Privacy Policy

1. Definitions

For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

“Personal Information” means any information that can be used to identify you as an individual, including your name, phone number, and usage data.

“Platform” refers to the Poripurok mobile application and the website poripurok.com, collectively.

“Service” means the AI-powered educational doubt-solving and study assistance features available through the Platform.

“Doubt Solver” refers to the AI-powered question-answering feature available within the Platform.

“User” means any person who registers for, accesses, or otherwise uses the Platform.

2. Information We Collect

We collect personal information in the following circumstances.

2.1 Information You Provide Directly

When you register for an account, we collect your full name, mobile phone number, educational institution, class level (HSC, SSC, or University Admission), gender (optional), profile photograph (optional), and password. When you use the Doubt Solver feature, we collect the questions, text, and images you submit, together with any feedback or reactions you provide in response to AI-generated answers.

নিবন্ধনের সময় আমরা আপনার নাম, মোবাইল নম্বর, শিক্ষা প্রতিষ্ঠান, শ্রেণি স্তর এবং পাসওয়ার্ড সংগ্রহ করি। ডাউট সলভার ব্যবহারের সময় আপনার প্রশ্ন ও মতামত সংগ্রহ করা হয়।

2.2 Device Permissions (Mobile App)

The Poripurok mobile application requests the following Android permissions. Each is requested at runtime, with your explicit consent, and is used only for the feature described:

1. Camera— used only when you choose “Take Photo” to capture a doubt question. The captured image is uploaded to our secure storage and sent to the AI Doubt Solver for analysis. We do not access the camera at any other time, do not record video, and do not capture images in the background.
2. Photos / Media Library(READ_MEDIA_IMAGES on Android 13 and above; READ_EXTERNAL_STORAGE on older Android) — used only when you choose “Choose from Gallery” to attach an existing photo to your doubt question. We use the Android system photo picker wherever supported, which means we receive only the specific image you select — not access to your full photo library.
3. Microphone (RECORD_AUDIO) — used only inside the feedback dialog, when you choose to record a short voice note describing an issue. We do not record audio at any other time, do not transcribe the recording locally, and do not activate the microphone in the background. The recording is uploaded to our secure storage so our team can review your feedback.
4. Internet — used to communicate with our servers for authentication, question processing, and content delivery.

You may decline any of these permissions when prompted. Declining a permission disables only the specific feature that requires it (for example, declining Camera disables “Take Photo,” but the rest of the app continues to work). You may also revoke any granted permission at any time through your device’s Android Settings.

মোবাইল অ্যাপ্লিকেশনে আমরা কেবল প্রয়োজনীয় Android অনুমতিগুলো চাই — ক্যামেরা (ডাউটের ছবি তুলতে), ছবি/মিডিয়া (গ্যালারি থেকে ছবি যুক্ত করতে), ও মাইক্রোফোন (ফিডব্যাকে কণ্ঠ রেকর্ড করতে)। প্রতিটি অনুমতি ব্যবহারের আগে রানটাইমে আপনার সম্মতি চাওয়া হয় এবং পটভূমিতে কখনোই ব্যবহার করা হয় না।

2.3 Transaction Information

When you purchase a subscription, we collect payment confirmation details including invoice reference numbers and transaction identifiers. We do not store payment credentials, mobile financial service PINs, or any banking details.

2.4 Technical Information

We automatically collect certain technical information, including device type and operating system version, for the purpose of maintaining service compatibility and resolving technical issues.

We do not collect your bank account numbers, credit or debit card details, or National Identification (NID) numbers. We do not track your location. We do not access your device contacts. The Camera, Photo Library and Microphone permissions are requested only as described in Section 2.2 — each is triggered by an explicit action on your part (tapping Take Photo, Choose from Gallery, or Record Voice Feedback) and is never used in the background.

2.5 Crash & Diagnostic Data (Sentry)

We use Sentry (Functional Software, Inc.) to collect crash reports and diagnostic data that help us identify and fix errors in the app. This includes your device model and operating system version, the app version, error messages and stack traces, navigation and network breadcrumbs (a short trail of recent in-app events), and a user identifier consisting of your numeric account ID and the last four digits of your phone number. We have disabled the collection of your IP address, and we do not send your full phone number, your name, your message or question content, or any uploaded images to Sentry. Sentry is governed by its own privacy policy, available at https://sentry.io/privacy/.

অ্যাপের ত্রুটি শনাক্ত ও সমাধানের জন্য আমরা Sentry (Functional Software, Inc.) ব্যবহার করে ক্র্যাশ রিপোর্ট ও ডায়াগনস্টিক তথ্য সংগ্রহ করি — যেমন ডিভাইস মডেল, অপারেটিং সিস্টেম ও অ্যাপের সংস্করণ, ত্রুটির বার্তা, এবং একটি ব্যবহারকারী শনাক্তকারী (আপনার সংখ্যাসূচক আইডি ও ফোন নম্বরের শেষ ৪ সংখ্যা)। আপনার সম্পূর্ণ ফোন নম্বর, নাম, প্রশ্নের বিষয়বস্তু বা আপলোড করা ছবি Sentry-তে পাঠানো হয় না।

3. How We Use Your Information

We use the information we collect for the following purposes:

1. to create and manage your account, verify your identity, and maintain the security of your session;
2. to provide AI-powered responses to your academic questions through the Doubt Solver;
3. to send one-time passwords (OTP) and transactional notifications via SMS;
4. to manage your subscription, track usage quota, and process subscription renewals;
5. to store your conversation history and bookmarked content for your personal reference;
6. to improve and develop the Platform through analysis of aggregated, anonymised usage data;
7. to communicate with you regarding service updates, changes to this policy, and support requests; and
8. to comply with applicable legal and regulatory obligations.

We do not sell your personal information to any third party. We do not use your personal information for interest-based advertising.

আমরা আপনার ব্যক্তিগত তথ্য কোনো তৃতীয় পক্ষের কাছে বিক্রি করি না এবং বিজ্ঞাপন প্রোফাইলিংয়ের জন্য ব্যবহার করি না।

4. AI-Powered Features — Doubt Solver

The Doubt Solver feature processes your questions using third-party generative AI service providers. When you submit a question, the content of your query — including any image you attach and the prior turns of the same conversation — is transmitted to an AI provider to generate an educational response. We send only the content needed to answer your question; we do not share your name, phone number, payment information, or device identifiers with the AI provider.

Your conversation history is stored on our servers so that you may review and bookmark it at any time. You may delete any conversation directly within the application. We collect and store chat histories, subject selections, query patterns, ratings, and feedback provided for AI responses for the purpose of improving service quality. We do not use your question content to train AI models without your explicit consent.

You are advised not to include sensitive personal information — such as your National Identification number, financial account details, or passwords — within your Doubt Solver queries.

ডাউট সলভার আপনার প্রশ্ন বিশ্লেষণের জন্য তৃতীয় পক্ষের AI পরিষেবা ব্যবহার করে। আমরা শুধু আপনার প্রশ্ন ও সংযুক্ত ছবি পাঠাই — নাম, ফোন নম্বর বা পেমেন্ট তথ্য পাঠানো হয় না। ডাউট সলভারে জাতীয় পরিচয়পত্র, আর্থিক বিবরণ বা পাসওয়ার্ড প্রদান করবেন না। আপনি যেকোনো সময় অ্যাপের মধ্যে থেকে কথোপকথন মুছে দিতে পারবেন।

5. Payment Information

All subscription purchases are processed through bKash Tokenized Checkout on our secure website. We collect payment confirmation details including invoice reference numbers and bKash transaction identifiers (trxID). We do not store your bKash PIN, password, or any mobile financial service credentials.

bKash, as our payment processor, is governed by its own privacy policy and data practices. We are not responsible for the data practices of bKash or any other third-party payment provider.

6. Disclosure of Your Information

We may share your personal information only in the following limited circumstances.

6.1 Service Providers

We share information with third-party service providers who assist us in operating the Platform. Each provider is bound by contractual confidentiality and security commitments and may use your information only for the specific service they provide to us. They may not sell or repurpose your information for advertising. The categories of providers we work with are:

1. AI service providers — receive your Doubt Solver question text and any attached image for the sole purpose of generating an educational answer. See Section 4.
2. Cloud infrastructure providers — host our database, object storage, application servers, and content delivery. Your account data and uploaded images reside on the servers of our cloud providers, primarily in the Asia-Pacific region.
3. Payment processor — bKash Tokenized Checkout — handles all subscription payments. We share only the package identifier and our internal user identifier with bKash. bKash collects your payment credentials (mobile number, bKash PIN, OTP) directly from you; we never see or store these.
4. SMS gateway provider — sends one-time passwords (OTP) and account-related SMS messages. We share only your mobile phone number and the message body.
5. Error & diagnostics provider — Sentry (Functional Software, Inc.) — receives crash reports and diagnostic data (device and app-version information, error messages and stack traces, breadcrumbs, and a user identifier consisting of your numeric account ID plus the last four digits of your phone number) so that we can detect and resolve errors in the app. Sentry is governed by its own privacy policy at https://sentry.io/privacy/.

6.2 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or where we reasonably believe disclosure is necessary to protect the rights, property, or safety of Poripurok, our users, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

We do not sell or rent your personal information to third parties, and we do not share your information with advertisers.

7. Data Storage and Security

We implement industry-standard technical and organisational security measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

7.1 Encryption in transit

All communication between the Platform (mobile app and website) and our servers is transmitted over HTTPS / TLS 1.2 or higher. Image uploads use signed URLs that authorise a single, scoped upload over an encrypted channel.

7.2 Encryption at rest

All user data stored on our infrastructure is encrypted at rest using industry- standard AES-256 server-side encryption provided by our cloud providers. Access-credential tokens are wrapped in an additional layer of AES-256-GCM authenticated encryption with a server-side key never exposed to clients.

7.3 Authentication and sessions

Passwords are never stored in plain text — we use industry-standard salted hashing. Authentication tokens expire automatically: access tokens after one (1) hour and session refresh tokens after thirty (30) days. Refresh tokens rotate on every use so a stolen token can only be used until the next refresh.

7.4 International data transfers

Your account data is stored primarily on cloud servers located in the Asia-Pacific region. When you use the Doubt Solver, your question text and any attached image are transmitted to third-party AI service providers whose servers may be located outside Bangladesh, including in other parts of Asia, the United States, or the European Union. These transfers occur because the AI services themselves are operated internationally. By using the Doubt Solver, you consent to this international transfer for the sole purpose of generating an answer to your question.

7.5 Limits of security

Whilst we take all reasonable precautions to safeguard your information, no method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at team@poripurok.com.

পরিবহনের সময় (HTTPS/TLS) এবং সংরক্ষণের সময় (AES-256) উভয় ক্ষেত্রেই আপনার তথ্য এনক্রিপ্ট করা থাকে। ডাউট সলভার ব্যবহারের সময় প্রশ্ন ও ছবি তৃতীয় পক্ষের AI পরিষেবার সার্ভারে (দেশের বাইরে) পাঠানো হয়। অ্যাকাউন্ট বিপদে পড়লে তাৎক্ষণিকভাবে আমাদের সাথে যোগাযোগ করুন।

8. Cookies and Local Storage

The Poripurok mobile application does not use browser cookies. It uses secure local device storage (AsyncStorage) to retain your authentication session and application preferences. Local storage is scoped to the app and cannot be read by other apps on your device.

Our website, poripurok.com, uses essential cookies and browser local storage for session management — specifically a small “pp_authed” cookie that the site uses to know you are logged in, and local storage entries that hold your authentication tokens. We do not use advertising cookies, third-party tracking cookies, behavioural-targeting pixels, or any cross-site analytics on our website.

9. Data Retention and Account Deletion

We retain your personal information for as long as your account remains active or as otherwise necessary to provide the Service.

9.1 How to delete your account

You can delete your Poripurok account and all associated personal data through any of the following channels:

1. In the mobile app — open the app, tap Profile → Edit Profile → Delete Account, and confirm. Your account and the data described in this policy will be queued for permanent deletion.
2. On the website — sign in at poripurok.com, open the Profile page, and use the “Delete Account” option in the same way.
3. By email — if you cannot access the in-app option, send a request to team@poripurok.com from the email address or phone number registered with your account. We will verify your identity and process the deletion within the timeframe described below.

9.2 What gets deleted

When you delete your account, we permanently delete the following from our systems: your name, mobile phone number, password, educational institution, class level, profile photograph, your complete conversation history with the AI Doubt Solver, every image you ever uploaded as part of a doubt, every bookmark, every reaction or rating you provided, and your device identifiers tied to your account. The deletion is completed within thirty (30) days of your request.

9.3 What we may retain

We may retain certain limited data after account deletion where required by law, financial regulation, or for fraud prevention:

1. Payment and transaction records — retained for seven (7) years to comply with Bangladesh financial regulations applicable to mobile-financial-service payments. These records contain only the bKash transaction identifier and the amount, not your personal identifiers.
2. Aggregated, anonymised analytics — usage statistics from which all personal identifiers have been removed.
3. Server log data — retained for ninety (90) days for security and diagnostic purposes, after which it is automatically deleted.
4. One-time password (OTP) codes — expire and are deleted automatically after five (5) minutes regardless of account state.

