Privacy Policy

Last updated: October 25, 2026

ComplianceQuest ("the app", "we", "us") is a mobile learning app whose primary purpose is to help people learn India's Digital Personal Data Protection (DPDP) Act, 2023 and Rules, 2025. You can learn by reading PDFs and other learning materials, watching DPDP-related videos, studying structured lessons and chapters, taking quizzes, playing educational games, and using the AI chat assistant. This policy explains what the app collects, how it is used, who it is shared with, and the choices available. It applies to the ComplianceQuest mobile app and this page's own domain.

Information we collect

Account information

• Email address and password — used to create and sign in to your account. Your password is stored as a salted hash and is not stored in readable form.
• Selected role/persona — the role you choose during signup, such as CEO, CFO, CISO, CMO, CLO, DPO, CIO or CTO, is used to tailor the learning content shown in the app. Other roles may be available where supported by the app.
• Account ID — a unique identifier for your account, used to save your progress and to enforce fair-use limits (including on AI chat requests).

Learning activity

• Lesson, quiz, flashcard and game progress, scores and completion.
• Notes you write inside the app. These are stored on your device.
• Questions you type or speak to the AI chat assistant, and its replies. These are processed on your device, or, only if you consent to online AI, sent as described in "AI — chat only" below. We do not store the text of your chat questions or replies in our database.
• If you submit thumbs-down feedback on a predefined answer, the optional reason you provide and your account ID are stored in an admin review queue so the answer can be reviewed.

Lessons, quizzes, flashcards and chapters are role-based learning content provided through our backend and retrieved from our database. They are not created from the text you type into chat. Most of the activity above is generated and stored directly on your device (using the device's own local storage) so the app works offline. Where the app is connected to a learning workspace, your progress also syncs to that workspace so it is not lost if you change devices, and so your organisation's administrators can see aggregate or individual progress within their own workspace.

AI — chat only

The only feature where text you type is sent to an AI provider is chat. When you ask a question, the app first checks our predefined Q&A database; if your question matches, the app returns that predefined answer from our backend without generating a new AI response and without sending your question to a third-party AI provider. Only when there is no match does an AI model help formulate a reply, using relevant passages from the DPDP Act, Rules and our learning materials rather than the model's general knowledge. Voice input is transcribed by your device's operating-system speech-recognition service, which may use Apple's servers depending on your device settings.

Why we use free third-party AI APIs: ComplianceQuest is provided to you free of charge. To keep it free while still offering this AI fallback, we use the free API quotas Google Gemini and Groq make available, rather than a paid tier.

AI chat storage and usage: We do not store the text of your AI chat questions or replies in our database. We record only usage totals, such as request and token counts, per account to enforce fair-use limits. An account ID is included with chat requests for usage-limit enforcement. This usage information does not include the text of your question or the AI reply.

A chat reply can come from two different places:

• On-device: processed entirely on your phone, never sent to us or any third party — see "On-Device AI Processing" below.
• Online (Google Gemini or Groq): only after you explicitly consent, your question is sent to our backend. The backend retrieves relevant passages from our DPDP Act and Rules learning materials and sends the question and those passages to the selected AI provider. These passages are learning material, not your personal data. We do not send your conversation history, email, or password. The app has no feature to upload or attach your own documents or files. We do not use your questions for advertising or sell your data.

Third-party AI privacy protection: Online AI is used only after you explicitly consent. Your question is sent to our backend, which retrieves relevant passages from our DPDP Act and Rules learning materials and forwards the question and passages to the selected provider (Google Gemini or Groq). Each provider handles requests under its own applicable terms and settings, summarised below. Please do not submit passwords, confidential business information, or sensitive personal information through online AI chat.

• Google Gemini — unpaid API service (Gemini API Additional Terms of Service): For unpaid Gemini API usage, Google may use submitted prompts and generated responses to provide, improve, and develop Google products, services, and machine-learning technologies. Human reviewers may review inputs and outputs; Google says it disconnects them from the Google Account, API key, and Cloud project before review. Google does not specify one universal retention period for all unpaid Gemini API prompts and responses, so we do not promise deletion within a fixed number of days. Withdrawing consent or deleting your ComplianceQuest account does not delete data already processed by Google.
• Groq — free API service (Groq Privacy Policy, Services Agreement, and Your Data in GroqCloud): When you use online AI chat, your question and the retrieved passages may be sent to Groq for processing. Groq states that inference request inputs and outputs are not retained by default, but may be temporarily logged when needed to investigate suspected abuse or troubleshoot service reliability issues. Groq also states that it does not use customer data to train models for its own purposes. Data handling and logging may depend on the applicable service and account settings.

