1. Who we are
Practicks (operated by Agattiya, India) provides a self-assessment and practice platform. We act as the "data fiduciary" (controller) for personal data of self-service users, and as a "data processor" for institutional users acting on behalf of the subscribing training institution. Practicks serves professional and technical skills training; it is not a school or college platform.
2. Information we collect
2.1 Account information
- Name and email address.
- A password, stored only as a one-way hash — never the password itself.
- Country, which we ask at signup so prices can be shown in your own currency.
- Role (candidate / faculty / administrator), the training institution you belong to, and the skills or cohorts your access covers.
- Locale, timezone, accessibility preferences.
That is the whole of the identity data we ask for. Practicks does not collect a phone number, a date of birth, a postal address, a government identity number, or any document proving who you are. There is no profile-picture upload. The only image Practicks ever holds of you is a proctoring capture, and only on an attempt you consented to (section 2.3).
If your institution buys through the in-app purchase flow, the billing details you enter for the invoice — billing name, address, and a contact email or phone — are held for that purpose. Card details are never sent to or stored by Practicks; they go directly to the payment provider.
2.2 Practice and assessment data
- Attempts, answers, time spent per question, scores, confidence signals.
- Wrong-answer notebook entries, spaced-repetition state.
2.3 Proctoring data (only on opted-in attempts)
- Periodic webcam photos (every 30 seconds) and browser telemetry (tab switches, full-screen state).
- Optional continuous-inference face signals computed in-browser, batched as anonymous observations.
- Consent is recorded explicitly before any capture begins. Candidates see exactly what is captured.
2.4 Messages from your institution
Where your institution uses Practicks to send announcements to its learners, we record:
- The message itself, who sent it, and who it was sent to.
- Whether you have opened it, and when.The person who sent it can see that, the way a read receipt works — so they know who still needs telling.
- The reaction you choose, if you choose one. Reactions are a fixed set of acknowledgements; there is no free-text reply, so nothing you write is stored or shown to anyone.
- Your answer, where a message asks a question.You pick one of the options whoever sent it wrote — again, there is nothing for you to type. Whether they can see that the answer was yours depends on how they set the question up, and the message tells you which it is before you answer: a question marked Anonymous means they see the totals and never who chose what, and one without that label means your answer is visible to them beside your name. That choice is fixed when the question is sent and cannot be changed afterwards. Either way, other learners never see who answered what.
This applies only to learners at an organisation. Self-enrolled learners have no institution sending them messages, so none of it exists for them.
2.5 Technical data
- IP address, device type, browser type, app version.
- Audit logs of security-relevant events (sign-in, password change, role change, etc.).
- Aggregated, anonymised usage analytics.
3. Why we collect it (purposes)
- Operating the service: authentication, attempt grading, reporting, scheduling, notifications.
- Integrity: surfacing suspected plagiarism, supporting proctoring decisions on opted-in attempts.
- Personalised feedback: mistake notebooks, spaced review, adaptive next-best-question — all derived from your own attempts.
- Service health: error reporting, performance monitoring, security investigations.
- Communication: account-related emails (sign-in, password reset, account changes) and opt-in notifications (assessment reminders, results, etc.).
- Legal and compliance: responding to lawful requests, defending claims, enforcing these policies.
4. Where data is stored
Personal data is stored on Amazon Web Services (AWS) in the ap-southeast-2 (Sydney, Australia) region. Backups remain within the same region.
This means personal data is processed outside India. If you are in India, that is a cross-border transfer, which the DPDP Act permits except to countries the Government of India restricts by notification. Your rights under this policy — access, correction, deletion, grievance redressal — are unchanged by where the data sits, and our grievance officer remains the contact for exercising them.
The protections described in how we protect your data apply in full to data held in this region. If we change region, or a new third-party processor introduces processing in a further country, this policy will be updated and affected users notified.
5. Who can see your data
- You, through the in-app surfaces (your performance, your notebook, your account settings).