9.4 Deleting individual items without closing your account

You may delete individual conversations, bookmarks, and uploaded images at any time directly within the application, without deleting your full account.

অ্যাকাউন্ট মুছতে চাইলে অ্যাপে: প্রোফাইল → প্রোফাইল এডিট → অ্যাকাউন্ট মুছো — অথবা ইমেইল করুন: team@poripurok.com। ৩০ দিনের মধ্যে আপনার সমস্ত ব্যক্তিগত তথ্য মুছে ফেলা হবে। আইনি বাধ্যবাধকতার ক্ষেত্রে কিছু পেমেন্ট রেকর্ড ৭ বছর পর্যন্ত সংরক্ষণ থাকতে পারে।

10. Minor Users

The Platform is intended for students preparing for HSC examinations and university admission tests, typically aged fifteen (15) years and above. We do not knowingly collect personal information from children under the age of thirteen (13). If a parent or guardian believes that a child under thirteen has provided us with personal information without consent, they should contact us immediately at team@poripurok.com and we will promptly delete such information.

We recommend that parents and guardians of users between the ages of thirteen (13) and eighteen (18) review this Privacy Policy. We do not serve behavioural advertising to any user, including minors.

আমরা ১৩ বছরের কম বয়সী শিশুদের থেকে সচেতনভাবে কোনো তথ্য সংগ্রহ করি না। অভিভাবক অনুরোধ করলে সংশ্লিষ্ট তথ্য তাৎক্ষণিকভাবে মুছে দেওয়া হবে।

11. Your Rights

Subject to applicable law, including the Bangladesh Personal Data Protection Ordinance 2025 and international best practices, you have the following rights with respect to your personal information:

1. Right of Access: you may request a copy of the personal information we hold about you;
2. Right of Correction: you may request that we correct any inaccurate or incomplete personal information;
3. Right of Deletion: you may request deletion of your account and associated personal data, subject to legal retention requirements;
4. Right of Portability: you may request an export of your personal data in a machine-readable format;
5. Right to Object: you may object to certain types of processing, including analytics; and
6. Right to Withdraw Consent: where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at team@poripurok.com. We will respond to your request within fourteen (14) working days.

এই অধিকারগুলো প্রয়োগ করতে team@poripurok.com-এ ইমেইল করুন। আমরা ১৪ কার্যদিবসের মধ্যে জবাব দেব।

12. Modifications to This Policy

We reserve the right to modify this Privacy Policy at any time. When material changes are made, we will notify you through the application or via SMS at least seven (7) days before the changes take effect. The date of the most recent revision is indicated at the top of this page. Your continued use of the Platform after any modification constitutes your acceptance of the revised policy.

গুরুত্বপূর্ণ পরিবর্তনের ক্ষেত্রে কার্যকর হওয়ার কমপক্ষে ৭ দিন আগে অ্যাপ বা SMS-এর মাধ্যমে আপনাকে জানানো হবে।

13. Disputes and Jurisdiction

Any dispute arising out of or in connection with this Privacy Policy, including any question regarding its existence, validity, or termination, shall be resolved through the following two-step mechanism:

Stage 1 — Mediation.The parties shall first attempt to resolve the dispute through mediation conducted by a mutually agreed neutral third party. The mediator’s decision is non-binding; however, both parties shall make good-faith efforts to abide by it.

Stage 2 — Arbitration. If mediation does not yield a satisfactory resolution within a reasonable time, the dispute shall be referred to binding arbitration. The arbitration panel shall comprise three members — one appointed by each party and a third nominated by mutual consent of the two appointed members. Arbitration shall be conducted at Dhaka, Bangladesh, in the English language, and the arbitral award shall be final and binding on both parties.

If the foregoing mechanisms do not resolve the dispute, it shall be referred to the courts of competent jurisdiction in Dhaka, Bangladesh. This Privacy Policy is governed by the laws of Bangladesh.

যেকোনো বিরোধ প্রথমে মধ্যস্থতার মাধ্যমে নিষ্পত্তির চেষ্টা করা হবে। না হলে ঢাকায় সালিশ এবং প্রয়োজনে বাংলাদেশের আদালতে নিষ্পত্তি হবে।