Privacy Policy

1. Who we are

Forensique (“we”, “us”) is a test-preparation platform for UGC NET/JRF Forensic Science Paper II aspirants. This policy explains what personal data we collect, why, how we store it, and what rights you have over it.

2. What we collect

• Account data: email address, name (if you provide it), password (stored hashed by our identity provider Supabase Auth, never in plaintext).
• Learning data: your test attempts, per-question responses, time-per-question, bookmarks, custom-test filters. This is what powers the analytics dashboard.
• Payment metadata: subscription ID, plan, status, renewal date. Actual card / UPI / netbanking credentials are collected and processed entirely by Razorpay; we never see or store your card number, CVV, or UPI PIN.
• Technical data: IP address, browser user-agent, and timestamps for security and abuse-prevention.

3. Why we collect it (lawful basis)

• Contract: to provide the Service you subscribed to.
• Legitimate interest: fraud prevention, service improvement, aggregated non-identifying analytics.
• Consent: any marketing emails; you can opt out at any time from the footer of any email.
• Legal obligation: tax and accounting record-keeping.

4. Where your data is stored

Application data lives in Supabase (Postgres) hosted in AWS Asia-Pacific regions. Payment data lives with Razorpay. Static assets and page rendering are served from Vercel's CDN. We do not transfer your personal data to any third party for marketing purposes.

5. Who can see your data

Row-level security in our database ensures that a signed-in user can only see their own attempts, responses, bookmarks, and subscription. Our admins can access aggregate analytics and, when necessary for support, individual records — access is logged and gated on a role flag.

6. Cookies & tracking

We use one strictly-necessary session cookie for Supabase Auth. We do not use third-party advertising cookies. If we add analytics in future, it will be a privacy-respecting product and this policy will be updated with 14 days' notice.

7. How long we keep data

• Account & learning data: for as long as your account is active.
• Deleted-account data: purged within 30 days of deletion, except where retained under law (e.g., financial records for 7 years).
• Payment metadata: as long as required by applicable financial/tax law.

8. Your rights

You can, at any time:

• Access and download your data (email us; we'll send a JSON export within 7 days).
• Correct inaccurate data.
• Delete your account. This cascades to attempts, responses, bookmarks, subscription.
• Object to processing or withdraw consent for optional processing (marketing).
• Lodge a complaint with the relevant data-protection authority.

9. Children's privacy

The Service is not directed to individuals under 18. If we learn we've collected data from a minor, we'll delete it promptly.

10. Security

Data-in-transit is TLS-encrypted. Data-at-rest is encrypted by Supabase / Razorpay / AWS. Access to admin interfaces is limited and gated on database-side role flags with column-level restrictions preventing self-promotion or forgery of scoring data.

11. Changes to this policy

We will notify you by email or in-app banner at least 14 days before any material change.

12. Contact

For any privacy request, email privacy@forensique.in or use /contact.