- Your institution's authorised staff— your faculty and organisation admins — for the purpose of operating your training programme. Each role's view is scoped by design (faculty see the cohorts they run; org admins see their organisation).
- Whoever sent you a messagecan see whether you opened it, when, and which reaction you chose — and, on a question that is not marked Anonymous, what you answered. Other learners cannot: the list of who has read something, and who answered what, is shown only to the sender and to your organisation's administrators.
- Faculty grading a specific assessment — a trainer can be added to an assessment in order to review and re-score its submitted answers. That access covers only the attempts on that assessment, and it is separate from the cohort scope above.
- Practicks personnel with a need-to-know for service operation, support, or security. Internal access is audited.
We do not sell personal data. We do not share personal data with advertisers or data brokers.
6. Third-party services
Practicks integrates a small set of third-party services to operate the platform:
- Amazon Web Services (AWS) — hosting, storage, email (SES), push (SNS Mobile / FCM / APNs), code execution sandbox.
- Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs) — for mobile push notifications you have opted into.
- face-api.js (runs in-browser) — for in-browser continuous-inference face signals on opted-in proctored attempts. Models are downloaded to your browser; the inference does not leave your device for the telemetry stream.
We do not currently integrate advertising trackers or third-party analytics SDKs that profile users across sites.
7. Cookies and local storage
We use cookies and local storage strictly to operate the service — keeping you signed in, remembering your locale / theme preferences, preserving in-progress attempts so a page reload doesn't lose your work. We do not use cookies for advertising.
8. Children's data
Practicks is a professional and technical skills platform intended for adult learners and for the training institutions that enrol them. It is not directed at children, there is no school or college edition, and we do not knowingly collect personal data from a child. We ask for no date of birth, so we hold nothing that records anyone's age.
If you believe a child has created an account, contact us using the details on the Contact page and we will delete it. We do not target advertising at anyone and we do not profile users for any purpose beyond operating the service.
9. Your rights
Under the DPDP Act and similar applicable laws, you have the right to:
- Access the personal data we hold about you and request a copy.
- Correct inaccurate or incomplete personal data.
- Delete your account and your personal data. You can do this yourself, at any time, from Settings → Delete my account— no request and no reason needed. The screen offers you a download of everything we hold about you first, and shows you exactly what is about to go. Records that are also about other people stay with your name removed from them; see our Data Retention Policy for what that covers and what legitimate retention still applies.
- Withdraw consent for optional processing (e.g. notifications).
- Lodge a grievance with our grievance officer (see Section 12).
- Nominate another individual to exercise your rights in the event of incapacity or death.
Deletion is the one right you do not have to ask for — it is a control in the product. To exercise any of the others, contact us using the details on the Contact page. Institutional users should also notify their institution's administrator since that administrator may hold your record on the institution's behalf.
10. Security
We use industry-standard technical and organisational measures to protect personal data: transport encryption (TLS), at-rest encryption on cloud storage, role-based access control, audit logging, periodic security review. No system is perfectly secure; if you believe your account has been compromised, contact us immediately.
Institutions can additionally ask for individual personal details — name, email address and proctoring photos — to be separately encrypted, so that even a copy of the database does not contain readable versions of them. Seeing those details in full is limited to you, about yourself, and to a Practicks platform administrator with a recorded reason. How we protect your data explains what is covered and who can see what.
11. Data breach notification
In the event of a personal data breach likely to result in significant harm, we will notify the relevant Data Protection Board and affected users in accordance with the DPDP Act timelines.
12. Grievance officer and contact
As required under the IT Act 2000 and the DPDP Act 2023, the grievance officer's contact details are listed on the Contact page. We will acknowledge grievances within the statutory timeline and resolve them within thirty (30) days where possible.
13. Changes to this policy
We may update this policy as the platform evolves. Material changes are reflected in the "Last updated" date at the top and signalled to active users.