CivicaPrivacy Policy
Effective date: September 29, 2026 · Version: 1.2
This policy explains what personal data Civica (citizenleap.com) collects, why, and your choices. Civica is operated from India and handles personal data in line with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. It describes what the Service actually does today.
1. What we collect
Account data
- Your name and email address.
- A password hash if you sign up with a password. We never store your password itself.
- If you sign in with Google: your Google name, email address, and Google's account identifier. We do not receive your Google password.
Study data
- Your learning progress, quiz results, and review schedule, saved to your account so it can sync across devices.
Subscription and billing data
- Our payment provider and Merchant of Record, Paddle, collects and processes your payment details, billing name and address, and tax information at checkout. Card details are entered in Paddle's checkout and never reach our servers.
- To set up checkout we send Paddle your name and email address and a reference to your Civica account.
- We keep your plan, whether it auto-renews, your access end date, and Paddle's reference IDs (customer, transaction, subscription), together with the payment event records Paddle sends us, which can include limited billing details such as the payment method type and card last four digits.
Technical data
- A session cookie that keeps you signed in. It is strictly necessary and we do not use advertising or analytics cookies.
- Your IP address is used briefly, in memory, for rate limiting and abuse prevention. Our hosting and web-server logs may also record IP addresses and request details.
- When you open the payment window, Paddle's checkout scripts are loaded from Paddle's servers. Paddle may set cookies and process device and network data needed to take payment and prevent fraud, under its own privacy notice. We load these scripts only when you start checkout. We do not use advertising or analytics cookies ourselves.
- The site remembers your light/dark theme and some settings in your browser's local storage. This stays on your device.
Speak-aloud practice runs in your browser. We do not record or upload your voice.
2. Why we use it
- To create and secure your account and keep you signed in.
- To save your progress and give you personalised review.
- To provide and bill for Premium, and to prevent fraud and abuse.
- To contact you about your account, such as security or billing matters.
- To meet legal, tax, and accounting obligations, and to establish or defend legal claims.
We process your data with your consent, given when you create an account and accept these terms, and for the limited other uses the law permits, such as meeting legal obligations. You can withdraw consent at any time by deleting your account; this does not affect earlier processing.
3. Who we share it with
We do not sell your personal data and we do not show ads. We share data only with providers that help us run the Service:
- Paddle, our Merchant of Record, to process payments, collect and remit tax, issue receipts, and handle refunds. Paddle acts as an independent controller of the data it collects at checkout; see Paddle's Privacy Policy.
- Google, only if you choose Sign in with Google.
- Our hosting provider, which runs the servers that store your data.
- An AI model provider (via OpenRouter), only if you use the AI tutor. The text you type into the tutor, and the practice question you are viewing, are sent to it to produce a reply. We ask providers not to retain or train on this data, and we do not send your name or email. Tutor messages are limited to citizenship-test study; AI replies can be wrong, so check the official source. We store only usage counts and shared, question-level explanations, not your chat transcript.
We may also disclose data if required by law or to protect rights and safety, and it may transfer with the Service if the business is sold or reorganised.
4. Where your data is processed
Our servers and providers may be located in India or in other countries. By using the Service you understand that your data may be transferred to and processed in those places. We only use providers that we believe protect data appropriately. Paddle and its payment partners process payment data in the UK, the EU, the US, and other countries.
5. How long we keep it
- Account and study data: until you delete your account.
- Sessions: until they expire or you sign out.
- Billing and payment records: as long as needed for tax, accounting, and legal purposes.
- Backups and logs: for a limited period, then removed in the normal course.
6. Security
Passwords are hashed with scrypt. Traffic to the Service is encrypted with HTTPS, session cookies are HttpOnly and Secure, and access to the database is limited to the server. No system is perfectly secure, and we cannot guarantee absolute security. Please use a strong, unique password.
7. Your rights
You can ask to access a summary of your personal data, correct it, have it erased, withdraw your consent, and nominate someone to exercise these rights on your behalf if you cannot. To use any of these rights, including account deletion, email admin@citizenleap.com from the address on your account. We will respond within the time required by law.
Grievances: if you have a complaint about how your data is handled, write to admin@citizenleap.com with the subject "Privacy grievance". If you are not satisfied with our response, you may complain to the Data Protection Board of India, or to the data protection authority in your country.
8. Children
The Service is for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.
9. Links to other sites
We link to official government and other third-party sites. We are not responsible for their content or privacy practices.
10. Changes
We may update this policy. For material changes we will give notice in the app or by email. The effective date above shows when it last changed.
11. Contact
Privacy questions or requests: admin@citizenleap.com