What IAAA Vantage knows about you, and why.

IAAA Vantage is a product of IAAA — the Institute of Applied AI and Analytics™. The legal entity that operates IAAA Vantage and acts as the data fiduciary for the purposes of applicable data protection law is Rahul Ghai, trading as Institute of Applied AI and Analytics (GST registration 29AHOPG8778Q2ZY, Udyam registration UDYAM-KR-03-0625793), a proprietorship registered in Bengaluru, Karnataka, India. The full registered address, telephone number, and grievance contacts are published on the Contact page, and by the Institute at iaaa.academy/contact.

Verified against the actual database schema, IAAA Vantage stores:

• your email address (used for sign-in and account identification);
• authentication metadata managed by Supabase Auth (account creation date, last sign-in time);
• your learning progress: per-concept mastery and skill levels, spaced-repetition scheduling, attempt history (which questions you answered, whether you were correct, your stated confidence), and mock exam results;
• account-level access settings (whether your access has an expiry date, and — for admin accounts only — an admin flag);
• a record that you accepted these Terms/Privacy Notice, and which version; and
• once paid access launches — a record of your purchase: the payment gateway's transaction and order identifiers, the amount, the currency, the date, and the status. No card details of any kind are stored here — not the number, not the CVV, not the expiry, and not even the last four digits. Bank credentials and UPI PINs likewise never reach this application. All of that stays with the payment gateway, which is the only party that ever sees it.

We do not collect your date of birth, employer, demographic information, or any government-issued identifier. We do not collect your name, phone number, or a billing address today; if a paid checkout requires any of these for invoicing or tax purposes, it will be collected at that point and only for that purpose. Nothing beyond the above is collected because nothing else is needed for IAAA Vantage to function — this list is not padded with data "we might use later."

• You provide it directly — your email address, when invited or signing in.
• Generated through your use of IAAA Vantage — your progress, attempt history, and mock exam results are all created automatically as you study; you don't enter them yourself.
• Automatically, at the infrastructure level — sign-in session cookies (see Cookies & local storage below). IAAA Vantage does not run any analytics or tracking script, so no behavioral/device data is collected this way beyond what Supabase's authentication infrastructure itself requires to keep you signed in.

• authenticating you and keeping your session secure;
• delivering the core learning functionality (showing you your own progress);
• maintaining your spaced-repetition schedule and mastery state between sessions;
• personalizing which concepts and questions you see next;
• generating the short AI coaching note on your Today page;
• evaluating free-text explain-back answers when AI grading is enabled;
• administering invite-only access and, if applicable, an access expiry date;
• using feedback and bug reports you send us to fix issues and improve IAAA Vantage; and
• meeting our own legal and record-keeping obligations.

Nothing is processed for advertising, profiling for marketing, or resale.

Two AI-assisted features exist, and this is exactly what each sends, verified against the code that calls them:

Explain-back grading. When AI grading is enabled, the concept name, the grading rubric, and the free-text answer you typed are sent to Anthropic's API to produce a score and short feedback. Your email address or any account identifier is not included in that request. The result IAAA Vantage keeps is the computed judgment — a score and feedback text — not a stored transcript of your original answer; IAAA Vantage's own attempt records do not carry your free-text wording. A server-side cache avoids re-grading identical answers twice; it stores the computed judgment, keyed by a one-way hash of the question and answer, not your original text in a retrievable form.

Coaching notes. A short summary of your own progress — your streak, strongest and weakest domains, concepts flagged as forgotten or misunderstood — is sent to Anthropic to write the 2–3 sentence coaching note shown on your Today page. This summary contains no free text you've written and no personal identifiers.

Anthropic processes this information under its own commercial API terms. IAAA has not independently verified, and does not represent, what Anthropic's retention or model-training policies are for this specific integration — if that matters to you, review Anthropic's own published terms, or avoid submitting sensitive content through the explain-back feature.

If no AI provider is configured, IAAA Vantage falls back to a deterministic, zero-cost local evaluator that sends nothing to any third party.

No payments are collected today. When paid access launches, payments will be processed by Razorpay, a licensed payment gateway, which supports Indian methods (cards, UPI, netbanking) and international cards.

Card and bank details never reach IAAA Vantage. They are entered into the gateway's own hosted interface and go directly to it. This application receives only the outcome — that a payment of a given amount succeeded, when, and which account it belongs to — plus the gateway's transaction identifiers, which are what a refund or a billing dispute is traced by. There is no code path in IAAA Vantage that could store a card number, because it is never sent one.

Razorpay is an independent data fiduciary/controller for the payment data you give it, and processes it under its own published terms and privacy policy, including for fraud screening and for the regulatory record-keeping a payment processor is required to do. If you pay with a card issued outside India, your details are additionally processed by your own card scheme and issuing bank in the ordinary course of a cross-border transaction.

Retention is longer for payment records than for anything else. Deleting your account removes your learning data, but a record of a completed transaction must be kept for as long as Indian tax, accounting, and statutory record-keeping law requires, which is measured in years rather than months. This is a legal obligation rather than a choice, and it is the one category of data that a deletion request cannot clear while that obligation runs.

