Privacy Policy

This policy explains how PaperMap (“we”, “us”) handles personal data on this website and, once launched, in the PaperMap app. We have written it to be read by students, not just lawyers.

Data Fiduciary: PLACEHOLDER legal entity name, PLACEHOLDER registered address, India. Contact for privacy questions and grievances: the email address on our contact page.

Summary

• We collect only what we need to run PaperMap and reply to you.
• We do not sell personal data, and we do not show third-party ads.
• You can ask us to access, correct or delete your data at any time.
• This website uses no advertising or tracking cookies.

What we collect

On this website (pre-launch)

Data	When	Why
Email, semester (optional)	Early-access form	To send your invite and launch updates
Name, college, semester, branch, suggestion, email (optional)	Suggestions form	To understand what to build; email only to tell you when it ships
Name, email, message	Contact form	To reply to you
Anonymous, aggregated usage (if analytics is enabled)	Page views	To understand which pages are useful

In the app (after launch)

• Account details: email and the semesters/subjects you choose.
• Study data: your plans, check-in results and progress.
• Answer photos you upload to Answer Coach, and the feedback generated for them.
• Payment records: transaction reference and amount. Payments are processed by a payment gateway; we do not receive or store your UPI PIN or bank credentials.

Why we use it (purpose and legal basis)

We process personal data on the basis of your consent, which you give when you submit a form or create an account, and for certain legitimate uses permitted by the DPDP Act, 2023 (for example, to comply with law). We use data only to:

• provide and improve PaperMap’s features;
• send you service messages and, if you opted in, product updates;
• respond to requests and support questions;
• keep the service secure and prevent abuse.

We will ask for fresh consent before using your data for any new purpose.

Answer photos

Answer photos are used to generate your feedback. They are private to your account and are never shown publicly. We may use de-identified samples to improve answer checking only if you opt in; you can withdraw that at any time.

Who processes data for us

We use a small number of service providers (“Data Processors”) under contract:

• Form provider (PLACEHOLDER, e.g. Formspree / Web3Forms) — receives website form submissions.
• Analytics (PLACEHOLDER, privacy-friendly, e.g. Plausible / Umami) — aggregated page statistics, no cookies, no cross-site tracking. Disabled until configured.
• Hosting (PLACEHOLDER, e.g. Cloudflare Pages / Netlify / Vercel) — serves the website.
• Payment gateway (PLACEHOLDER) — processes UPI payments after launch.

Some processors may store data outside India. Where they do, we rely on transfers permitted under Indian law.

How long we keep it

• Early-access emails: until launch plus 12 months, or until you unsubscribe.
• Suggestions and contact messages: up to 24 months, then deleted or anonymised.
• App account data: while your account is active; deleted within 30 days of an account deletion request, except records we must keep by law (e.g. payment records).

Your rights under the DPDP Act, 2023

You can:

• Access a summary of the personal data we hold about you and how we process it.
• Correct, complete, update or erase your personal data.
• Withdraw consent at any time — as easily as you gave it. This does not affect processing done before withdrawal.
• Nominate another person to exercise your rights in case of death or incapacity.
• Grievance redressal: contact us first. If you are not satisfied with our response, you may approach the Data Protection Board of India.

To exercise any right, use the contact page and choose “Privacy / data request”. We aim to respond within 30 days.

Children

PaperMap is intended for university students aged 18 and above. If you are under 18, please use PaperMap only with the verifiable consent of a parent or guardian.

Security

We use HTTPS everywhere, limit internal access to personal data, and choose processors with reasonable security practices. No system is perfectly secure; if a breach affects your data, we will notify you and the authorities as required by law.

Changes

We will update this page when our practices change and revise the “Last updated” date. Material changes will be announced on the website and Telegram channel.