Introduction
AceMax (“AceMax”, “we”, “us” or “our”) operates acemaxpakistan.com, our mobile app and the related services described on them (together, the “Platform”). We provide ECAT and BCAT exam preparation, including practice tests, full mock exams, the Prepathon and Mockathon events, past papers, study analytics and the Jojo AI study assistant.
This policy applies to everyone who visits the Platform, creates an account, takes part in an event, applies to one of our programs or buys a plan. We are the controller of the personal information described here, which means we decide how it is used and we are responsible for it.
If you do not agree with this policy, please do not use the Platform. Your use of the Platform is also governed by our Terms of Service.
Information We Collect
Information you give us
- Account details: your name, email address and a password. Passwords are stored only as a salted one-way hash, so we cannot read them. If you sign in with Google, we receive your name, email address and profile picture from Google, never your Google password.
- Onboarding choices: your target exam (ECAT or BCAT), the universities you are aiming for, your exam date and the subjects you find hardest. This is how we tailor your dashboard and study plan.
- Test and performance data: the tests you generate, every answer you give, scores, time taken, and your subject, chapter, topic and difficulty breakdowns. We also keep your daily activity and study streaks.
- Plan and payment details: the plan you buy, the amount, any promo code, the contact details you submit at checkout and the payment receipt screenshot you upload. See the Payments section for how this works.
- Messages and feedback: support requests sent through the contact form, feedback you submit, and any information you choose to include in them.
- Event registrations: your name and email when you register for a Prepathon or Mockathon session, and your answers and results when you take part.
Information we collect automatically
- Device and sign-in data: your IP address, browser, operating system and device type. At sign-in we also work out an approximate location (city, region and country) from your IP address and store it with your latest device. This is used to protect accounts, as explained in the Data Security section.
- Usage data: pages viewed, features used and interactions with the Platform, used to understand what students find useful and to fix problems.
- Daily usage counters: how many tests, Jojo AI questions and PDF downloads your account has used today, so that the limits of your plan can be applied.
- Mobile app data: if you use the app and allow notifications, we store a push notification token and whether your device runs iOS or Android.
- Diagnostic data: request logs, rate-limiting signals and error reports used to detect abuse and fix faults. Sensitive values such as one-time codes and email addresses in page addresses are removed before error reports leave our systems.
Information we do not collect
We do not collect or store your card number, bank login or mobile wallet PIN. You pay through your own banking or wallet app, and we only see the receipt you choose to upload as proof of payment.
How We Use Information
We use personal information for the following purposes:
| Purpose | Examples |
|---|---|
| Providing the Platform | Creating your account, generating practice tests, scoring submissions, showing analytics, building your study plan and running events |
| Personalisation | Using your target exam, weak subjects and past performance to suggest what to practice next |
| Payments and plans | Reviewing receipts, applying promo codes, activating your plan and downgrading it when it expires |
| Account security | Email verification codes, password resets, limiting failed sign-ins and detecting account sharing |
| Service emails | Verification and password reset messages, test summaries, payment confirmations, plan expiry warnings, and event reminders for sessions you registered for |
| Study reminders and updates | Weekly progress digests, exam date reminders, nudges to keep your streak and announcements of new features. You can opt out of these. |
| Support | Replying to your questions and resolving issues you report |
| Improvement and analytics | Understanding aggregate usage so we can fix bugs, improve questions and decide what to build next |
| Legal and safety | Enforcing our Terms, preventing fraud and abuse, and complying with applicable law |
We rely on your consent where it is required, on the performance of our agreement with you to deliver the Platform, and on our legitimate interest in running a secure and useful service.
Jojo AI
Jojo AI is our AI study assistant. When you use it, the message you type and the context needed to answer it, such as the question you are asking about, are sent to Google’s Gemini API to generate a reply.
- Your conversations are saved to your account so you can return to them and pin the ones you want to keep.
- Requests are sent from our servers rather than from your browser, and we do not include your password or payment details.
- Please do not type sensitive personal information into a chat, such as ID numbers, passwords or payment details. The assistant does not need them.
- AI answers can be wrong. Treat them as a study aid and check important facts against your textbooks.
Prepathon and Mockathon
Prepathon is our weekly timed test and Mockathon is our university mock exam series. When you register or take part:
- We record your registration (name and email), your answers, your score and your time taken for each session.
- Leaderboards rank participants by score and then by time. A leaderboard can show your name, score and time to other participants and visitors.
