Privacy policy

Last updated 12 October 2026

This Privacy Policy describes how Philotium Studio (“Philotium”, “ExamGraph”, “we”, “us” or “our”), located in Kumbakonam, Tamil Nadu, India, processes personal data in connection with ExamGraph Schools: the website at examgraph.org and at each school’s own address on that domain, and the ExamGraph Schools iOS app (together, the “Service”).

The Service is provided to schools, colleges and coaching institutes (each a “School”). A School creates the accounts of its students, teachers and administrators; there is no public sign-up. This policy applies to every person who uses the Service through a School (“you” or “User”).

We process personal data in accordance with the Digital Personal Data Protection Act, 2023 and the rules framed under it (the “DPDP Act”), and the Information Technology Act, 2000 and the rules framed under it. This policy should be read together with our Terms and Conditions.

Contents

1. Who is responsible for your data
2. Personal data we process
3. Purposes of processing
4. Who can see your data
5. Service providers
6. Storage and cross-border transfer
7. Cookies and device storage
8. Children’s personal data
9. Retention and deleting your account
10. Your rights
11. Security
12. Changes to this Privacy Policy
13. Grievance Officer and contact

1. Who is responsible for your data

Your School is the Data Fiduciary for the personal data of its students, teachers and administrators. The School decides who has an account, which features are switched on, who can see results, and how long records are kept.

Philotium is the School’s Data Processor. We run the Service for your School and process that personal data only on the School’s behalf, under a written agreement with the School, and only to provide the Service to that School. We do not use it for any purpose of our own.

Philotium is the Data Fiduciary only for the limited technical data described at 2.6, for the contact details of the School representatives we deal with, and for any correspondence you send us directly.

For any question or request about your account or your records, please contact your School first. We will help your School respond, and you may also write to us at support@examgraph.app.

2. Personal data we process

2.1 Account data, provided by your School

• your school ID (a name or number chosen by your School), your name, your role (student, teacher or administrator), your class and whether your account is active;
• your password, which is first set by your School and which you are asked to change when you first sign in. Passwords are stored by our sign-in provider only as a secure hash and cannot be read by us or by your School.

We do not collect your email address, phone number, date of birth, address, photograph, location, contacts, device identifiers or any government identifier. Each account has an internal address of the form id@school.examgraph.org, which is used only for signing in and to which no email is ever sent.

2.2 Study records (students)

• Practice, Focus sessions and School tests: the questions presented to you, the answers you select, the time taken on each question, whether you skipped it, and your scores;
• Derived records: your progress in each chapter, the questions in your Mistakes and those you star, your history, and your rating on the leaderboard.

2.3 MITRA, the AI tutor (students)

MITRA is optional, and your School can turn it off. Before you first use it, the Service explains what MITRA sends to OpenAI and asks you to agree; nothing is sent before you do.

• the messages you send to MITRA and its replies, saved as conversations in your School’s database so you can come back to them;
• where you ask MITRA to explain a question, the question and the answer you selected; and
• how many MITRA replies you used each day, with the number of AI tokens used and their estimated cost, kept to apply the daily limits your School sets.

2.4 Teacher and administrator records

• the questions and figures you write or edit in your School’s question bank, and the tests you build, publish and release;
• an audit log of what administrators and teachers changed, such as creating, changing, deactivating or deleting an account, resetting a password (the log never contains a password), changing classes and settings, publishing and releasing tests, and a teacher or administrator opening a student’s record.

2.5 On your device

• Website: your choice of light or dark theme, your preferred practice and Focus modes, and whether you have agreed to the MITRA notice are kept in your browser’s local storage. They stay on your device.
• iOS app: your sign-in is kept in the iOS Keychain, and the app clears everything else it holds when you sign out.

2.6 Technical data

Our hosting provider (Vercel) and our database and sign-in provider (Supabase) record technical information when the Service is used, including the IP address of each request, browser or device type, the pages requested and the time, used only to run and secure the Service. When a page or a screen of the app fails, it may send us a short error report containing the error message and where it happened, and no other information about you. On the front door, the school ID you type is used only to find your School and is not stored.

3. Purposes of processing

We process personal data, on the instructions of your School, only to:

• create, authenticate and secure your account;
• present practice questions, Focus sessions and School tests, record your answers, and grade them;
• show you your results, history, progress and Mistakes, and show the same records to your teachers and your School’s administrators as described in section 4;
• choose practice questions for you on the basis of your own records;
• generate MITRA’s replies and explanations, and apply the limits your School sets on them;
• keep the audit log your School relies on to supervise access to student records;
• handle requests to delete accounts;
• maintain, secure, troubleshoot and improve the Service; and
• comply with applicable law and respond to lawful requests from authorities.

We do not sell or rent personal data. There is no advertising, no tracking and no analytics tool in the Service: we do not use personal data for advertising or marketing, we do not build profiles of Users for any third party, and we do not use your data to train AI models.

4. Who can see your data

• You can see your own records.
• Your teachers can see the results and activity of the students in the classes assigned to them, and how many MITRA replies each student used. They can never see what you wrote to MITRA.
• Your School’s administrators can see every account and record in the School, and the same MITRA counts. They cannot see your MITRA conversations either.
• Other students, only where your School switches on the leaderboard: students in your class or in your School (as the School chooses) can see your rank and rating, shown with your full name, with your first name and initial, or with no name, as the School chooses.
• Other Schools cannot see anything. Each School’s data is held in that School’s own database, not shared with any other School.
• ExamGraph’s staff access a School’s data only when needed to run, support or fix the Service, or where the School asks us to.

