Privacy Policy

1. Who is responsible for your data

TeckPal Technology Ltd, operating BandGuru in Bangladesh, decides how your information is used. You can reach us any time at hello@bandguru.ai.

2. What we collect

• Your mobile number and password — this is how you sign in. We send a one-time code to your number only to create your account or reset your password. Your password is stored encrypted; we cannot read it.
• Your name and preferences — the name you give us, your language choice (English or Bangla), how you prefer to be addressed, and your exam date if you tell us.
• Your practice work — your answers, essays, scores, mistakes, and which questions you found hard. This is the heart of the service: BandGuru only works because it remembers your mistakes.
• Voice recordings — only if you use speaking practice, and only after your browser asks your permission.
• Your email — optional for your account, used to help you recover it if you lose your number. It is also asked at checkout so SSLCOMMERZ can send your receipt.
• Checkout details — when you buy a package: your full name, email, mobile number and billing address. We pass these to SSLCOMMERZ to take the payment; we keep only what you bought, the amount, the date and the payment reference.
• Basic technical information — device type, browser, and general usage, so we can keep the service working and stop abuse.

We do not collect your card number, bKash, Nagad or bank details, PINs or payment codes. You enter those on SSLCOMMERZ’s own secure payment page, never on ours. SSLCOMMERZ has its own privacy policy.

3. Why we use it

• To sign you in and keep your account secure.
• To grade your work and give you feedback and band estimates.
• To remember your weak points and build your next practice from them.
• To process your purchases through SSLCOMMERZ and keep a record of them.
• To send you service messages (for example, your sign-in code).
• To keep BandGuru safe — spotting abuse and protecting against fraud.

4. Who we share it with

We do not sell your data. We share only what is needed, with companies that help us run the service:

• Our AI grading partners — when you submit an essay, a chat message, or a speaking recording, that content is sent to AI providers (currently Google Gemini and Groq for speaking, Deepgram for live speech, and Anthropic and OpenAI for chat and writing) so it can be graded or answered. They process it on our instructions to return your feedback. We do not send them your name or phone number with it.
• Google Analytics — counts visits and shows which pages are used: the pages you open, your device and browser, and your approximate city. It uses cookies (see section 9). We do not send it your name, phone number or anything you write or say.
• Our hosting and database provider — Supabase and Vercel, where the service and your account data run.
• Our SMS provider in Bangladesh — receives only your mobile number and the sign-in code, so the message can be delivered.
• Our payment partner, SSLCOMMERZ (Software Shop Limited) — receives your name, email, mobile number, billing address and the amount, to process the payment, prevent fraud and send your receipt.
• Authorities — only if the law requires it.

Some of these providers operate outside Bangladesh, so your information may be processed abroad under their own security commitments.

5. How long we keep it

• Voice recordings: three months maximum. After that they are deleted automatically. Your transcripts and results are small text records and stay, so your progress history survives.
• Your practice history: for as long as your account is open — that is what makes the personalisation work.
• Purchase records (what you bought, the amount, the date and the payment reference): as long as accounting and tax rules require, even if you delete your account.

6. Your choices

• See your data — ask us and we will tell you what we hold about you.
• Correct it — you can change your name, language and exam date in the app at any time.
• Delete it — email us and we will delete your account. Your personal details are removed; anonymous practice statistics that no longer identify you may remain.
• Stop messages — service messages like sign-in codes are required to use the account, but you can opt out of anything promotional.

To use any of these, email hello@bandguru.ai from your account’s contact address or tell us your registered mobile number. We reply within 30 days.

7. Security

Connections are encrypted. Your practice data is protected so that each account can only reach its own records, and the answer keys to our questions are held where the app itself cannot read them. No system is perfect, but if a breach ever affects you, we will tell you.

8. Children

BandGuru is for learners aged 13 and above. If we learn that we hold data about a younger child, we delete it.

9. Cookies

We use a small number of cookies: one to keep you signed in, a few to remember your settings, and Google Analytics cookies (named _ga) that count visits and show which pages are used. We do not use advertising cookies to track you across other websites. You can block or delete cookies in your browser; you will then need to sign in again.

10. Changes

If we change this policy in a way that matters, we will tell you in the app or by message before it takes effect.