Privacy Policy

Draft pending legal review. The data categories and processors below reflect how Medharu is currently built. Highlighted values must be completed, and the text checked against the privacy law that applies to you, before Medharu accepts users. It must also be updated whenever the services or data flows change.

This policy explains what Medharu collects, why, who else processes it, and what you can do about it. The controller is Medharu Technologies Ltd. of [registered address]. For privacy questions contact [privacy contact email].

What we collect

Account details — your name, email address, and profile image if you set one.

Study profile — which exam you are preparing for, your test date, target score, how many minutes a day you intend to study, which days of the week you are available, your timezone and language.

Study activity — this is the bulk of what we hold, and it is what makes the product work:

• every answer you submit, whether it was correct, how long you spent, and how confident you said you were;
• diagnostic results, the skill estimates derived from them, and your study roadmap and daily plans;
• practice and mock exam sessions and their results;
• essays you write and the feedback generated for them;
• conversations with the AI tutor;
• vocabulary review history, your mistake notebook, streaks, XP and badges.

Subscription and payment records — your plan, its status and dates, and a record of payments. Full card and mobile wallet credentials are handled by the payment provider and never reach our systems.

Technical data — device and session information needed to keep you signed in and to secure the service, and how you arrived at Medharu, so we can tell which channels bring people in.

Why we use it

• To provide the service. Your answers drive the adaptive engine — it selects the next question from how you performed on previous ones. Without that history the product cannot function.
• To show you your progress — scores, analytics, streaks and pacing.
• To bill you and to manage your subscription.
• To contact you about your account, and about study reminders if you have enabled them. You can turn off non-essential messages in your notification settings.
• To improve Medharu — understanding which questions are too easy or too hard, and where learners get stuck. This uses aggregated data.
• To keep the service secure and to prevent abuse.

Our legal basis, where that concept applies to you, is performance of our contract with you for the first three, your consent for optional messages, and our legitimate interest in a secure and improving product for the rest. [Confirm the correct bases for your jurisdiction.]

Who else processes your data

We use the following providers. Each receives only what it needs, and each is bound to process data on our instructions.

• Supabase — authentication, database and file storage. Holds your account and study data.
• Vercel — application hosting and delivery.
• Upstash — temporary caching and rate limiting.
• OpenAI and Anthropic — power the AI tutor and essay grading. The text of your questions to the tutor and the essays you submit are sent to them for processing. Do not put sensitive personal information in either.
• Pinecone — search index used to find relevant material for tutor answers.
• PostHog — product analytics, so we can see how features are used.
• Resend — sends account emails such as password resets.
• Stripe, bKash, Nagad, SSLCommerz and RevenueCat — payment processing, depending on how you pay.

We do not sell your personal data, and we do not share it with advertisers.

Where your data is held

Our providers operate internationally, so your data may be processed outside your country, including in [list regions, e.g. the United States and the European Union]. Where the law requires a transfer safeguard, we rely on [state the mechanism, e.g. standard contractual clauses].

How long we keep it

• Account and study data: while your account is open.
• After you delete your account: erased or anonymised within [deletion window], except records we must keep by law.
• Payment records: retained for [statutory period] to meet tax and accounting obligations.
• If your subscription lapses without deletion, study history is kept for [retention period] so you can resume, then deleted.

Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, obtain a portable copy, object to certain processing, or withdraw consent. You can edit your profile and notification settings in the app at any time, and you can delete your account from your profile.

For anything else, write to [privacy contact email] and we will respond within [response time]. If you are unhappy with our response you may complain to your data protection authority.

Children

Medharu is not directed at children under [minimum age]. If we learn we have collected data from a child below that age without the necessary consent, we will delete it.

Security

Passwords are handled by our authentication provider and are never stored by us in readable form. Traffic is encrypted in transit. Access to production data is restricted to those who need it. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority as the law requires.

Changes

We will update this policy when our data practices change, and will tell you in the app or by email when a change is material. The date at the top shows the current version.