5. Service providers

We disclose personal data only to the following providers, who act as sub-processors under our instructions and only to the extent necessary for the services they provide:

We ask OpenAI not to store these requests, and under OpenAI’s terms for its application programming interface they are not used to train its models. Questions from ExamGraph’s own question bank are read from ExamGraph’s database; nothing about you is written there.

We may also disclose personal data where required by law, court order or a request from a competent authority; where necessary to protect the rights, property or safety of a School, its Users, Philotium or others; or to a successor entity in the event of a merger, acquisition or transfer of the Service, subject to that entity continuing to honour this Privacy Policy and our agreements with Schools.

6. Storage and cross-border transfer

Each School’s database, including its accounts, study records, MITRA conversations and audit log, is run by Supabase on Amazon Web Services in Mumbai, India. The website and its server run on Vercel, whose network may handle requests outside India. MITRA requests, described in section 5, are processed by OpenAI in the United States of America. ExamGraph’s question bank and the list of participating Schools are held in Tokyo, Japan; they contain no personal data of Users.

Personal data is transferred outside India only to countries not restricted by the Central Government under section 16 of the DPDP Act, and only to providers that maintain safeguards consistent with this Privacy Policy.

7. Cookies and device storage

We use only what the Service needs in order to work:

• On the website, a sign-in cookie keeps you signed in. It is set for your School’s site only, is not readable by scripts on the page and is not sent to any other School’s site. The website cannot be used without it.
• Local storage and the iOS Keychain keep what is described at 2.5.

Neither the website nor the app carries analytics, advertising tags or any third-party tracker. If you use a shared device, sign out when you finish; signing out removes your sign-in from that device.

8. Children’s personal data

Many students who use the Service are under 18 years of age. Schools create their accounts, and your School, as Data Fiduciary, is responsible for obtaining any consent of a parent or lawful guardian that the DPDP Act requires, or for establishing that an exemption available to educational institutions applies. We process a child’s personal data only on the School’s instructions and for the educational purposes described in this policy.

We do not undertake tracking or behavioural monitoring of children, or advertising of any kind, and we do not process children’s personal data in any manner likely to have a detrimental effect on their well-being. Personalisation within the Service is limited to selecting practice content and giving MITRA a summary of the student’s own practice. A parent or lawful guardian may request access to, correction of or erasure of a child’s personal data through the School, or by writing to the Grievance Officer.

9. Retention and deleting your account

We keep your personal data for as long as your School keeps your account. A School may turn off (deactivate) an account, which stops it from signing in; a turned-off account keeps its records until it is deleted.

Deleting your account

• In the iOS app, Account › Delete account sends a request to your School’s administrator. On the website, ask your School’s administrator.
• Your School manages your account, so your School’s administrator deletes it. When it is deleted, you can no longer sign in, and your name and school ID are removed. Your MITRA conversations and Mistakes are deleted. Your School keeps your answers and test results without your name, so its records stay complete.
• A School administrator’s own account is deleted by ExamGraph: contact us.

When a School leaves

When a School’s agreement with us ends, we hand the School a copy of its data on request and then delete the School’s database. We keep nothing of the School’s data except what the law requires us to keep, such as records of our agreement and invoices.

Residual copies in backups are erased in the ordinary course of the backup cycle, and technical logs are kept by our providers for a limited period and then deleted.

10. Your rights

Subject to applicable law, you have the right to:

• access a summary of the personal data processed about you and the processing undertaken;
• correct, complete or update your personal data; your School can correct your name and class, and you can change your password in the Service at any time;
• erase your personal data, as described in section 9, subject to the records your School is required to keep;
• withdraw consent where processing is based on consent, without affecting processing carried out before withdrawal; some features, such as MITRA, cannot be used without the data they require;
• nominate another individual to exercise these rights on your behalf in the event of your death or incapacity; and
• seek redressal of grievances from your School and from us, and thereafter from the Data Protection Board of India.

Because your School is the Data Fiduciary, please make requests to your School. You may also write to us at support@examgraph.app with your school ID and your School’s name (never your password); we will pass the request to your School and help it respond. We may take reasonable steps to verify your identity before acting on a request. The support page answers the most common questions.

11. Security

We implement reasonable security safeguards to protect personal data against unauthorised access, disclosure, alteration and loss. Data is encrypted in transit. Each School has its own separate database. Within a School, access is limited by role, so a student sees only their own records and a teacher only the classes assigned to them. Passwords are stored only as a secure hash, password resets are recorded in the audit log, and access to production systems is limited to personnel who need it to operate the Service. No method of transmission or storage is entirely secure, and we cannot guarantee absolute security. In the event of a personal data breach, we will inform the affected School without delay and assist it in notifying affected Users and the Data Protection Board of India as required by law.

12. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time. The date of the latest revision is stated at the top of this page. Where an amendment materially affects the processing of personal data, we will inform Schools before it takes effect, and notify Users through the Service.

13. Grievance Officer and contact

In accordance with the Information Technology Act, 2000, the rules framed under it, and the DPDP Act, the details of our Grievance Officer are as follows:

Vasanth Nagarajan
Grievance Officer, Philotium Studio
Kumbakonam, Tamil Nadu, India
Email: support@examgraph.app

Grievances will be acknowledged within 24 hours and resolved within 15 days of receipt. If you are not satisfied with the resolution, you may approach the Data Protection Board of India.