Privacy & User Data Policy

This Privacy & User Data Policy explains what personal data Shocchol Outsourcing Firm (trade licence no. 02378), which operates PilotsBD (“PilotsBD”, “we”, “us”, “our”), collects when you use our website and question bank (the “Service”), why we collect it, who else can see it, how long we keep it, and what you can do about it. It forms part of our Terms of Service.

We are the controller of the personal data described here. For any question about this policy, or to exercise any right under clause 10, contact support@pilotsbd.com.

1. Account details. Your full name, email address and password. Passwords are hashed by our authentication provider; we never see or store your password in readable form. If you sign in with Google instead, we receive your name, email address and Google account identifier from Google, and no password at all.
2. Payment submissions. The bKash number you sent payment from, the transaction ID, the plan you selected and its price, together with the status of our review and any note we add. We never receive, ask for or store your bKash PIN, password or one-time code.
3. Study data. The answers you select, whether they were correct, the questions you save or flag, the private notes you write, and the practice tests and timed examinations you start, resume and finish — including their configuration, score and result.
4. Preferences. Your explanation language (English or Bengali), your light or dark theme, and whether you have opted in to occasional update emails.
5. Your acceptance of our terms. When you create an account we record the version of the legal documents you accepted and the time you accepted them, so that both of us have the same record of what was agreed.
6. Messages you send us. The name, email address and message you submit through the contact form, and anything you send to our support address.

1. Device and session data. To keep one account on one device, your browser generates a random device identifier and we derive a plain-language device label from your browser’s user agent — for example “Chrome on Android”. We store that label and your current session identifier on your profile so that a second device can be told which device holds the account. We do not build a device fingerprint, and we do not collect your location.
2. Technical and log data. Your IP address is used to rate-limit the contact form and other sensitive endpoints, to stop abuse. Our hosting provider also generates standard server logs, which include IP address, request time, page requested and browser user agent.
3. Aggregate analytics. We use privacy-friendly analytics that report how many people visit which pages, in aggregate. It does not use advertising cookies and does not identify you personally.

We use no advertising or tracking cookies, and we do not sell or share data with ad networks. What we do store on your device is:

Clearing your browser storage signs you out and resets these preferences. Blocking the authentication cookies will prevent you from signing in at all.

1. to create and operate your account, and to sign you in;
2. to deliver the Service — showing questions, recording answers, scoring tests and building your progress statistics;
3. to verify a bKash payment against your submission and activate, extend or reject the corresponding plan;
4. to send you transactional email: confirmation and password-reset links, and the result of a payment review;
5. to enforce the one-device-at-a-time rule and our free-question limits;
6. to reply to your support messages and to fix faults you report;
7. to correct and improve the question bank, using the flags and reports you send;
8. to keep the Service secure — rate limiting, abuse prevention, and investigating account sharing or unauthorised access;
9. to send occasional update emails, but only if you have opted in;
10. to comply with our legal obligations and to establish or defend legal claims.

We do not use your study data or your answers to advertise to you, and we do not sell, rent or trade your personal data to anyone.

Where data protection law requires a lawful basis, we rely on: performance of a contract with you, for everything needed to give you the Service you signed up for and paid for; legitimate interests, for security, abuse prevention, enforcing our terms and improving the question bank; consent, for update emails, which you may withdraw at any time; and legal obligation, where the law requires us to keep or disclose records.

We do not sell your data or share it for anyone else’s marketing. We use a small number of service providers to run the Service. They process data on our instructions and for no purpose of their own:

Beyond these providers, we disclose personal data only where we are required to by law, court order or a lawful request from a competent authority; where it is necessary to establish, exercise or defend a legal claim; or where it is necessary to protect the rights, safety or property of PilotsBD, our users or the public. If our business is ever transferred, your data may transfer with it, subject to this policy.

Your account and study data is held in our database provider’s Mumbai region, in India. Our other providers operate servers in a number of countries, so some data — email delivery and server logs in particular — is processed elsewhere. Wherever it is held, it remains subject to this policy and to contractual protections with the provider concerned.

1. Account, study and preference data: for as long as your account exists.
2. Payment submissions and subscription records: for as long as your account exists. Deleting your account deletes these records too — we cannot recover them afterwards, so keep your own bKash transaction records if you may need them.
3. Support and contact messages: kept in our support mailbox for as long as needed to handle the matter and to keep a record of what was reported and fixed.
4. Server and security logs: kept for a short period by our hosting provider for security and troubleshooting.

You can, at any time:

• See and correct your details — your name, email, language and theme are all editable from your account page.
• Change your password — from your account page, or through the password-reset link on the login page.
• Stop update emails — turn off the updates option on your account page. Transactional email about your account and payments cannot be switched off while you have an account, because it is how we tell you what happened to your payment.
• Sign other devices out — signing in on a new device offers to end the other session.
• Delete your account — the delete option on your account page removes your login and everything attached to it, including your study history, payment submissions and subscription records. Deletion is immediate and cannot be undone; any remaining time on a paid plan is lost and is not refundable. Copies may remain for a short period in our email records and in our providers’ backups and server logs.

You may also ask us for a copy of your personal data, ask us to correct or delete it, or object to or restrict a particular use, by emailing support@pilotsbd.com from your registered address. We will respond within 30 days. If you are not satisfied with our response, you may complain to the relevant authority in your country.

We take security seriously and build for it: traffic is encrypted in transit; passwords are hashed by our authentication provider and are never stored in readable form; database access is protected by row-level security rules so that one account cannot read another account’s data; administrative functions are restricted to administrator accounts; sensitive endpoints are rate-limited; and the one-device rule limits the damage a leaked password can do.

No system is perfectly secure. Please use a strong, unique password, keep it to yourself, and tell us at support@pilotsbd.com immediately if you suspect your account has been accessed by someone else. If a breach occurs that is likely to affect your rights, we will notify affected users and any authority we are required to notify, without undue delay.

The Service is not directed at children. You must be at least 18 to hold an account, as set out in our Terms of Service; a younger student studies through an account held by a parent or legal guardian. We do not knowingly collect data from a child directly; if you believe a child has given us personal data, contact support@pilotsbd.com and we will delete it.

The Service links to third-party sites and channels, including our social media and WhatsApp. This policy does not cover them, and we are not responsible for their privacy practices.

We may update this policy. The current version is always published on this page with the date it took effect. Where a change materially affects how we use your data, we will give reasonable notice by email or in the Service before it applies.

The Service is operated by Shocchol Outsourcing Firm, trade licence no. 02378. For any privacy or data question, or to exercise any right in clause 10: support@pilotsbd.com, or through our contact form.