We share data with these providers only to generate chat replies, and we rely on their published terms for the protection they apply to it.

Your Choice About Online AI

Online AI is off by default. Before your first question is sent to an online AI provider, ComplianceQuest displays an "Online AI Data Sharing Consent" dialog that explains what is sent, who it is sent to, and how those providers may use it. No online AI request is sent until you provide consent.

You can review this disclosure or withdraw your consent at any time by going to Settings → On-device AI.

• If you decline consent: Your chat continues using the on-device AI model only. No questions are sent to online AI providers.
• If you withdraw consent: The app blocks all further online AI requests until you provide consent again. Your chat remains available through the on-device AI model.

Withdrawal of Consent and Third-Party Data

Withdrawing consent stops future online AI requests from ComplianceQuest, but it does not automatically delete data that a third-party AI provider has already processed. Similarly, deleting your ComplianceQuest account does not, by itself, delete data held by third-party AI providers.

On-Device AI Processing

ComplianceQuest uses locally running Qwen models through the open-source LiteRT-LM runtime.

Supported variants include Qwen3 0.6B Instruct, Qwen2.5 1.5B Instruct, and Qwen3 1.7B Instruct, selected according to device memory.

The on-device model is downloaded from Hugging Face (huggingface.co), which can see your IP address during the download.

After download, your questions and the model's responses are processed on your device and are not sent to Qwen, Hugging Face, or any external AI provider.

Local AI responses may be inaccurate or incomplete. Verify important information against official DPDP Act and Rules sources.

Qwen License

• Published licensing metadata identifies the Qwen2.5 1.5B, Qwen3 0.6B and Qwen3 1.7B variants as Apache License 2.0.
• Applicable model copyright and attribution notices are retained.
• The LiteRT-LM runtime and flutter_gemma plugin have separate open-source licenses.

Videos

YouTube videos: Some videos are embedded through a WebView using youtube-nocookie.com where possible, with a fallback to youtube.com. When you open a YouTube video, the YouTube player loads and may share your IP address and device or browser information with Google/YouTube, under their own privacy policy.

Azure-hosted videos: Other videos are streamed from Microsoft Azure Blob Storage through a time-limited signed link. Requests may expose your IP address and standard request information to our backend and Azure.

What we do not do

• We do not include third-party advertising or ad-tracking software in the app.
• We do not include third-party analytics or crash-tracking software in the app.
• We do not sell personal data to third parties.

How information is used

• To create and secure your account, and keep you signed in.
• To save your learning progress and let you resume it, and to tailor content to the role you chose.
• To answer your questions, the app first checks our predefined Q&A database. If a matching answer is available, it returns that answer from our backend without sending your question to a third-party AI provider. If no predefined answer matches, the app can answer using on-device AI or, only if you consent to online AI, send the question you submit to our backend. Our backend forwards that question together with relevant passages from the DPDP Act, Rules and learning materials to the selected AI provider through its API to generate a reply. We do not send your conversation history, email address or password as part of this AI request.
• To review predefined answers that users mark as unhelpful.
• To operate, secure and improve the service, and to enforce fair-use limits.
• Where the app is provided to you through an employer or training organisation, to let that organisation's administrators see aggregate or individual progress within their own workspace.

Where information is stored

Account and learning data are stored on Microsoft Azure infrastructure. Media such as lesson images and videos are served from Azure Blob Storage. Data stored only on your device (see above) stays there until you sign out, uninstall the app, or it is synced to your workspace as described above.

Your rights

• Access and correction: you can review your profile within the app.
• Deletion: you can permanently delete your account and its data at any time from within the app (Profile → Delete Account), or from the account deletion page, with no need to sign in first.
• Questions or requests: contact us at support@aashrayinfotech.com.

These rights reflect the DPDP Act, 2023 itself, the very law the app teaches: as a Data Principal, you may seek access to, correction of, and erasure of your personal data, and may withdraw consent at any time.

Children's privacy

ComplianceQuest is a professional compliance-training tool aimed at working adults (for example, business owners, executives and compliance staff), is not directed at children, and is not intended for use by anyone under 18. This also reflects the minimum-age eligibility requirements of the third-party AI providers described above. We do not knowingly collect personal data from children.

Security

Passwords are hashed, not stored in plain text. Traffic between the app and our servers is encrypted in transit. Access to stored data is restricted to what each part of the service needs to function.

Changes to this policy

We may update this policy as the app changes. The "Last updated" date above will change accordingly. If a change affects what is sent to third-party AI providers, the app will ask for your consent again before sending anything.

Contact us

Aashray Infotech
support@aashrayinfotech.com