PRIVACY POLICY

This Privacy Policy describes how ISSB Preparation, a project of Athens Academy, Islamabad, Pakistan(“we”, “us”, “our”, or “the Platform”) collects, uses, stores, and protects personal information when you visit our website or use any of our services (collectively, the “Services”).

We are an independent, not-for-profit preparation platform with the mission of making quality education accessible to candidates preparing for Pakistan's armed-forces selection process. We are not affiliated with the Inter Services Selection Board, the Pakistan Armed Forces, or any government body.

If you have any questions or requests regarding this Privacy Policy or the handling of your personal data, please contact us:

By using the Platform you acknowledge that you have read and understood this Privacy Policy and agree to the collection and use of your information as described herein. This Privacy Policy is incorporated by reference into our Terms & Conditions.

We collect only the information necessary to operate the Platform and deliver the Services to you. The categories of information we collect are set out below.

2.1 Account information

When you register for an account you provide your full name, email address, and a password (stored as a one-way bcrypt hash — we never store or see your plaintext password). You may also provide an optional mobile phone number in the format 03XXXXXXXXX; when provided, this is used for payment verification and account-related communications.

2.2 Social sign-in via Google or Facebook

If you choose to register or sign in using Google or Facebook, we receive from that provider only your name, email address, and a reference to your profile picture. We never receive or store your Google or Facebook password. We do not request access to your contacts, friends list, timeline, or any other social data. See Section 5 for more on these third-party providers.

2.3 Biodata and eligibility inputs

The Platform's biodata and eligibility tools ask for information such as your date of birth, educational qualifications, physical measurements, and branch of interest. This information is used solely to generate your eligibility report and personalised study roadmap.

2.4 Test responses and uploaded materials

When you participate in evaluated assessments — including psychometric practice tests, written exercises, picture-story submissions, and handwriting samples — your responses and uploaded images are received and stored temporarily for the purpose of evaluation. Once evaluation is complete and your report has been generated, the raw submitted material is permanently deleted (see Section 4 — Data Retention).

2.5 Payment receipt images

If you upgrade to a paid plan, you upload an image of your payment receipt or transaction confirmation for manual verification by our team. This image is stored only until verification is complete, after which the image data is permanently deleted. The outcome of the verification (approved or declined) is retained as the permanent payment record.

2.6 In-house usage analytics

We collect in-house usage analytics — such as pages visited, features used, and session timing — for the purpose of understanding how the Platform is used and improving it. These analytics are tied to an anonymous device identifier generated on your device; they are not linked to your name or email address except in aggregate. We do not use any third-party analytics networks, advertising trackers, or behavioural profiling services. There are no advertising cookies or ad networks on this Platform.

We use the personal information we collect for the following purposes only:

• To operate the Platform — creating and managing your account, authenticating your identity, and providing access to the features included in your plan.
• To evaluate your submissions — processing your test responses and uploaded materials using automated assessment technology under the supervision and review of our expert panel, and generating your evaluation report.
• To verify payments — reviewing your uploaded payment receipt, activating or managing your paid plan, and contacting you by phone or WhatsApp where payment verification requires direct communication.
• To communicate about your account — sending you transactional notifications (report ready, payment approved, account security alerts) and infrequent updates about material changes to the Platform or these policies.
• To personalise your experience — generating your study roadmap, tracking your progress, awarding XP and badges, and tailoring content recommendations based on your activity.
• To improve the Platform — using anonymised, aggregated analytics data to identify technical issues, understand usage patterns, and develop new features.
• To comply with legal obligations — retaining records we are required to keep under Pakistani law and responding to lawful requests from public authorities.

We do not use your personal information for advertising, profiling for commercial purposes, or any purpose not listed above. We will not sell, rent, or trade your personal information to any third party.

We follow a data-minimisation policy: sensitive raw submission data is deleted as soon as its purpose has been fulfilled. The table below summarises our retention periods.

Deletion of raw submission data is irreversible. The evaluation report — not the raw material — is the permanent record retained on our systems. We believe this approach minimises privacy risk while ensuring you retain access to your feedback.

Certain payment and transaction records may be retained beyond the periods above where required by applicable Pakistani law or for the resolution of disputes.

We share personal data with third parties only where strictly necessary to operate the Platform. We do not sell, rent, or trade your data. The limited categories of third parties we work with are described below.

5.1 Infrastructure providers

Your data is stored on servers operated by reputable cloud infrastructure providers — including our database host and our web hosting provider — under data processing agreements that require them to protect your data and use it only for the services they provide to us. These providers are located in or accessible from data centres in the Asia-Pacific region.

5.2 Google (optional sign-in)

If you choose “Continue with Google”, your browser communicates directly with Google. We receive only your name, email address, and a profile picture reference from Google's OAuth service. Google's handling of your data during that authentication flow is governed by Google's own privacy policy at policies.google.com/privacy.

