Privacy Policy

1. Who we are

SkillCrest, Flat 8, Block 36, PHA Apartments, Near UET, Lahore, Punjab 54900, Pakistan, is the controller of the personal data described in this policy. For any privacy question or request, contact ustadamorg@gmail.com or call +92 306 8805 885.

2. Personal data we collect

Account data: your name, email address and password. Passwords are stored only as a one-way cryptographic hash; we cannot see your password.

Learning data: practice sessions and mock exams you start, your answers and scores, questions you bookmark or flag for review, and any issue reports you write about a question.

Purchase data: the plan or exam you buy, the price, the date, order status and the reference number issued by the payment provider. Card and wallet details are entered directly with the payment provider; we never receive or store your full card number.

Download data: the date and exam of each PDF study guide you download. Each PDF is watermarked with your name, email address and a reference code.

Security and technical data: your IP address and the email address entered when a sign-in fails, or when an account is registered, used for rate limiting and fraud prevention; security-check (captcha) tokens; and server logs kept by our hosting provider.

Communications: the content of messages you send to our support or privacy addresses.

We do not use advertising trackers, sell your personal data, or build marketing profiles of you.

3. How and why we use your data

• To provide the Service (performance of our contract with you): creating and securing your account, running practice sessions and mock exams, showing your progress, and giving you access to what you paid for.
• To process payments and keep financial records (contract and legal obligation): confirming purchases, granting access, handling refunds, and keeping records required by tax and accounting law.
• To protect the Service and our content (legitimate interests): rate-limiting sign-ins, detecting automated abuse, enforcing download limits, and tracing redistributed PDF study guides via their watermark.
• To improve our content (legitimate interests): reviewing issue reports and aggregated, de-identified answer statistics to fix unclear or incorrect questions.
• To communicate with you (contract and legitimate interests): replying to support requests and sending important notices about your account, purchases or changes to our terms.
• To comply with law (legal obligation): responding to lawful requests from authorities.

4. Who we share data with

We share personal data only with service providers that help us run SkillCrest, under contracts that require them to protect it:

• Hosting and infrastructure providers that run our website and servers (for example Vercel).
• Database providers that store our data (for example Neon or another managed PostgreSQL provider).
• Payment providers that process your payments (such as PayFast, Safepay, 2Checkout/Verifone or Stripe, as shown at checkout). They act as independent controllers for the payment data you give them.

We may also disclose data if required by law or a valid order of a court or authority, to protect our rights or users' safety, or to a buyer or successor if our business is reorganised or sold, in which case this policy will continue to apply.

5. International transfers

Our service providers may store or process data outside Pakistan, for example in Singapore, the European Union or the United States. Where we transfer personal data internationally, we rely on providers that offer appropriate safeguards, such as standard contractual clauses, and we transfer only what is needed to provide the Service.

6. How long we keep data

• Account and learning data: while your account is active. When you ask us to delete your account, we delete or anonymise this data within 30 days.
• Purchase and order records: for as long as required by tax and accounting law (typically up to 6 years), even after account deletion.
• PDF download logs: for the life of the account, and up to 12 months afterwards, to investigate redistribution.
• Failed sign-in and registration records (with IP address): normally deleted automatically within 48 hours.
• Used security-check tokens: deleted automatically shortly after they expire (they contain no personal data).
• Support emails: up to 24 months after the conversation ends.

7. Security

We protect your data with measures including encrypted connections (HTTPS), hashed passwords, signed and HTTP-only session cookies, role-based access for staff, rate limiting and bot protection on sign-in. No system is completely secure; if a breach affecting your personal data occurs, we will notify you and the relevant authorities where required by law.

8. Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy of it;
• correct inaccurate data;
• delete your account and personal data, subject to records we must keep by law;
• object to, or ask us to restrict, certain processing;
• receive your data in a portable format;
• withdraw consent where we rely on consent;
• complain to a data protection authority.

To exercise these rights, email ustadamorg@gmail.com from the address registered to your account. We may need to verify your identity, and we will respond within 30 days. Residents of the European Economic Area and the United Kingdom have these rights under the GDPR / UK GDPR.

9. Children

The Service is not intended for children under 13. Users aged 13 to 17 may use it only with the consent of a parent or guardian. If you believe a child under 13 has given us personal data, contact us and we will delete it.

10. Cookies

We use only strictly necessary cookies (to keep you signed in) and a preference cookie (to remember light or dark mode). Details are in our Cookie Policy.

11. Changes to this policy

We will post any changes on this page with a new effective date. If the changes are significant, we will also notify you by email or on the Service before they take effect.