• Supabase — hosts the authentication system and the Postgres database that stores your account and progress. This is the primary processor of your personal data.
• Resend — delivers the sign-in email itself (your email address and the one-time sign-in code). Resend does not receive your learning data.
• Anthropic — processes the AI-feature inputs described above, only when those features run.
• Vercel — hosts the application; standard web-request metadata (such as IP address) passes through it as part of ordinary hosting, as with any website.
• Razorpay — processes payments, once paid access launches. See Payment information above for exactly what it receives and what IAAA Vantage does not.

This list reflects the providers IAAA Vantage actually uses today, not a generic template.

Supabase, Resend, Anthropic, Vercel, and — once payments launch — Razorpay are international infrastructure providers, and your information may be processed on servers outside India as a result. We do not control or disclose the specific data-center locations these providers use at any given time; each operates under its own published data-processing terms.

The reverse is also true and worth stating plainly: IAAA Vantage is operated from India, so if you use it from elsewhere, your information is processed in India and by the providers listed above, wherever they run. Signing up is what puts it there. Restricting sales away from the EU, EEA, and UK (see above) is what keeps this straightforward: the transfer regimes that would require a specific executed mechanism, such as standard contractual clauses, are the ones we have chosen not to operate under. IAAA has not put such agreements in place with each provider and does not claim to have done so.

Where your data is stored. The database is hosted in Singapore, so your account and learning progress are stored outside India even though IAAA operates from India. Payment-record storage under review — India's payment-data localisation rules apply to payment system operators and to payment data specifically. IAAA never receives card or bank credentials, so the sensitive category never reaches this application at all; whether the transaction identifiers it will keep must nonetheless be held in India is being confirmed before paid access launches, rather than assumed either way.

We keep information for as long as reasonably necessary for the purpose it was collected for — operating your account, maintaining your learning progress, and meeting security or legal record-keeping needs. Mock exam attempt detail is capped at your most recent 8 attempts; older attempts are automatically reduced to a summary (score only, item-level detail dropped).

Payment records are the exception. Once paid access launches, records of completed transactions are kept for as long as tax, accounting, and statutory record-keeping law requires — longer than the account data itself, and independent of a deletion request. See Payment information above.

IAAA reserves the right to delete an account that has had no sign-in for 24 consecutive months, after emailing prior notice to the address on file. This is a policy commitment, not something the app currently automates or enforces on a schedule — no account has been deleted on this basis to date, and if it ever is, it will be a deliberate, manual action, not a background job.

Subject to applicable law, you can:

• ask what information we hold about you;
• ask us to correct inaccurate information;
• ask us to delete your account and data — see Account deletion below;
• withdraw consent where our processing relies on it (this mainly affects optional AI features — you can simply not use explain-back grading);
• raise a grievance — see Grievances below; and
• exercise any nomination or other rights available to you under India's Digital Personal Data Protection Act, 2023, once its relevant provisions and rules are in force, as applicable to your account.

We don't promise a right that doesn't actually apply to you or your jurisdiction.

IAAA Vantage is not offered to residents of the European Union, the European Economic Area, or the United Kingdom. We do not market the product into those regions, we do not sell paid access to a billing address in them, and we do not set out to collect, store, or process the personal data of people resident there. This is set out as a term of use in Terms of Use §3.

We are telling you the reason rather than leaving it unexplained: offering a paid service into those regions brings obligations — appointing a local representative, putting specific transfer arrangements in place, maintaining a formal record of processing — that this product cannot yet discharge properly. Restricting where it is sold is the honest response to that. Claiming compliance we have not reached would not be.

If you are nonetheless resident in one of those regions and hold an account, or believe we hold data about you, write to the grievance address below. We will act on an access, correction, or deletion request from you on the same footing as any other, and you can ask us to delete the account outright — which you can also do yourself from this page.

You can delete your own account below at any time. This removes your Supabase Auth identity and, because your progress and profile records are linked to it with cascading deletion, your learning progress and profile data are removed in the same action. This can't be undone and isn't recoverable — there's no separate backup retained for your convenience. The one thing deletion does not clear is a record of a completed payment, which law requires be kept; see Retention above.

Privacy questions or grievances can be sent to support@iaaa.academy.

Your progress data is protected by database-level row-level security: Supabase's Postgres itself refuses to return your data to any other account, independent of any bug in IAAA Vantage's own application code. Sign-in uses a one-time code emailed to your address and typed on the sign-in screen, rather than a password, removing an entire class of password-related risk. No system is completely secure, and we don't claim otherwise.

IAAA Vantage is intended for adults preparing for a professional certification, not for children. We do not knowingly collect information from children. Account creation is currently invite-only and administered manually, which limits — though does not technically enforce — this in practice.

IAAA Vantage uses one category of cookie: the session cookie set by Supabase Auth, strictly necessary to keep you signed in. There is no analytics, advertising, or tracking cookie anywhere in the app — verified directly in the codebase, not assumed. Because only strictly necessary storage is used, no cookie-consent banner is shown; one would be implemented before any non-essential tracking is ever added.

Separately, your browser's local storage is used to save your in-progress mock exam answers on your own device, purely so a refresh doesn't lose your work. This never leaves your browser as part of that mechanism.

We may update this notice as IAAA Vantage changes. The "Last updated" date at the top reflects the current version; material changes will be communicated through the app where appropriate.