Privacy Policy

Who we are

We run Airabits (airabits.com), a service that gives students adaptive skill tests and turns the results into skill profiles for universities and recruiters. For the personal data described here we are the data controller (a "data fiduciary" under India's Digital Personal Data Protection Act, 2023).

Where a university runs assessments for its own students, the university decides why those students are assessed and we process their results on its behalf. Questions about how a university uses results are best sent to that university.

What we collect

We collect only what we need to run the service:

• Account details. Your name, email address, account type (university, recruiter or student), the name of your university, college or company, your password (stored only as a one-way hash, never in readable form), the avatar you pick and whether you want product news by email.
• Your agreement. When you accepted these terms and which version, so we can show your consent if asked.
• Security records. Your IP address, browser type, log in and log out times and security events such as password changes, used to keep accounts safe and stop misuse.
• Purchases. What you bought, the amount, the invoice and the payment reference and method that Razorpay sends us. We never see or store your full card number, UPI PIN or bank login: you enter those with Razorpay, not with us.
• Assessments. If you take a test: your answers, scores, time taken and the skill profile made from them. If you are a university or recruiter: the course material or job descriptions you upload.
• Invitations. When a university, recruiter or student sends tests, we receive the email address (and, if given, the name) of each person invited, and record when the invitation was sent and first opened. We use these only to deliver the invitation and run that person's test.
• Messages. What you write to us by email, including through the contact page.

We do not collect sensitive data such as health, religion, caste, biometrics or financial account details, and we do not use webcams or facial recognition.

Why we use it

We use your data only for these purposes, each with its legal basis:

• To provide the service: create and run your account, deliver tests, show results and profiles, and send receipts, codes and security emails. Basis: performing our contract with you.
• To take payments and keep tax records: process purchases through Razorpay and issue invoices. Basis: contract, and our legal duty to keep financial records.
• To keep the service secure: rate limits, fraud checks and the security records above. Basis: our legitimate interest in protecting users and the service, and legal duties to keep data secure.
• To send product news, only if you turn this on in Settings. Basis: your consent, which you can withdraw at any time.
• To answer you when you contact us. Basis: your request.

Scores are one signal about skill. We do not make decisions that have legal or similarly significant effects on you by automated means alone: universities and recruiters decide what to do with results, and you can ask a person to review a result.

We do not sell your personal data, and we do not share it for targeted advertising.

Who we share it with

We share personal data only as needed to run the service:

• Razorpay (Razorpay Software Private Limited, India) processes payments. When you pay, you give your payment details to Razorpay under its own privacy policy.
• Our email provider (ZeptoMail by Zoho) delivers our emails such as codes and receipts.
• Cloudflare (Cloudflare, Inc.) carries all traffic to the site and protects it from attacks. It also counts page visits for us with Cloudflare Web Analytics, which sets no cookies, keeps no profile of you and does not follow you across other sites.
• Our hosting and infrastructure providers store the data and run the servers.
• Your university sees the results of assessments it runs. Recruiters see a student's results only for tests the student takes for that recruiter, or a profile the student chooses to share.
• People sending tests: if your university or recruiter account's address is on another organisation's invitation list, they see your name, account type and avatar, so they can take you off the list (only student accounts take tests). Student accounts, and addresses without an account, are never revealed this way.
• Authorities, when the law requires it, or to protect someone's safety or our legal rights.

Our providers may use the data only to provide their service to us, under written agreements that require them to protect it.

Transfers to other countries

Our providers may store or process data outside the country you live in. When data leaves the European Economic Area, the United Kingdom or another country with transfer rules, we rely on the safeguards those rules allow, such as the European Commission's Standard Contractual Clauses. Transfers out of India follow the Digital Personal Data Protection Act and any restrictions the Indian government sets.

How long we keep it

• Your account: while it is open. When you delete it in Settings, your name, email, organisation, password and avatar are wiped straight away and every session ends.
• Payment records and invoices: for as long as tax and accounting law requires (in India currently up to 8 years), even after the account is deleted.
• Security records: only as long as needed to protect accounts and investigate misuse.
• Sign ups never confirmed and expired codes are removed or become useless within days.

Your rights

Depending on where you live, you can ask us to:

• tell you what data we hold about you and give you a copy (you can download most of it yourself in Settings);
• correct data that is wrong (you can edit your profile in Settings);
• delete your data (you can delete your account in Settings);
• withdraw consent you gave, for example to product news, at any time and as easily as you gave it;
• object to or restrict some uses, or move your data to another service;
• nominate someone to use these rights for you if you die or cannot act (India).

Write to [email protected]. We answer within one month, and we may need to confirm it is you first. Using your rights is free.

If you are not happy with our answer you can complain to our Grievance Officer, and then to your data protection authority: in India the Data Protection Board of India, in the EU your national supervisory authority, in the UK the Information Commissioner's Office.

California residents: you have the right to know, delete and correct personal information, and not to be treated differently for using these rights. We do not sell or share personal information as the CCPA defines those terms, and we honour Global Privacy Control signals.

Cookies

We use essential cookies to keep you logged in and secure, and optional cookies only with your consent. The Cookie Policy lists them, and you can change your choice any time from "Cookie settings" at the foot of every page.

Children

Airabits is for people aged 18 or over, and you must confirm this when you sign up. We do not knowingly collect data from anyone younger. If you believe a child has given us personal data, write to us and we will delete it.

How we protect it

Data travels over encrypted connections. Passwords are stored as strong one-way hashes. Each part of our system can reach only the data it needs, access is logged, and payments are checked with Razorpay before we mark anything as paid. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

Changes to this policy

If we change this policy we will update the date at the top. For significant changes we will tell you by email or on the site before they take effect.