Legal

Privacy notice

Last updated

The short version We collect your mobile number so you can sign in, and your answers so we can score them. We do not sell your data, we do not share your results with anyone, and you can ask us to delete the lot.

This notice explains how , trading as Nextstep4u, handles your personal data. Under the Digital Personal Data Protection Act 2023 we are the Data Fiduciary and you are the Data Principal.

What we collect, and why

What	Why
Mobile number	It is how you sign in, and how we send your result and any refund update. Required.
Name and email	To put on your GST invoice. Required only if you buy.
State, and GSTIN if you give one	To charge the correct GST. The law requires the place of supply on the invoice.
Your answers and timing	To score the paper and produce the analysis. This is the product.
Which exam you are preparing for	So we show you relevant notifications rather than all of them.
Device and browser, IP address	Security, fraud prevention and diagnosing a failed attempt.

We do not collect your Aadhaar, your PAN, your caste, your marks in the real examination, or anything about your health. We have no reason to.

What we never do

We do not sell your data, and we do not rent your mobile number to coaching institutes. This is the most common thing done in this category and we do not do it.
We do not publish your score, your rank or your name anywhere another candidate can see it, unless you explicitly ask us to.
We never see your card number, UPI PIN or bank password. Razorpay handles payment on their own page.

Who else sees it

Only the services needed to run this, and only what each needs:

Razorpay — to take a payment and issue a refund.
Our identity provider — to send your OTP and confirm it is you.
Vercel — where the website and the API run.
Neon — where the database is stored.

Your data is stored in India. If that ever changes we will tell you here before it does.

How long we keep it

Account and attempts — while your account is open, and for one year after your last batch expires, so you can look back at your progress.
Invoices and payment records — eight years. Indian tax law requires it, so these survive a deletion request; everything else does not.
Security logs — 90 days.

Your rights

Under the DPDP Act you may ask us to:

tell you what we hold about you, and who we have shared it with;
correct anything wrong;
delete your account and your data, except records tax law makes us keep;
withdraw your consent, which ends your ability to sign in;
nominate someone to exercise these rights if you cannot.

Email from your registered address. We respond within and complete the request within 30 days.

If we have not resolved it, you may complain to the Data Protection Board of India.

Children

Nextstep4u is for candidates aged 18 and over. If a parent or guardian tells us we hold data about someone under 18 without their consent, we delete it.

Messages you get from us

We send: your OTP, your result, receipts and refund updates. These are part of the service and cannot be switched off while you have an account.

Job alerts are optional and you choose them. Every alert says how to stop them, and stopping them does not affect your batch.

Cookies and storage

We store your sign-in token and your display preferences in your browser. We do not use third-party advertising cookies on this site today. If we add analytics or advertising measurement, this notice is updated before it goes live, not after.

If something goes wrong

If personal data is exposed, we notify the Data Protection Board and every affected person, telling you what happened, what it affects and what to do.

Data protection contact

See also Terms of use, Refund policy and Contact.