Privacy Policy
Last Updated: October 21, 2026 • Governing how student data, examination scores, and credentials are encrypted and protected at Phoenix Studies (PHOENIXFLY CAREERS LLP).
1. Statutory Scope & Corporate Identity
This Privacy Policy describes how PHOENIXFLY CAREERS LLP ("we", "our", "us", or the "Data Fiduciary"), an incorporated Limited Liability Partnership in India with GSTIN 32ABJFP8277G1ZW, collects, processes, stores, protects, and discloses personal data obtained through the Phoenix Studies mock test series platform, CBT test simulator, and associated digital services.
This policy is drafted in strict adherence to the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
2. Categories of Personal Data Collected
We collect only the minimum personal data strictly necessary to fulfill our educational services and simulate CBT examinations:
Full name, verified email address, optional contact telephone number, and target exam preferences (e.g. SSC CGL, GATE CS, SBI PO).
Secure cryptographic password hashes (salted bcrypt), active session tokens, and transient 6-digit One-Time Passwords (OTPs) for registration and credential recovery.
Examination attempt logs, question-by-question response state, time spent per question (in seconds), marked-for-review indices, negative marking deductions, and All-India percentile rankings.
Order numbers, purchased test series titles, invoice timestamps, and GST amounts. We never record or store full credit/debit card numbers or bank NetBanking passwords on our servers.
3. Lawful Grounds for Data Processing
Under Section 4 and Section 6 of the DPDP Act 2023, PHOENIXFLY CAREERS LLP processes personal data on the following lawful grounds:
- Contractual Necessity: Processing your login credentials, test state, and entitlement records is required to execute our contract with you—namely, providing access to the online CBT examination simulator and generating your scorecards.
- Consent: When creating an account or taking our Free 5-Minute Demo CBT Exam, you provide explicit, affirmative consent to calculate your test results and email your account OTPs.
- Statutory Compliance: Retaining purchase transaction logs and GST invoice metadata is mandatory under the Central Goods and Services Tax (CGST) Act, 2017 and Indian accounting standards.
4. CBT Performance Analytics & Scoring Telemetry
When you undertake an examination in our CBT runner, our platform records granular performance telemetry:
- Time-Per-Question Analysis: Tracks whether you are spending disproportionate time on difficult quantitative reasoning or speed-reading comprehension.
- Marked for Review Conversion: Evaluates your decision-making accuracy when revising marked questions before the final timer expiration.
- Anonymized Percentile Engine: Your raw test scores are aggregated into anonymized distribution curves to calculate your All-India percentile rank. Your individual identity, email, or telephone number is never exposed to other test-takers on public leaderboards.
5. OTP & Verification Lifecycle
To eliminate fake accounts and secure student records:
- A temporary 6-digit numeric One-Time Password (OTP) is generated cryptographically on the server.
- The OTP is dispatched via transactional email directly to the applicant's verified inbox.
- The code carries a strict 10-minute validity window. Once verified, or once 10 minutes elapse, the token is permanently invalidated from our active cache.
- Automated rate limiters block repeated OTP requests exceeding 3 attempts within 15 minutes to prevent brute-force attacks.
6. Cloud Security & AES-256 Encryption Standards
We implement comprehensive defense-in-depth technical safeguards to shield candidate data against unauthorized access, destruction, or interception:
All traffic between your browser and our servers is encrypted using modern 256-bit SSL/TLS 1.3 protocols, preventing eavesdropping or man-in-the-middle tampering.
Database storage volumes, backups, and user credentials in PostgreSQL are encrypted at rest using military-grade Advanced Encryption Standard (AES-256).
Database queries enforce strict user isolation. A candidate cannot query or inspect test attempts or invoices belonging to another student account under any circumstances.
Continuous point-in-time recovery and geographically redundant backups protect against data loss in the event of hardware failures.
7. Zero Data Selling Guarantee
Phoenix Studies and PHOENIXFLY CAREERS LLP will NEVER sell, lease, rent, trade, or monetize your personal contact details, email addresses, phone numbers, or examination performance data to third-party telemarketers, loan agents, or external commercial coaching institutes.
Your examination attempts belong solely to you. We do not engage in spam calls, unwanted promotional WhatsApp broadcasts, or cross-platform data tracking.
8. Candidate Rights Under the DPDP Act 2023
As a Data Principal under Indian law, you are entitled to enforce the following rights:
- Right to Access Summary of Personal Data: You can view all active test series, attempt scorecards, profile details, and invoices directly from your Student Dashboard at any time.
- Right to Correction & Updating: You may update your profile details or correct inaccurate information by editing your profile settings or submitting a request to our DPO.
- Right to Erasure / Account Deletion: You may request permanent deletion of your account and test attempts by emailing llpphoenixfly@gmail.com. Upon receipt, your personal identifiers will be purged within 30 days, subject only to statutory tax retention mandates for invoices.
- Right to Grievance Redressal: You have the right to register complaints regarding data handling directly with our designated Data Protection Officer.
9. Protection of Minor Candidates
Many competitive aspirants preparing for NDA, JEE, NEET, or State CET examinations are under the age of 18. In compliance with Section 9 of the DPDP Act 2023:
- We do not engage in behavioral tracking or targeted commercial advertising directed at minor students.
- We do not undertake any processing of personal data likely to cause detrimental effects on the well-being of a child.
- Accounts for minor candidates must be initiated with the affirmative consent and supervision of a parent or guardian.
10. Data Retention & Deletion Timeline
We retain student personal data only for as long as necessary to fulfill the purposes described in this policy:
- Active Account Data: Retained for the lifetime of your registered account to allow continuous review of past scorecards and retake mock tests.
- Transient Verification Data (OTPs): Purged automatically after 10 minutes.
- Financial & GST Invoices: Retained for 8 statutory fiscal years in compliance with the Central Goods and Services Tax Act, 2017.
11. Contact Designated Data Protection Officer (DPO)
For any questions regarding your personal data, privacy inquiries, or to exercise your DPDP Act rights, please contact our Data Protection Officer: