Privacy policy
Last updated 27 September 2026
We collect as little as the product can work with, we keep it in India, and we do not sell it. This page explains exactly what we hold and what you can make us do about it.
Who is responsible for your data
LUMINOVIX TECHNOLOGIES is the data fiduciary for the purposes of India’s Digital Personal Data Protection Act, 2023 (DPDP Act). Our registered address is on the contact page.
What we collect
| Data | Why we have it |
|---|---|
| Your name | Given when you create an account with a password, so we know who we are writing to if you contact support. It is never shown to anyone else and never used in marketing. |
| Email address | To create your account, sign you in, restore your access on a new device, and send you one reminder before a pass expires. That reminder says when your pass ends and nothing else — never your scores, your answers or what you have studied. It carries an unsubscribe link, and stopping it changes nothing about your access. If you bought a pass, we may also write once after your exam to ask how it went and whether you would rate BCBR Buddy; reply “stop” and we will not write again. When you buy, your address also goes to Razorpay so they can email you the payment confirmation. |
| Your answers and progress | Which questions you attempted, what you chose, what you flagged, which revision notes you opened and on which day, your exam date. This is what makes your progress, mistakes list and readiness score work, what lets you resume on another device, and how we tell which notes are worth improving. |
| Ratings and reviews | If you rate BCBR Buddy: your stars and anything you write. Your stars count in the average rating shown on the website. What you write appears there only if you post it as a review and tick the box to show your first name, and only after we have read it. A suggestion is read only by us. |
| Session and device information | A record of the device currently signed in, so we can enforce one active session per account and detect sharing. |
| Purchase records | Which pass you bought, when, how much, and the payment reference. Needed to give you access, to handle refunds, and to keep lawful business records. |
We do not collect or store your card, UPI or bank details. Payments are handled entirely by Razorpay; we receive only a reference and a confirmation that a payment succeeded.
We do not run advertising trackers, we do not build advertising profiles, and we do not sell or rent your data to anyone.
Where your data lives
Your account and study data are stored in India, in a database hosted by Supabase in the Mumbai region. Some infrastructure providers we rely on operate globally and may process limited technical data (such as an IP address in a server log) outside India.
Who we share it with
Only the providers we need to run the service, and only for that purpose:
- Supabase — database, authentication and email delivery for sign-in codes.
- Razorpay — payment processing. Razorpay is a regulated payment aggregator and handles your payment details under its own privacy policy.
- Vercel — website and application hosting, and cookieless usage measurement.
- Google Play or Apple — if you buy inside a mobile app, that store processes the payment under its own terms.
We may also disclose data where the law requires it, or to establish or defend a legal claim.
Storage on your own device
The app stores content and your recent answers in your browser or device storage. That is what lets it work offline and on a slow connection. It stays on your device, and clearing your browser data removes it. We do not use advertising or analytics cookies.
Measurement
We count page views and a handful of events — reaching a locked lecture, starting a payment, finishing one — so we can tell which parts of the product work. This is done through Vercel Web Analytics, without cookies and without any identifier that follows you between visits. We do not record who you are, what you answered, or which questions you saw, and we do not sell or share any of it. There is nothing here to opt out of, because nothing here is tied to you.
How long we keep it
- Account and study data: while your account exists, and for 12 months after your last sign-in.
- Purchase and payment records: as long as Indian tax and accounting law requires us to keep them, which is longer than the rest.
- If you ask us to delete your account, we act on it as described below.
Your rights
Under the DPDP Act you may:
- ask what personal data we hold about you and how we use it;
- ask us to correct anything inaccurate or incomplete;
- ask us to erase your data — we will do so except where we must keep purchase records for legal reasons;
- withdraw your consent, which will mean closing your account — see account deletion for how; and
- nominate someone to exercise these rights if you are unable to.
Write to us and we will respond within 30 days. Deleting your account permanently removes your study history, and a deleted account cannot be restored — how to delete your account sets out exactly what goes and what has to be kept.
Grievance officer
If you are unhappy with how we have handled your data, contact our grievance officer:
- Name: Sachin Jagtap
- Email: support@bcbrbuddy.in
- Address: as listed on the contact page
If we do not resolve your complaint you may escalate it to the Data Protection Board of India.
Children
BCBR Buddy is intended for medical professionals and postgraduate students, and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, tell us and we will remove it.
Security
Access to your data is enforced at the database level rather than in app code, connections are encrypted in transit, and payment credentials never reach our systems. No system is perfectly secure, but we will notify you and the Data Protection Board of a breach affecting your data as the law requires.
Changes
We will post any change here with a new date at the top, and tell you by email if the change is significant.
Contact
Any question about this policy: contact us.