5.3 Facebook / Meta (optional sign-in)

If you choose “Continue with Facebook”, your browser communicates directly with Meta Platforms. We receive only your name, email address, and a profile picture reference from Facebook's OAuth service. We request only the minimum permissions (email and public_profile) and do not access your friends list, timeline, messages, or any other Facebook data. Meta's handling of your data during authentication is governed by Meta's Data Policy at facebook.com/privacy/policy.

5.4 No advertising networks

We do not use any advertising networks, third-party trackers, behavioural analytics services, or data brokers. There are no advertising pixels, fingerprinting scripts, or retargeting cookies on this Platform.

We implement technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure:

• Encrypted transport — all communication between your browser and our servers uses TLS (HTTPS). We do not accept unencrypted HTTP connections.
• Hashed passwords — passwords are stored using bcrypt with a cost factor of 12. Plaintext passwords are never stored or logged.
• Access-controlled storage — uploaded files (handwriting samples, picture-story images, payment receipts) are stored in private, access-controlled object storage. They are never publicly addressable and are served only to authorised users via time-limited, signed requests.
• Uploaded files are never executable — files you upload are validated for type and content before storage and are served only as data, never executed as code.
• Rate limiting — our API endpoints apply per-IP and per-user rate limits to protect against brute-force and denial-of-service attacks.

While we take these measures seriously, no system is completely secure. We cannot guarantee the absolute security of your data and encourage you to use a strong, unique password and to notify us immediately if you suspect unauthorised access to your account.

The Platform is intended for candidates preparing for Pakistan's armed-forces selection process. To register for an account you must be at least thirteen (13) years of age. Users between the ages of 13 and 17 may only use the Platform with the express consent of a parent or legal guardian.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account without parental consent, please contact us at prepareissb@gmail.com and we will delete the account and associated data promptly.

You have the right to request deletion of your account and the personal data we hold about you. To submit a data deletion request, please contact us using one of the methods below:

• Email — send a message to prepareissb@gmail.com with the subject line “Data deletion request”. Please include the email address associated with your account so that we can verify your identity.
• WhatsApp — message us at +92 334 2997799 from the mobile number registered to your account (this helps us verify your identity quickly).

Once we have verified your identity, we will delete your account and associated personal data within 30 days. You will receive a confirmation message when deletion is complete.

Please note that certain records may be retained beyond this period where required by applicable Pakistani law or for legitimate payment-audit purposes (for example, the outcome of a payment verification). Raw submission data (handwriting images, test responses, interview transcripts) may already have been deleted before your request arrives, in accordance with our standard data-retention policy described in Section 4.

If you signed in with Google or Facebook, you can also revoke the app's access to your account directly in your provider's settings:

• Google — visit myaccount.google.com/permissions, find “ISSB Preparation”, and click Remove.
• Facebook — visit Facebook Settings → Apps and Websites, find “ISSB Prep”, and click Remove. Note that revoking provider access does not automatically delete your ISSB Preparation account or its associated data — please also submit a deletion request using one of the methods above.

Subject to applicable law, you have the following rights with respect to your personal data:

• Access — you may request a copy of the personal data we hold about you.
• Correction — you may update your name, phone number, and password via your account settings page at any time. If you need to correct your email address, please contact us.
• Deletion — you may request deletion of your account and personal data as described in Section 8.
• Objection — you may object to any use of your personal data that you believe is not covered by this Privacy Policy by contacting us.

To exercise any of these rights, contact us at prepareissb@gmail.com. We aim to respond to all requests within 30 days. We may ask you to verify your identity before processing any request.

We use a small number of strictly necessary cookies and browser storage mechanisms to operate the Platform:

• Session cookie — an encrypted, HTTP-only cookie that keeps you signed in during your session. It is deleted when your browser session ends (or on sign-out).
• CSRF token — a security token included in forms to prevent cross-site request forgery.
• Anonymous device identifier— a randomly generated identifier stored in your browser's local storage for in-house analytics purposes. It contains no personal information and is not shared with any third party.

We do not use any advertising, tracking, or profiling cookies. There are no third-party cookies on this Platform other than those set by Google or Facebook during their respective OAuth flows (which you initiate by choosing to sign in with those providers).

This Privacy Policy is governed by and construed in accordance with the laws of the Islamic Republic of Pakistan. Any dispute arising out of or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of competent jurisdiction located in Islamabad, Pakistan.

We may update this Privacy Policy from time to time. When we do, we will post the revised policy on this page and update the “Last updated” date at the top. For material changes — such as new categories of data collected or new uses of existing data — we will make reasonable efforts to notify you via the email address or phone number on your account.

Your continued use of the Platform after a revised Privacy Policy has been posted constitutes your acceptance of that revised policy. If you do not agree with any change, please stop using the Platform and, if you wish, submit a data deletion request as described in Section 8.