Privacy Policy

1. Introduction & Scope

Welcome to NeoMCQ. We recognize that privacy, confidentiality, and security are fundamental considerations for students, professionals, candidates, and scholars worldwide. This Privacy Policy details our practices concerning the collection, storage, processing, transfer, and disclosure of personal data when you interact with the NeoMCQ web application, APIs, user accounts, and study tools.

By creating an account, accessing educational modules, submitting prompts to our AI Tutor, or subscribing to paid tiers on NeoMCQ, you acknowledge the data handling practices described in this document. If you do not agree with these practices, you must discontinue platform use.

2. Operating Entity & Platform Description

NeoMCQ is an online educational technology platform providing AI-assisted exam preparation, structured learning materials, practice questions, quizzes, flashcards, notes, AI tutoring, study tools, and related educational services across international examination systems and jurisdictions.

3. Information We Collect

We collect several categories of information to operate, secure, and personalize the platform:

• Account & Authentication Information: Email address, hashed authentication credentials, unique account identifiers, sign-in timestamps, and authentication tokens issued via Supabase Auth.
• Profile & Preferences: Full name, target examination (e.g., USMLE, PLAB, NCLEX, NEET-PG), target exam year, specialty interest, selected primary curriculum, and UI theme preferences.
• Exam & Subject Selections: Selected subjects, subtopics, study mode choices, difficulty preferences, and custom syllabus filters.

4. Educational Activity, Prompts & AI Content

To deliver adaptive study tools, track knowledge retention, and render AI Tutor lessons, we record user interaction data:

• MCQ & Quiz Performance: Question attempts, selected options, correctness, time spent per item, error patterns, revision bookmarks, and active recall drill scores.
• User Notes & Saved Content: User-created Sticky Notes, custom text highlights, saved flashcards, and A4 revision note bookmarks.
• AI Tutor Conversations & Prompts: Text prompts, questions, and audio requests submitted to the interactive AI Tutor. Prompts are transmitted to secure AI model endpoints (such as OpenAI or Google Gemini) to generate step-by-step whiteboard explanations and high-speed neural audio (TTS).
• 30-Day Canonical Content System: AI-generated study materials (MCQs, revision notes, tutor whiteboards) are stored in our central database for up to 30 days. Shared canonical content is reused across candidate requests to reduce redundant AI compute while maintaining freshness. Users explicitly acknowledge that AI outputs are stored and versioned to provide historical learning continuity.

5. Payment Information & Razorpay Processing

All commercial transactions, subscription upgrades (Pro, Max, Elite), and one-time exam curriculum switch fees ($2.00 USD) are processed securely through Razorpay.

• No Sensitive Card Storage: NeoMCQ does NOT collect, store, or transmit raw credit card numbers, debit card numbers, CVVs, or banking PINs on its own servers. All payment credential inputs are captured inside Razorpay’s PCI-DSS compliant iframe/checkout element.
• Transaction Metadata Recorded: For account verification, billing records, and tax compliance, NeoMCQ stores transaction metadata: Razorpay Payment ID, Order ID, subscription tier, canonical price in USD, payment status, transaction timestamp, and billing country.
• Razorpay Legal Policies: Payment processing is governed by Razorpay’s Privacy Policy and terms. You may inspect Razorpay’s official compliance standards at https://razorpay.com/privacy/.

6. Technical Data, Logs & Cookies

When you access NeoMCQ, our servers automatically log technical request headers:

• Device & Security Logs: IP address, user-agent string, operating system version, browser type, referrer URLs, request timestamps, and API response status codes.
• Essential Cookies & Storage: We use local storage and essential session cookies for authentication state, CSRF protection, and UI theme preferences (dark/light mode).

7. How We Use Your Information

NeoMCQ processes user personal data strictly for lawful, legitimate business purposes:

8. Data Retention & Account Deletion

We retain personal data for as long as your account remains active. Upon requesting account deletion via privacy@neomcq.com or our Contact Us portal:

• Account credentials, user profiles, and saved notes are purged or permanently anonymized within 30 days.
• Exceptions: Transaction logs, Razorpay order references, and tax ledger records are retained for mandatory statutory periods required by financial regulators (typically 5–7 years).

9. Third-Party Service Providers

NeoMCQ engages trusted third-party infrastructure vendors who process data under strict data protection agreements:

• Supabase Inc.: Managed PostgreSQL database hosting, user authentication (Supabase Auth), and row-level security enforcement.
• Razorpay Software Pvt. Ltd.: Secure international credit card processing, subscription management, and webhook verification.
• OpenAI LLC & Google LLC (Gemini API): Enterprise AI model processing endpoints for educational prompt completions and neural audio synthesis.
• Cloud Infrastructure (Vercel / Cloud Run): Edge server hosting, SSL encryption, and application execution environments.

10. International Data Transfers

NeoMCQ serves users internationally across multiple continents. Your personal information may be transferred to, stored, and processed in secure data centers located in the United States, Europe, or other cloud server regions. Where required, we rely on standard contractual clauses (SCCs) and adequacy frameworks to safeguard cross-border transfers.

11. EU & UK GDPR Data Subject Rights

If you reside in the European Economic Area (EEA) or the United Kingdom, you possess specific legal rights under Regulation (EU) 2016/679 (GDPR) and UK GDPR:

• Right of Access (Art. 15): Request a copy of all personal data held by NeoMCQ.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete profile data.
• Right to Erasure / Right to be Forgotten (Art. 17): Request deletion of your personal data subject to legal retention exceptions.
• Right to Restriction & Objection (Art. 18 & 21): Object to processing based on legitimate interests.
• Right to Data Portability (Art. 20): Request your learning data in a structured, machine-readable JSON format.

To exercise GDPR rights, contact privacy@neomcq.com.

12. California Privacy Rights (CCPA / CPRA)

Under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), California residents have specific privacy rights:

California users may request access to or deletion of their data twice per 12-month period without discrimination.

13. Other Regional Privacy Rights

Users in Canada (PIPEDA), Australia (Privacy Act 1988), India (DPDP Act 2023), Brazil (LGPD), and other jurisdictions enjoy local statutory privacy protections. NeoMCQ processes all privacy requests in accordance with applicable non-waivable laws.

14. Automated Processing & AI Personalization

NeoMCQ uses automated algorithms solely to recommend subtopics, generate adaptive flashcards, and calculate knowledge radar metrics. We do NOT use automated decision-making to produce legal effects or similarly significant decisions affecting individuals.

15. Children’s Digital Privacy

NeoMCQ is designed for academic exam candidates, university students, and professional licensure candidates. We do not knowingly collect or solicit personal information from children under 16 (or the applicable digital consent age in your jurisdiction) without verified parental/guardian consent.

16. Data Security & Incident Response

We enforce 256-bit SSL transport encryption, Supabase database Row-Level Security (RLS), and API authentication checks. In the event of a confirmed security incident impacting user data, NeoMCQ will notify affected users and applicable regulatory bodies as required by law.

17. Privacy Contact & Policy Updates

For privacy inquiries, GDPR data requests, CCPA rights execution, or account deletion: