Privacy policy

We collect the minimum needed to run an exam preparation platform: your phone number so you can sign in, your exam attempts so we can score and analyse them, and basic device information so the app works on your handset.

We do not sell personal data. We do not share your results with employers, recruitment agents or manpower companies. We do not share your results with an institute unless you joined that institute's batch yourself.

You can export everything we hold about you, or delete your account entirely, at any time. Both are handled within thirty days and usually within a few days.

iSmartExams is operated by Lacspace Corporation Pvt. Ltd., registered in Nepal with its principal office at Bhimsengola, Kathmandu, Nepal. For anything in this policy, write to hello@lacspace.com.

We are the data controller for the information described here. Where we use service providers who process data on our behalf, they are listed in the sharing section below.

We collect three categories of information, and nothing outside them.

Information you give us.

• Your phone number, which is your account identifier and how you sign in.
• Your name and username, so the community and leaderboards can display you.
• Optionally an email address, a profile photo and a short bio.
• Anything you write in the community — questions, answers, comments and reports.
• Messages you send to support.

Information created by using the platform.

• Your exam attempts: which questions you answered, what you selected, and how long you took.
• Your scores, topic strength, streaks and bookmarks.
• Which lessons, vocabulary and audio you have opened or downloaded.
• Payment records — the amount, the date and a transaction reference from your wallet or bank.

Technical information.

• Device model, operating system version and app version, so we can reproduce bugs.
• A push notification token per device, if you enable notifications.
• IP address and request logs, retained briefly for security and abuse prevention.

We do not collect your contacts, your location, your photo library, your call history or your SMS messages. The app asks for camera and photo permissions only if you choose to set a profile picture, and for microphone only if you use a spoken-answer question type.

• To run your account. Sign you in, keep your progress, and restore it when you change handset.
• To score and analyse. Marking happens on our servers, and your attempt history is what produces topic strength, trends and rank.
• To improve the question bank. Aggregate answer patterns tell us which items are badly worded. This uses aggregated data, not your individual identity.
• To send what you asked for. Streak reminders, results and publication notices — each of which you can switch off individually.
• To take payment. Activating a subscription and issuing a receipt.
• To keep the platform safe. Detecting abuse, fraud and attempts to game scoring or leaderboards.

We do not build advertising profiles, we do not run third-party advertising trackers, and we do not use your data to train models that are shared outside our own products.

We share personal data only with service providers who need it to make the platform work, and only for that purpose:

• Our SMS provider, to deliver your sign-in code — they receive your phone number and nothing else.
• Amazon Web Services, which hosts our servers and stores uploaded media.
• Expo, which delivers push notifications to your device.
• eSewa, Khalti and our banking partners, when you make a payment.

Institutes. If you join an institute's batch, that institute sees your results within their portal. That is the point of joining a batch, and it happens only when you join one yourself. We never hand your results to an institute you are not enrolled with.

What we never do. We do not sell personal data. We do not share individual results with employers, recruitment agents, manpower companies or embassies. We do not accept payment for access to our users.

We disclose data to authorities only where we are legally required to, and where we can lawfully tell you that it happened, we will.

• Account and attempt history — for as long as your account exists. Your history is the product; deleting it silently after a year would break the thing you came for.
• Payment records — seven years, because Nepali tax law requires it.
• Support conversations — two years.
• Request and security logs — ninety days.
• Deleted accounts — removed from live systems within thirty days and from backups within a further ninety, at which point recovery is impossible.

You can, at any time and without giving a reason:

• Ask for a copy of everything we hold about you, in a machine-readable format.
• Correct anything inaccurate, most of which you can edit yourself in the app.
• Delete your account and your personal data permanently.
• Withdraw consent for notifications, individually or entirely.
• Object to a particular use of your data and have a person consider it.

Use Settings → Account in the app, or write to hello@lacspace.com. We respond within thirty days and usually within a few working days. We do not charge for any of this and we do not put a retention conversation in the way of a deletion request.

• Everything is transmitted over TLS. There are no unencrypted endpoints.
• Passwords, where an account has one, are hashed with bcrypt and never stored in readable form.
• Access to production data is limited to the small number of staff who need it and is logged.
• Answer keys are held server-side and never sent to a device before an attempt is submitted.
• We run rate limiting and abuse detection on authentication endpoints.

No system is perfectly secure. If a breach affects you, we will tell you what happened, what data was involved and what we are doing about it — without waiting to see whether anyone noticed.

iSmartExams is intended for candidates aged 16 and over. We do not knowingly collect personal data from children under 16 through this platform.

Where a school or institute enrols students under 16 through an institute portal, the institute is responsible for obtaining parental consent, and the institute — not the student — is our point of contact for that data.

If you believe a child under 16 has created an account directly, write to hello@lacspace.com and we will remove it.

Our servers are hosted in the Asia Pacific (Mumbai) region. Your data therefore leaves Nepal and is stored in India, under contractual protections with our hosting provider.

We chose that region for latency — it is the closest that gives Nepali users a responsive app. If a suitable Nepal-based option becomes available, we intend to move.

When we change this policy materially — what we collect, why, or who we share it with — we will tell you in the app before the change takes effect, not afterwards and not through a silently updated date at the top of a page.

Minor clarifications and wording improvements are made without notice, and the last updated date always reflects them.

For anything in this policy, write to hello@lacspace.com. A person reads it.

Lacspace Corporation Pvt. Ltd.
Bhimsengola, Kathmandu, Nepal
+977 9705 300600

If you are not satisfied with our response, you may complain to the relevant data protection authority in your jurisdiction.