Privacy Policy

DailyApple LLP, a limited liability partnership registered in Mumbai, Maharashtra, India ("DailyApple LLP", "we", "us", or "our"), operates Millennial CAT (the "Service"), a CAT mock test and preparation service at cat.millennial-ai.com. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it. It applies to visitors, free-account users, and pass holders alike.

By using the Service, you agree to the collection and use of information as described here. Use of the Service requires your agreement to this policy. This policy should be read together with our Terms of Service.

1. Information we collect

We collect the following categories of personal data:

• Account information — the email address, name, and authentication credentials you provide when you create an account, whether directly or through a third-party sign-in provider (e.g. Google). We do not ask for a phone number.
• College email check — if you claim the free IIT or BITS Pilani pass, we check the domain of your verified email address against our list of institute domains and record that you claimed it and for which CAT season.
• Study activity — your answers, time per question, marks, percentiles and ranks, bookmarks, notes, study-plan preferences, and progress across mocks, sectionals, lessons and practice. This is the data that produces your results, your analysis and your study plan. Your marks count towards the percentiles that other takers of the same paper see, without your name. Where the Service shows a leaderboard, other users see your first name and the initial of your last name beside your score or rank.
• AI help — which AI option you used on which question, and the doubts you type, so we can answer them and keep the free daily limit. See Section 5 for what is sent to AI providers.
• Billing information — when you buy the CAT pass, the order and payment identifiers our payment processor returns, the pass purchased, the amount, your name and email as they were at checkout, and whether the payment succeeded or failed. Card and UPI details never reach us (see Section 8).
• Refund claims — if you claim the 99+ refund, the official CAT scorecard you upload, the CAT registration number and the overall percentile you type, your name and email at the time of the claim, and, for a refund paid by UPI, the UPI ID you give us. The scorecard is kept in a private file store that only our team can open, through our admin pages; it has no public link.
• Usage and device data — pages visited, features used, approximate timing of activity, browser and device type, and similar technical data collected through our product analytics provider, PostHog. This includes heatmaps of how pages are clicked and scrolled and, for a sample of sessions and for sessions in which the app hits an error, a recording of how the pages were used. Text on the page and anything you type are masked in these recordings.
• Communications — information you send us directly, such as support requests or feedback on lessons and explanations. For the emails we send you, we also record whether each one was delivered, bounced, was opened, had a link clicked, or was marked as spam.

We never receive or store your card number, CVV, or other card credentials — those go directly to our payment processor (see Section 8).

2. How we use your information

We use personal data to:

• Provide, operate, and maintain the Service, including marking your mocks, computing percentiles and ranks, spaced-repetition review, and your study plan;
• Give you AI help with solutions, study reminders, and practice suggestions;
• Check that a refund claim or a free IIT or BITS pass meets its conditions;
• Communicate with you about your account, your preparation, and material changes to the Service or this policy (the emails we send are described below);
• Monitor and improve the Service through privacy-respecting usage analytics, including the masked session recordings and email records described in Section 1;
• Detect, investigate, and prevent misuse, fraud, or violations of our Terms of Service; and
• Comply with applicable law and respond to lawful requests from public authorities.

Emails we send. Account and service emails, such as password resets, a welcome note and payment receipts, are sent when they are needed. Founder notes, study tips, and a weekly progress summary are on by default. Daily study reminders are sent only if you turn them on. Each founder note, study tip, progress summary, and reminder carries an unsubscribe link that turns off that kind of email, and you can switch each kind on or off at any time in the email preferences in Settings.

3. Legal basis and consent

Where the Digital Personal Data Protection Act, 2023 ("DPDP Act") applies, we process your personal data on the basis of your consent, given when you create an account and continued by your use of the Service, or where processing is a "legitimate use" recognised under the DPDP Act (for example, to respond to a request you have made, such as taking a free mock). You may withdraw consent at any time by contacting us (Section 10), though this may limit or end your ability to use parts of the Service that depend on that data.

4. Cookies and local storage

We keep tracking to a minimum. The Service uses zero third-party advertising cookies. Where we use browser storage, it is limited to what is needed to run the product — for example, remembering your theme preference, carrying a partner's referral code into your new account, or powering pseudonymous, privacy-respecting product analytics stored via your browser rather than cross-site cookies. Authentication is handled via secure session identifiers required for you to stay signed in.

5. AI processing

AI help (hints, alternative solutions, why the options fail, answers to your doubts, similar questions and mock debriefs) is produced by third-party AI providers. Much of it is generated in advance for each question and stored by us, so using it usually sends nothing about you. When something has to be generated for you, we send the provider the question, the option or answer you selected, and, for a doubt or a mock debrief, the text you typed or your marks on that mock.

We never send your name, email address or user id to an AI provider. Our AI providers may process and store what we send outside India, and may use it to improve their models, so do not type personal details into a doubt. AI-generated content may occasionally be inaccurate or incomplete — see our Terms of Service for the related disclaimer.

6. Sharing your information

We never sell your personal data. We share personal data only with:

• Service providers who process data on our behalf to operate the Service, under obligations to protect it and use it only for the purposes we specify: Vercel (hosting) and Neon (our database), both in Singapore; Razorpay (payments, Section 8); Resend (sending our email); PostHog (product analytics); and AI providers (Section 5);
• Successors, in the event of a merger, acquisition, or sale of assets, subject to this policy or a substantially similar one; and
• Authorities, where required by applicable law, regulation, legal process, or governmental request.

Most of our service providers, including our hosting, database, email, analytics and AI providers, store data outside India. PostHog has no India region, so analytics data leaves India. The DPDP Act permits transfer of personal data outside India except to countries specifically restricted by the Government of India from time to time. By using the Service, you acknowledge this transfer.

7. Data retention and deletion

We retain personal data for as long as your account is active or as needed to provide the Service, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and associated personal data at any time (Section 10); we will action such requests except where retention is required by law.

A refund claim's scorecard file is deleted 90 days after the claim is refunded or rejected, and so are the registration number and any UPI ID you gave us. We keep the claim itself (its outcome and amounts) and a one-way fingerprint of the scorecard and of its registration number, so that one scorecard cannot be claimed twice.

8. Payments

Payments for the CAT pass are processed by Razorpay, our payment processor. When you pay, your card details are collected and processed by Razorpay under its own privacy policy. Razorpay handles your card number; we never see or store it. We store no payment method for reuse. The CAT pass is a one-time purchase: nothing is charged again and nothing renews.

What we do receive and store is the order and payment identifiers, the pass purchased, any partner coupon used, the amount and currency, and the status of the payment. We keep these to give you access to what you bought, to issue invoices and refunds, and to meet our tax and accounting obligations.

9. Your rights

Subject to applicable law, you have the right to:

• Access a summary of the personal data we hold about you and how it is processed;
• Correct inaccurate or incomplete personal data;
• Request erasure of your personal data, subject to Section 7;
• Withdraw consent to processing (Section 3);
• Nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, as recognised under the DPDP Act; and
• Lodge a grievance with us (Section 11) and, if unresolved, with the applicable data protection authority.

To exercise any of these rights, contact us using the details in Section 10.

10. Contact us

For questions, requests, or complaints about this Privacy Policy or our data practices, contact:

DailyApple LLP
Mumbai, Maharashtra, India
Email: privacy@millennial-ai.com

11. Grievance Officer

In accordance with the Information Technology Act, 2000 and the rules made thereunder, the Grievance Officer for Millennial CAT can be reached at privacy@millennial-ai.com. We will acknowledge grievances within 24 hours of receipt and endeavor to resolve them within 15 days.

12. Children's privacy

The Service is intended for users capable of entering into a binding contract under Indian law, generally 18 years of age or older. Consistent with the DPDP Act's definition of a "child" as anyone under 18, we never knowingly collect personal data from children without the verifiable consent of a parent or legal guardian, who must also accept our Terms of Service on the child's behalf. If you believe a child has provided us personal data without such consent, please contact us so we can remove it.

13. Changes to this policy

We may update this Privacy Policy from time to time, particularly as the Service and its underlying infrastructure evolve. We will post the revised policy here with an updated "Last updated" date, and where changes are material, we will provide additional notice (such as an in-product notice or email).