Privacy policy

Account and sign-in

Your mobile number, which we verify with a one-time password (OTP) sent by SMS. Optionally your name and email address. For security we record sign-in sessions with the device type, browser, IP address and time.

Profile and onboarding answers

What you tell us when you set up your account or speak with the AI counselor: who you are (for example student, job seeker or teacher), the interview or exam you are preparing for, your goals, current level, preferred languages and voice, city, daily practice time and reminder preferences.

Interviews, lessons and counselor calls

What you say during a mock interview, lesson or counselor call is converted to text. We store the text transcript of each turn, the interview settings you chose, and the scores, feedback and report generated from it. We do not record or store the audio of your sessions.

Purchases

Orders, the plan or pack you bought, amounts, invoice details (including a GSTIN if you provide one), refund requests and your minutes balance. Card, UPI and bank details are entered on Razorpay’s checkout and are handled by Razorpay; we do not receive or store them.

Usage and support

Which courses, lessons and interviews you start and finish, streaks and achievements, ratings you give, consents you grant, and messages you send to support.

On your device

The website uses your browser’s local storage to keep you signed in and to remember interface preferences. We do not use advertising cookies or third-party analytics or advertising trackers.

We process personal data on the basis of the consent you give when you create an account and accept this policy, and for legitimate uses the DPDP Act allows, such as complying with law (for example tax invoices). We use your data only to:

• create and secure your account, verify your phone number and prevent misuse;
• run mock interviews, lessons and counselor calls in the language you choose, and generate scores, feedback and reports;
• personalise practice — the interview tracks, questions, courses and reminders we suggest;
• process payments, issue GST invoices, handle refunds and keep your minutes balance accurate;
• answer support requests and send service messages about your account, purchases and sessions;
• measure and improve the quality, reliability and cost of the service; and
• meet our legal obligations and enforce our terms.

We do not sell your personal data, and we do not use it for advertising. You can withdraw consent at any time by writing to us or by deleting your account; withdrawal does not affect processing already done, and some features will stop working without the data they need.

We use the following service providers (Data Processors) to run ExamPilot. Each receives only the data it needs for its task and processes it on our instructions.

Hosting and storage — Google Cloud

Our servers, database and stored files (such as invoice and report PDFs) run on Google Cloud in its Mumbai (asia-south1) region.

Real-time voice — Agora

Carries the live audio between your device and the AI interviewer or tutor during voice sessions.

Speech recognition and voice — Soniox, Murf AI, Microsoft Azure AI Speech and Sarvam AI

Convert your speech to text and generate the interviewer’s or tutor’s voice, depending on the language of the session. Deepgram, ElevenLabs and Cartesia are configured as alternative speech providers and may be used for the same purpose.

AI models — OpenAI

Generates interviewer and tutor replies and evaluates transcripts to produce your report. We send the conversation text and the context needed for the session, not your phone number. Some features may be routed to Google’s Gemini models for the same purpose.

SMS — 2Factor, MSG91 and Gupshup

Deliver your sign-in OTP to your mobile number.

Payments — Razorpay

Processes payments and refunds. Razorpay collects your payment details directly under its own terms and privacy policy.

We may also disclose personal data where the law requires it, for example to comply with a lawful order of a court or government authority.

Our primary database is in India. Some processors above, such as the AI model and speech providers, may process data on servers outside India. Where this happens we transfer only what the task needs, and we do not transfer personal data to any country the Government of India restricts under section 16 of the DPDP Act.

• Account, profile, transcripts and reports: for as long as your account is active, so you can review your progress.
• One-time passwords: only for the few minutes they are valid, plus a short record of the attempt for abuse prevention.
• Orders, payments and invoices: for as long as tax and accounting laws require, even after you delete your account.
• Support messages: for as long as needed to resolve your request and keep a record of it.

When you ask us to delete your account, we deactivate it straight away and then remove your name, phone number and email address from our records. Records we must keep for financial, legal or security reasons are kept in a form that is no longer linked to those identifiers. If you want specific transcripts or reports deleted as well, say so in your request.

Under the DPDP Act you have the right to:

Access

Get a summary of the personal data we hold about you and the processing we do, and know which processors we share it with.

Correction and completion

Fix inaccurate or incomplete data. You can edit most profile details yourself in Settings.

Erasure

Ask us to delete your personal data, unless we must keep it to comply with law.

Withdraw consent

Stop processing based on your consent, as easily as you gave it.

Nominate

Nominate another person to exercise these rights for you in the event of your death or incapacity.

Grievance redressal

Complain to us about how we handle your data, and escalate to the Data Protection Board of India if you are not satisfied with our response.

To use any of these rights, write to hello@exampilot.ai with "Privacy" in the subject line from the email or phone number linked to your account. We may ask you to verify your identity before acting on a request.

Our Grievance Officer handles privacy complaints and requests. Contact: Grievance Officer, ExamPilot (Illumin), hello@exampilot.ai, subject line "Grievance". We acknowledge every grievance and respond within the time the DPDP Act and its rules require.

Some ExamPilot practice — for example school practical vivas — is used by students under 18. Under the DPDP Act, a person under 18 may use ExamPilot only with the verifiable consent of a parent or lawful guardian, who should create or supervise the account. We do not track children’s behaviour or target advertising at them. If you believe a child is using ExamPilot without a parent’s consent, write to us and we will act on it.

We protect your data with encryption in transit (HTTPS), access controls that limit staff access to what their role needs, audit logs of administrative actions, encrypted storage of service credentials and regular review of our systems. No online service can be perfectly secure. If a personal data breach occurs, we will inform affected users and the Data Protection Board of India as the law requires.

If we change how we handle personal data, we will update this page and the date below. For material changes — for example a new purpose or a new category of processor — we will tell you in the app or by message before the change applies, and ask for fresh consent where the law requires it.