Privacy Policy

RERAExam.com ("we", "us", or "our") is operated by JebuK Properties, Nashik, Maharashtra, India. We are the Data Fiduciary for the personal data we process through this platform. This Privacy Policy explains what personal data we collect, why, who we share it with, how long we keep it, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDP Act). It applies to reraexam.com and all of its state sections (Maharashtra, Karnataka, Uttar Pradesh).

1. Information We Collect

We collect the following personal data when you use RERAExam:

• Phone number - for account creation, OTP-based verification, login, and to contact you about your exam preparation.
• Name - as you provide it when registering or submitting a form.
• Email address - where you provide it (for example via the contact form), for replies and service messages.
• Payment information - transaction ID, payment status, amount, and access period, processed via Razorpay. We do not store card numbers or bank account details.
• Exam usage data - questions answered, scores, topic performance, mock-test activity, and session events, used to run and personalise your practice experience.
• Lead and enquiry data - the state/exam you are interested in, free-test results you choose to save, project/RERA details you enter for buyer verification, and the contents of messages you send us.
• Device and source information - browser type, platform, PWA status, referring page, and basic marketing-source/attribution data, for technical optimisation and to understand how people reach us.

2. Purposes For Which We Use Your Data

• To create, secure, and manage your account and log you in.
• To verify payment and grant or restore access to paid features.
• To track your exam progress and provide personalised practice recommendations.
• To respond to your enquiries and provide customer support.
• To contact you - by email, WhatsApp, or phone - about your exam preparation, your account, and relevant updates.
• To improve our question bank and platform based on usage patterns.
• To meet legal, tax, accounting, and regulatory obligations.

3. Consent and Legal Basis

We process your personal data on the basis of the consent you give when you submit a form, create an account, or make a payment, and for the legitimate uses permitted under the DPDP Act (such as fulfilling a service you asked for and meeting legal obligations). The point at which you provide your details carries a notice and a link to this Policy, so your consent is informed and specific.

Withdrawing consent: you can withdraw your consent at any time (see Section 7). You can stop marketing/automated WhatsApp messages immediately by replying STOP to any such message, or by contacting our Grievance Officer below. Withdrawing consent does not affect processing already carried out, and we may still retain limited data where the law requires it.

4. Communications

We use email, WhatsApp, phone, and in-product notices for account-related updates, support replies, educational content, and service messages. Automated or marketing messages are sent only where permitted by your consent or applicable communication rules, and you can opt out at any time.

We do not sell your personal data, and we do not share your phone number or email with third parties for their own marketing.

5. Who We Share Your Data With (Processors)

We share personal data only with service providers ("Data Processors") who process it on our behalf, under contract, to deliver this service. Each has its own privacy policy:

• Google Cloud / Firebase - authentication, database, and hosting (region asia-south1, Mumbai).
• Razorpay - payment processing.
• Resend - delivery of transactional and service emails.
• Meta (WhatsApp Business / Cloud API) - WhatsApp messaging where you have engaged with us there.
• Google Analytics & Google Search Console - aggregate site analytics and search performance.
• Anthropic (Claude API) - AI assistance used to draft replies and educational content.
• SerpApi - search-result research used for our own SEO analysis (no user personal data is sent).

We may also disclose data where required by law or to enforce our rights.

6. Data Retention

We keep your account data for as long as your account is active. Where you are an enquirer or lead who never creates a paid account and shows no activity, we automatically delete your personal data after 24 months of inactivity. Exam usage and event logs are retained for up to 24 months. Payment and transaction records may be retained longer where tax, accounting, or other laws require it. When data is no longer needed for these purposes, it is deleted.

7. Your Rights Under the DPDP Act

As a Data Principal, you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correction, completion, and updating of your personal data.
• Erasure of your personal data, where it is no longer needed and not required to be retained by law.
• Withdraw consent at any time.
• Grievance redressal - a readily available means to raise concerns with us (see below).
• Nominate another individual to exercise your rights in the event of death or incapacity.

How to exercise your rights: email our Grievance Officer at manage@jebuk.com from the email or with the phone number associated with your account, stating your request. We will verify your identity and respond within a reasonable period as required under the DPDP Act. There is no charge for a reasonable request.

8. Children's Data

RERAExam is intended only for adults (18 years and older) preparing for State RERA real-estate agent certification exams. We do not knowingly collect personal data of children, and we do not carry out behavioural tracking or targeted advertising directed at children. If you believe a child has provided us data, contact our Grievance Officer and we will delete it.

9. Data Security

Your data is hosted on Google Cloud infrastructure in the asia-south1 region (Mumbai, India). We apply reasonable security safeguards, including:

• OTP-based phone authentication for account access and PIN-based session security.
• Server-side payment verification - paid status is never set by the client.
• Database access rules that prevent direct client access to personal data; all reads/writes go through controlled server functions.
• Encryption in transit (HTTPS) and access controls designed to restrict each account to its own data.

10. Data Breach

In the event of a personal data breach, we will take reasonable steps to contain it and will notify the Data Protection Board of India and affected users as required under the DPDP Act and its rules.

11. Cross-Border Transfers

Your data is primarily stored in India. Some of our processors (listed in Section 5) may process limited data outside India in the course of providing their services. We rely on these providers' contractual and security commitments, and only transfer data to jurisdictions not restricted under applicable Indian law.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The version number and "last updated" date at the top reflect the current version. We will notify registered users of significant changes by email or in-product notice.

13. Grievance Officer & Contact