Privacy Policy

LAST UPDATED 2 AUGUST 2026

What we collect Why Who we share with Where it is stored How long Your rights Cookies Children

This policy explains what we do with your personal data. It is written to be read, not to be survived. If anything here is unclear, email [email protected] and we will explain it in plain terms.

Data controller (or "Data Fiduciary" under the DPDP Act):

Operated byPrepDMAT

Email[email protected]

1. What we collect

If you never create an account

You can read every guidance page and answer all 50 free practice questions without an account, and without us collecting anything that identifies you. Your answers to those questions are held in your own browser and never reach us. The site makes no request to our database at all until you choose to sign in.

We do collect anonymous analytics — see Cookies and analytics.

If you create an account

From Google: your email address, your name, and your Google account identifier. That is all we request. We never receive your Google password, your contacts, your files, or anything else in your Google account.
From your use of the site: which mocks you have taken, when, your answers, your score per section, the time you spent in each section, and the analysis generated from that.

If you buy access

Payment records: the order and transaction identifiers, the amount, the currency, the status, the payment method (for example "UPI" or "card"), and where applicable the bank name, the UPI VPA, or the last four digits of the card.
We never receive your full card number, CVV, UPI PIN, or net-banking credentials. Those are entered inside Razorpay's checkout and go to Razorpay, never to us. We could not store them if we wanted to.

2. Why we collect it

Email and nameTo identify your account, to send you the emails described below, and to answer you when you contact support.

Attempts and scoresTo show you your own analysis, to keep it when you change browser or device, and to compare a later attempt with an earlier one. This is the only reason a free mock needs an account at all.

Payment recordsTo grant access, to answer a refund or billing query, and to meet our tax and accounting obligations.

AnalyticsTo understand which questions are too easy or too hard and which pages are not working, in aggregate.

We do not sell your data. We do not share it with advertisers. We do not build advertising profiles. There is no third-party advertising on this site.

Only the processors we need to run the service:

SupabaseDatabase and authentication. Stores your account, attempts and payment records. Hosted in Mumbai, India (ap-south-1).

GoogleSign-in only. Google tells us your email and name after you approve it.

RazorpayPayment processing. Receives your payment details directly; sends us the transaction record.

Cloudflare / NetlifyServing the website and running the payment functions.

Google AnalyticsAggregate usage analytics, with IP anonymisation.

We may also disclose data where the law requires it. If that ever happens and we are permitted to tell you, we will.

4. Where it is stored

Your account data and attempts are stored in Supabase's Mumbai region, in India. Some processors above are outside India and may process data abroad; where that happens it is under their own contractual data-protection terms.

Access to paid material is enforced by row-level security inside the database itself, not by the browser. One account cannot read another account's attempts, scores or payment records, and unpaid accounts cannot read paid questions — that is enforced at the database, so it cannot be bypassed from a browser.

5. How long we keep it

Account, attempts and analysis: until you ask us to delete them, or until 24 months after your last sign-in, whichever is sooner.
Payment records: retained as long as Indian tax and accounting law requires, currently eight years, even if you close your account. We keep the transaction record, not your card details, which we never had.
Analytics: per Google Analytics retention, currently 14 months.

6. Your rights

Under India's Digital Personal Data Protection Act, 2023, you have the right to access the personal data we hold about you, to have it corrected, to have it erased, to nominate someone to exercise your rights if you cannot, and to complain.

To exercise any of these, email [email protected] from the address on your account. We will respond within 30 days.

You can delete your account and everything attached to it by asking us — no form, no retention offer. The only thing that survives is the payment record we are legally required to keep.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

7. Emails we send

We send two kinds of email, both transactional — they are part of the service, not marketing:

When you create an account: one email confirming the account and explaining what to do first.
When you buy access: one email confirming the payment and explaining how to use what you bought.

If we ever send anything genuinely promotional, it will have an unsubscribe link and unsubscribing will never affect your access to anything you have paid for.

8. Cookies and analytics

We use Google Analytics with IP anonymisation to understand aggregate usage. We do not use advertising cookies, retargeting pixels, or third-party trackers beyond this.

If you sign in, we store your session in your browser's local storage so you are not asked to sign in on every page. That is not a tracking cookie — it is how being signed in works — and clearing your browser data signs you out.

9. Children

The dMAT is an examination for applicants to Master's programmes, so this service is intended for adults. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, email us and we will delete it.

10. Changes

If we change this policy materially, we will email account holders. The "last updated" date above always reflects the current version.