Privacy Policy

1. Data Controller

Data Controller: NXGENFLOW SOLUTIONS LLP

, ,

Email: [email protected]

Data Protection Officer:

Email: [email protected]

2. Data We Collect

2.1 Account & Identity Data

• Name and email address
• Account credentials and authentication data

2.2 Learning & Performance Data

• Test responses and answers
• Performance analytics and progress tracking

2.3 Audio & Content Data

• Audio recordings for speaking tests
• Written responses and text submissions
• User-generated content and test creations

2.4 Technical & Usage Data

• IP address and device information
• Browser type, operating system, and technical specifications
• Usage patterns, click streams, and navigation data
• Error logs and diagnostic information
• Cookies and similar tracking technologies

2.5 Payment & Billing Data

• Payment method information (processed by third-party providers)
• Billing address and transaction history (processed by third-party providers)
• Subscription details and usage limits

3. Legal Basis for Processing

3.1 Processing Purposes

• Service Provision: Account management, test delivery, progress tracking
• AI Processing: Automated scoring, personalized learning, content recommendation
• Security: Fraud prevention, account protection, geographic compliance
• Communication: Customer support, service updates, educational content
• Legal Compliance: Regulatory requirements, dispute resolution, law enforcement

4. International Data Transfers & Storage

4.1 Primary Data Location

Our primary servers and data processing facilities are located in India. Your data is primarily stored and processed in India.

4.2 Third-Party Service Providers

We may use third-party service providers in various countries for:

• Cloud hosting and content delivery
• Payment processing (Stripe, Razorpay)
• AI and machine learning services
• Customer support and communication tools

4.3 Data Security During Transfer

All data transfers are encrypted using industry-standard protocols (TLS 1.3+). We maintain comprehensive data transfer agreements with all service providers.

5. AI Processing & Automated Decision-Making

5.1 AI-Powered Services

Our platform uses artificial intelligence and machine learning for:

• Automated test scoring and evaluation
• Personalized learning recommendations
• Content generation and adaptation
• Progress tracking and analytics
• Audio transcription and speech analysis

5.2 Automated Decision-Making

We use automated processing for test scoring, which may significantly affect your learning experience. However, these decisions are not legally binding and are for educational purposes only.

• Right to request human review of AI-generated scores
• Right to contest automated decisions
• Right to receive explanation of AI logic and criteria used

5.3 AI Training and Improvement

Your anonymized data may be used to improve our AI models. You can opt out of AI training data usage by contacting [email protected].

6. Data Retention & Deletion

6.1 Retention Periods

• Account data: Until account deletion plus 30 days for security purposes
• Test results & progress: 3 years after last activity
• Audio recordings: 1 year or until deletion requested
• Payment records: 7 years for tax and accounting purposes
• Support communications: 2 years after case closure
• Security logs: 1 year for fraud prevention

6.2 Automatic Deletion

We automatically delete data when retention periods expire, unless longer retention is required by law or for legitimate business purposes such as fraud prevention or legal claims.

6.3 Account Deletion

Upon account deletion, we will permanently delete your personal data within 30 days, except for:

• Data required for legal compliance or ongoing legal proceedings
• Anonymized data used for research and service improvement
• Backup data (automatically deleted within 90 days)

7. Your Privacy Rights

7.1 General Privacy Rights

All users have the right to:

• Access information about data processing
• Correct inaccurate personal information
• Request deletion of accounts and associated data
• Opt out of marketing communications
• Withdraw consent for optional data processing
• Receive clear information about privacy practices

7.2 How to Exercise Your Rights

To exercise any privacy rights, contact us at:

7.3 Identity Verification

We may request additional information to verify your identity before processing privacy requests to protect your personal data from unauthorized access.

8. Data Security & Protection

8.1 Security Measures

We implement comprehensive security measures:

• End-to-end encryption for data transmission (TLS 1.3+)
• AES-256 encryption for data at rest
• Multi-factor authentication for admin access
• Regular security audits and penetration testing
• Access controls and principle of least privilege
• Secure backup and disaster recovery procedures

8.2 Data Breach Response

In case of a data breach, we will:

• Contain and assess the breach within 24 hours
• Notify relevant authorities as required by law
• Inform affected users if high risk to their rights and freedoms
• Provide clear guidance on protective measures users can take

9. Children's Privacy & Parental Consent

9.1 Age Restrictions

Our service is intended for users 16 years and older.

10. Contact & Complaints

10.1 Contact Information

10.2 Filing Complaints

You can file complaints with relevant data protection authorities in your jurisdiction.

11. Changes to This Privacy Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. Material changes will be communicated via:

• Email notification to registered users
• Prominent notice on our website
• In-app notifications
• Reasonable advance notice

Continued use of our service after changes constitutes acceptance of the updated policy.