Privacy Policy

1. Who is responsible

Krpex runs Krpex (krpex.in) and is responsible for your personal data (the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023). Contact details are at the end of this page.

2. What we collect

• Account: name, email address, password (stored only as a secure hash by our sign-in provider), and, if you sign in with GitHub or Google, your public profile name and photo from that service.
• Learning profile: your goals, chosen subjects, level, background, learning style, available hours and timeline.
• Learning activity: the courses and lessons generated for you, quiz answers and scores, lesson progress, and the questions you ask your AI professors with their answers. In a course taught by a real professor's AI version, if you choose to send an answer to that professor to check, they see the lesson title, your question, the AI's answer and your note, never your name or email, and we keep their reply.
• Notifications: short messages about your account (a professor's reply, a payment, a report we looked at), shown only to you and kept for 90 days. Ones you haven't seen in the app may also be emailed to you; you choose how often, or turn this off, in your settings or from any of these emails. If you turn on notifications on a phone or browser, we keep that device's push address and keys until you turn them off. Study reminders (at most one a day) are made from your lesson and question activity; you can turn them off.
• Your material: if you build a course from your own files or pasted text, the text extracted from them, split into sections, plus the file name and page count. We don't keep the file itself.
• Professors who teach with us: if you join by invitation as a professor, your profile (name, title, institution, bio, languages), the qualifications you tell us about (seen only by Krpex), the version and date of the agreement you accepted, the text of material you upload (never the file), and the model lessons and lesson reviews you write (reviews are seen only by Krpex), the questions you add to your question bank, your replies to learners, and transcripts of lecture recordings you upload or record here (recordings are sent to Sarvam AI for transcription and not kept by us). Removing material deletes it from our database.
• Usage and billing: daily usage counts, plan, credit balance and payment records (order and payment IDs, amount, status). Card, UPI and bank details are handled by our payment partner, not stored by us.
• Messages: what you send through the contact form.
• Technical: IP address, browser and device information, and server logs used for security and fixing problems.

3. How we use it

• To create and run your account and sign you in.
• To generate personal courses, lessons, quizzes and professor answers.
• To track progress, enforce plan limits and process payments.
• To keep the service secure, prevent abuse and fix problems.
• To reply to your messages and send essential account emails (confirmation, password reset, receipts).
• To email you notifications you haven't seen in the app, unless you turn this off.

We process your data to provide the service you asked for, based on your consent when you sign up, and to meet legal obligations. We don't sell your data, and we don't use it for advertising.

4. Who we share it with

We use trusted service providers who process data for us under their own security and privacy terms:

• Supabase: database and sign-in.
• Amazon Web Services: hosting (servers in Sydney, Australia).
• OpenRouter and the AI model providers it routes to (such as OpenAI): your learning profile, course outline, questions and the relevant parts of any material you uploaded are sent to generate content. Don't include sensitive personal information (such as health or financial details) in your goals or questions.
• Sarvam AI (India): speech-to-text for lecture recordings that professors upload.
• GitHub / Google: only if you choose to sign in with them.
• Razorpay: payment processing, when you buy a plan or credits.
• Email provider (Spacemail): to deliver account and notification emails.
• Your browser's push service (Google, Apple, Mozilla or Microsoft): delivers notifications to devices where you turned them on. Messages are encrypted so the service can't read them.

Some of these providers store or process data outside India. We may also disclose data if the law requires it, or to protect the rights and safety of our users or the service.

5. Cookies and local storage

We use essential cookies to keep you signed in, and your browser's local storage to remember small preferences (such as theme and how far you got in a lesson). We don't use advertising or third-party tracking cookies.

6. How long we keep it

We keep your data while your account is active. When you delete your account, your profile, courses, lessons, progress, professor chats and uploaded material are deleted immediately from our database (backups roll off within about 30 days). Uploaded material that never became a course is deleted after a day, and a course's material is deleted with the course. We keep payment records as long as tax and accounting laws require.

7. Your rights

Under the DPDP Act and other applicable laws you can:

• see and correct your information (most of it is on your Account page);
• delete your account and data (Account → Settings → Delete account);
• withdraw consent, by deleting your account or contacting us;
• nominate someone to exercise these rights for you in case of death or incapacity;
• raise a complaint with our Grievance Officer, and then with the Data Protection Board of India.

8. Security

We use HTTPS, access controls so each learner can only reach their own data, hashed passwords and limited access for our team. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.

9. Children

The service is meant for people aged 18 and over. Anyone younger may use it only with a parent or guardian's verifiable consent. If you believe a child is using Krpex without consent, contact us and we'll delete the account.

10. Changes

We'll update this page when our practices change and change the date at the top. For important changes we'll also tell you in the app or by email.

11. Contact and Grievance Officer

For privacy questions, requests or complaints, contact our Grievance Officer at the email below. We acknowledge requests within 48 hours and resolve them within 15 days. See also our Terms of Service.