data | Why | Kept for |
|---|---|---|
| Email address, name | To sign you in, show your name on results, and contact you about your account | While your account exists |
| Your answer to "Are you 18 or older?", and for under-18s your parent's or guardian's email address and when they agreed | To get and record a parent's or guardian's consent (DPDP Act 2023, section 9) | While your account exists |
| Answers, time per question, scores, ranks | To mark your attempts and build your reports | While your account exists, plus 1 year |
| Orders and payment status (not card or UPI details) | To give you access, issue receipts, and meet tax law | 8 years (Indian tax records) |
| Sign-in and security records (IP address, device type, times) | To protect accounts, limit abuse, and investigate problems | Up to 1 year |
| Test monitoring records: counts of tab switches, window changes, leaving full screen, copy, print and screenshot attempts, a second device opening the same attempt, and unusually frequent loading of papers, per attempt, with first and last times; the code in your watermark | To protect the papers from leaks and keep rankings fair. Only staff and your institute's admins see them, and a person reviews them before any action | 1 year after the last event (the code while your account exists) |
| Actions by institute admins and staff | Audit trail of back-office changes | 3 years |
| Enquiries you send us: name, email, optional phone number and message | To reply to you | 12 months |
| Your mobile number, asked when you pay | To help with your order and match your payment. For a purchase without an account, Razorpay receives it with the payment | While your account exists, or with the order (8 years) |
| The campaign link you arrived by: the labels (utm_source, utm_medium, utm_campaign, utm_content, utm_term) on a link from one of our ads or posts, if you used one in the last 30 days, and only if you switch on Analytics or Advertising cookies | To see which of our ads and posts bring people to TestAspirant. It stays with us and is never sent to anyone | With your account while it exists, and with each order (8 years) |
| Analytics events, only if you switch on Analytics cookies: pages you view on our public website and, if your account says you are 18 or older, after you sign in (see Children below); when you start a checkout, send an enquiry, start the free sample or buy without an account | To see how people find and use the website. Your name, email address and phone number are never included | Up to 14 months in Google Analytics |
| Ad-measurement events, only if you are 18 or older and switch on Advertising cookies: the same pages and steps, and browser identifiers that Meta sets (the _fbp and _fbc cookies) | To measure our ads on Facebook and Instagram. Your name, email address and phone number are never included | As Meta's own policy says |
We do not sell your data. We use it to measure our ads only for adults who switch on Advertising cookies, as described in Cookies below. We do not use your mobile number for marketing messages, on WhatsApp or anywhere else.
Children
Many students preparing for entrance exams are under 18. We process a child's data only with consent from a parent or guardian, and we do not track children's behaviour for advertising or profiling.
- Advertising cookies are for adults only. The Meta Pixel loads only after a visitor ticks "I'm 18 or older" and switches on Advertising cookies; without that tick, "Accept all" switches on Analytics only.
- After you sign in, analytics and the Meta Pixel are for adults only. They run on the pages you see after signing in (such as your dashboard, plans, checkout, results and account) only if your account says you are 18 or older and you have switched on that group of cookies. They never run for an account that says you are under 18 or hasn't told us your age. They never run during a test, on its solutions or in the PDF reader. The address of your own attempt is not sent to Meta, and Google Analytics gets it without the attempt's id. They see the pages you view and when you start a checkout, but a purchase made in your account is not sent to Google or Meta.
- We ask your age once. When you sign up, we ask whether you are 18 or older. Accounts made before we asked are asked on their next visit.
- Under 18: we email a parent or guardian. You give us their email address; it must be different from yours. We send them an email that names you (your name and email address), says what TestAspirant is and which data we process, and links to this policy. It carries a link that works once and expires after 7 days. You can have it sent again, up to 3 times a day; a new email replaces the earlier link.
- They agree on a page of ours. The link opens a page that shows your name and what they are agreeing to, with an "I agree" button. They do not need an account.
- Until they agree, your account is limited. You can sign in, see your dashboard and the plans, and change your name. You cannot start any test (the free sample included) or buy a plan, and you do not appear on leaderboards. The same limits on tests and payments apply until you answer the age question.
- We keep the consent record (your answer, your parent's or guardian's email address, and when they agreed) while your account exists, so that we can show consent was given.
Who we share it with
- Razorpay, to process payments.
- Google (Google Analytics), only if you switch on Analytics cookies: the analytics events in the table above.
- Meta Platforms (the Meta Pixel), only if you are 18 or older and switch on Advertising cookies: the ad-measurement events in the table above.
- Our hosting and email providers, to run the service and send sign-in codes.
- Your institute, if you use TestAspirant on an institute's website. It sees your name, email, attempts and results for its papers.
- Other learners, who can see your first name and last initial on leaderboards.
- Authorities, where the law requires it.
Your rights
You can ask to see, correct or delete your personal data, or withdraw consent, by writing to [email protected]. To withdraw consent to analytics or advertising cookies, use Cookie settings at the bottom of any page of our website. We may keep order records that the law requires us to keep. If you are unhappy with our answer, contact our Grievance Officer ([email protected]), or the Data Protection Board of India.
Security
Sign-in uses one-time email codes. Staff and institute admins also use an authenticator app. Data is encrypted in transit. Access to data is limited to the people who need it.
Cookies
- Essential (always on): cookies that keep you signed in and secure, and remember your light or dark theme and your cookie choices.
- Campaign link (only with Analytics or Advertising on): our own cookie, "campaign", which remembers the campaign link you arrived by for 30 days (see the table above). It is never sent to anyone.
- Analytics (off until you switch it on): Google Analytics cookies (_ga and _ga_ followed by an id).
- Advertising (off until you switch it on, 18 or older only): Meta Pixel cookies (_fbp and _fbc).
Our banner asks before any analytics, advertising or campaign-link cookie is set, and "Essential only" turns them all off. You can change your choice at any time with Cookie settings at the bottom of any page of our website; switching one off deletes its cookies.
Changes
We will tell you before a material change to this policy takes effect.
Contact: [email protected]
Version 5, published Oct 30, 2026