Privacy Policy

groundopen is operated by RADHAVALLABH VENTURES, a business registered in India (GSTIN: 07ABLFR2429Q1ZI), with its registered office at B-114, Jhilmil Colony, Delhi – 110095, India. We provide an online exam preparation platform for IBPS Clerk aspirants.

For privacy-related queries contact us at support@groundopen.com.

We collect only what is necessary to provide our service:

• Account data — name, email address, hashed password (or Google OAuth token).
• Usage data — test attempts, scores, chapter progress, discussion posts.
• Payment data — Razorpay order/payment IDs and subscription status. We never store card numbers or CVV.
• Device data — IP address, browser type, session tokens (for the one-device policy).
• Log data — server-side structured logs for security and debugging (no passwords or tokens logged).

We do not collect Aadhaar, date of birth, phone number, or physical address unless you voluntarily provide them.

• Providing and personalising the exam preparation service.
• Processing subscription payments and issuing GST invoices.
• Enforcing the one-device login policy for exam integrity.
• Sending transactional emails (OTP, payment confirmation, password reset).
• Aggregated analytics to improve question quality and platform performance.
• Complying with legal obligations under the IT Act, 2000 and DPDP Act, 2023.

We do not sell, rent, or share your personal data with advertisers or third-party marketers.

We share data only with the following processors, each bound by data protection agreements:

• Supabase — database hosting (AES-256 encryption at rest, servers in the EU/US).
• Razorpay — payment processing (PCI-DSS compliant).
• Vercel — application hosting and edge CDN.
• Resend — transactional email delivery.
• Upstash — Redis session caching.

We may disclose data to law enforcement or government authorities if required by Indian law (IT Act, DPDP Act, court orders).

• Account and usage data — retained while your account is active and for 2 years after deletion (for dispute resolution).
• Payment records and GST invoices — retained for 8 years (GST audit requirement).
• Server logs — retained for 6 months (IT Act, 2000 requirement).
• OTPs and session tokens — deleted immediately after use or expiry.

As a data principal under the DPDP Act, you have the right to:

• Access — request a copy of all personal data we hold about you (GET /api/user/data-export from your Profile settings).
• Correction — update your name or email from Profile settings.
• Erasure — delete your account and all associated PII (DELETE /api/user/account from Profile settings). Payment records are retained as required by GST law.
• Grievance redressal — contact our Data Protection Officer at support@groundopen.com. We respond within 72 hours.
• Nominate — nominate another person to exercise your rights in the event of death or incapacity.

We use a single httpOnly, Secure, SameSite=Lax session cookie for authentication. We do not use third-party advertising cookies, fingerprinting, or cross-site tracking.

groundopen is intended for users aged 18 and above (minimum IBPS Clerk eligibility age). We do not knowingly collect data from persons under 18. If you believe a minor has registered, contact us at support@groundopen.com and we will delete the account promptly.

Passwords are hashed with bcrypt (cost 12). Session tokens are stored as SHA-256 hashes. All data in transit is encrypted via TLS 1.2+. Database backups are AES-256 encrypted. We conduct a security review before every major release.

We may update this policy to reflect changes in law or our practices. We will notify registered users by email at least 7 days before material changes take effect. The effective date at the top of this page will always reflect the latest version.

Data Protection Officer / Grievance Officer: