Privacy Policy

1. Entity and Scope

This Privacy Policy applies to the software platform “Prep by EVOLW” (“Prep”, “we”, “our”, or “us”), operated by Evolw, having its principal place of business at Waraseoni, District Balaghat, Madhya Pradesh, India.

This policy covers visitors, registered learners, and administrators accessing the website, platform APIs, and associated learning tools.

2. Information We Collect

We collect only the information necessary to provide structured technical interview preparation, progress tracking, and career workflows:

• Account and Authentication Credentials: Your name, email address, cryptographically salted and hashed passwords (for credential authentication), or OAuth account identifiers (if signing in with Google).
• Curriculum and Learning Records: Selected tracks, roadmap day schedules, task completions, revision dates, flashcards, personal notes, diagrams, and self-reported confidence ratings.
• Resume and Career Information: When voluntarily uploaded by the learner, raw resume text/PDF files, parsed skill evidence, employment history summaries, job preference filters, and target role categories.
• Mock Interview & Assessment Evidence: Learner answers submitted during mock rounds, code editor snippets, diagram layouts, and rule-based feedback or weakness mappings generated by the platform.
• Payment and Transaction Records: Subscription and pass status, transaction IDs, payment interval, and receipt timestamps provided by our payment gateway. We do not process or store raw payment card numbers or banking passwords.
• Security and Technical Telemetry: Anonymized or pseudonymized IP addresses for abuse prevention, sliding-window rate limit counters, user agent strings, and structured error identifiers.

3. How We Use and Process Data

We process collected data strictly for the following purposes:

• Generating personalized curriculum roadmaps and daily revision schedules.
• Grounding preparation blueprints and resume gap analyses in verified facts without fabricating experience.
• Enforcing feature gates and usage limits according to your active plan.
• Preventing account takeovers, brute-force attacks, and automated API abuse.
• Auditing administrative actions and maintaining system reliability.

4. AI Processing and Sensitive Data Policy

Prep includes optional AI enrichment features (such as tutor explanations, draft polish, and mock interview rephrasing). Our data policy enforces strict boundaries:

• Bring-Your-Own-Key (BYOK): Learners may supply their own API keys (e.g., Groq, OpenAI). Learner keys are encrypted at rest with AES-256 and sent strictly to the designated provider for that learner’s requests.
• Sensitive Feature Isolation: Features marked sensitive (resume insights, interview feedback, application strategy narratives) are sent to at most one allow-listed provider and never cascaded across multiple providers.
• No Raw Resume Dumping: Where AI assistance is used on resume data, structured facts (skills, titles, years) are sent; full raw documents are never used for third-party model training.
• Audit Logging Without Prompts: Our usage log records only timestamps, token counts, error codes, and feature keys; prompt text and completions are never stored in the administrative audit log.

5. Data Storage, Security, and Retention

Your data is stored in isolated PostgreSQL databases with TLS encryption in transit and encrypted disks at rest. Uploaded resume files are stored in private database storage scoped strictly to your authenticated account ID.

We retain active account data as long as your account exists. If an account is inactive or deleted, data is purged according to our Data Controls and Deletion policy.

6. Third-Party Service Providers

We engage trusted third-party sub-processors solely to provide core infrastructure:

• Payment Processing: Razorpay Software Private Limited for payment collection, invoice generation, and webhook notifications.
• Cloud Hosting & Compute: Vercel Inc. and PostgreSQL Cloud Provider for hosting, serverless functions, and database storage.
• Transactional Email: Transactional mail infrastructure (such as Resend or SMTP provider) for account confirmation and security notifications.

7. Your Rights and Data Controls

You have the right to access, inspect, export, and delete your data at any time. For self-service controls, see our dedicated Data Controls and Deletion Guide.

To exercise statutory rights under applicable data protection laws, contact our Grievance Officer below.

8. Grievance Officer and Inquiries

In accordance with the Information Technology Act, 2000 and Digital Personal Data Protection Act, 2023, the details of our Grievance Officer are: