School Inquiry Privacy Notice

1. Who this notice covers

This notice covers a school representative who submits the inquiry form on PrepPilot's schools page. It does not create a school, provider, staff, learner, family, licence, purchase, or marketing subscription.

Data Fiduciary: GSPHERE TECH PRIVATE LIMITED, JJ 287, Assetz Marq Phase-2, Kannamangala Village, Whitefield-Hoskote Road, Kannamangala, Bangalore South, Bengaluru, Karnataka, 560067, India. Privacy questions and requests go to privacy@preppilot.study.

2. Personal data collected

Do not submit child names, answers, credentials, reports, health information, payment credentials, or other sensitive learner data. The form does not accept attachments and does not store the raw idempotency key, IP address, cookie, authentication token, or advertising identifier with the inquiry.

3. Why PrepPilot uses it

• Receive, validate, secure, and de-duplicate the inquiry.
• Respond to the submitted pilot question or request.
• Show it to an authorized internal provider operator in the Admin Command Center.
• Send one internal alert containing only the safe reference, receipt time, and authenticated Admin link.

The required checkbox is consent for these inquiry-response purposes only. PrepPilot does not use it as consent for newsletters, advertising, sales sequences, unrelated profiling, or automatic visitor email. Withdrawing consent does not undo a response already completed, but it stops further consent-based use that is not needed to close or secure the request.

4. Who can receive it

The submitted fields are available only to authorized PrepPilot operators with the provider-management capability. Google Firebase and Google Cloud host the form, trusted service, and access-controlled Firestore records. Zoho ZeptoMail transports the minimal internal reference alert; contact and inquiry fields are not placed in that email. PrepPilot does not sell these details.

5. Retention and deletion

The inquiry, its duplicate-prevention command, and its internal alert status are retained for 30 days from the server receipt time. A bounded automated deletion runs daily and deletes the three linked records together when the 30-day boundary is reached.

Firestore's access-controlled point-in-time recovery may retain a deleted version for up to seven additional days before it expires. Recovery versions are not available in the product or to ordinary operators and are used only for restricted disaster recovery.

6. Access, correction, withdrawal, erasure, and complaints

Email privacy@preppilot.study to ask what inquiry data PrepPilot holds, correct it, withdraw the inquiry consent, request erasure where no lawful exception applies, or check a prior request. Include the safe inquiry reference if you have it. PrepPilot may use proportionate verification before disclosing or changing personal data.

Escalate an unresolved privacy complaint with the same reference to Umasri Prathapaneni at grievance@preppilot.study.

7. Version changes

A new purpose, data category, recipient category, or retention rule requires review and a new school-inquiry notice version before it is activated.