- We use event data to run the session fairly, to check that attempts started within the allowed window, and to investigate suspected cheating.
- Event emails, such as reminders and results, go to the address you registered with.
Ambassador and Organizer Programs
Some students apply to the AceMax Student Ambassador Program (ASAP) or to become a verified organizer through AceMax Squad. Because these roles represent AceMax to other students, we verify who applicants are.
- What we ask for: your full name, email, phone or WhatsApp number, city, school, college or university, and short written answers about your leadership and why you want to join. For verification we also collect a photo of your CNIC (or Form-B if you are under 18) and your institution ID card. Organizer applications collect your CNIC number, and an ID photo for university students.
- Who sees it: only authorised AceMax administrators who review applications. It is never shown publicly. ID images are kept in private storage that is not open to the public.
- Referral codes: accepted ambassadors receive a personal referral code. We record how many times it is redeemed to measure performance.
- Deletion: these records are not deleted automatically. You can ask us to delete your application and ID images at any time using the contact details below, unless we need to keep them for a legal reason or an ongoing dispute.
Payments
Payments are made by JazzCash, EasyPaisa or bank transfer, directly to our account. You then submit the purchase form and upload a screenshot or receipt so a member of our team can confirm the payment.
- We store the plan, amount, promo code, your contact details, the receipt image, the review decision and any note our team adds. Receipt images are kept in our file storage and are only opened by authorised team members.
- Receipts often show your wallet or account name and part of an account number. Please crop out anything unrelated to the transaction before uploading.
- We keep payment records for our accounting and tax obligations and to prove that you are entitled to your plan.
Data Retention
We keep personal information only as long as it serves the purpose it was collected for:
- Account, test and AI conversation data: for as long as your account is active. If you ask us to delete your account, we remove your personally identifiable information within 30 days.
- Payment records and receipts: kept for our financial and tax records and to prove entitlement to a plan, even after your account is deleted, in a form that is limited to what those records require.
- Support messages: kept while needed to resolve your request and to handle any follow-up.
- Event results: kept so past leaderboards and your history stay accurate.
- Program applications and ID images: kept for as long as the application or role is active, or until you ask us to delete them.
- Verification codes and password reset tokens: short-lived and expire automatically.
- Security and diagnostic logs: kept for a limited period for investigation and troubleshooting.
We may keep anonymised and aggregated statistics, such as overall platform usage, indefinitely, because they no longer identify you.
Data Security
We take practical steps to protect your information:
- All traffic is encrypted in transit using HTTPS, and our databases encrypt data at rest.
- Passwords are stored only as salted one-way hashes.
- Sessions use secure, HTTP-only cookies. Repeated failed sign-ins temporarily lock an account, and public forms and sign-in endpoints are rate limited.
- Access to administrative tools and student records is limited to authorised team members, and administrator actions are logged.
- Receipts and identity documents are kept in private storage and are only opened by authorised team members.
Account sharing protection
An AceMax account is for one person. To enforce this, signing in on a new device ends your session on the previous one, and we keep your last sign-in device and approximate location so that unusual activity can be spotted and so you can be shown where your account was last used. Plans that include PDF downloads also apply download limits and may pause downloads on an account that looks automated or shared.
No online service can promise perfect security. You are responsible for keeping your password confidential and for activity under your account. Tell us immediately if you think your account has been accessed without your permission.
Your Rights & Choices
Depending on where you live and applicable law, you can:
- Access and update your account and exam details from your profile and settings at any time.
- Request a copy of the personal information we hold about you, in a portable, machine-readable format where possible.
- Request correction of information that is inaccurate or incomplete.
- Request deletion of your account and personal information, subject to records we must keep for financial, tax or legal reasons.
- Object to or restrict certain processing, and withdraw consent where processing is based on consent.
- Opt out of study reminders and announcements using the unsubscribe link in those emails or your account settings, and switch off push notifications in your phone’s settings. Messages about your account, security, payments and events you registered for will still be sent.
To exercise any of these, email acemaxpakistan@gmail.com from the address on your account. We may need to verify your identity first, and we will respond within 30 days.
Age Requirements
AceMax is intended for students aged 15 and above who are preparing for college admission tests.
- We do not knowingly collect personal information from anyone under 15.
- If you are under 18, we encourage you to use the Platform and make purchases with the knowledge of a parent or guardian.
- Applicants to our programs who are under 18 provide a Form-B in place of a CNIC. We handle it with the same restrictions described in the programs section.
If you are a parent or guardian and believe your child under 15 has given us personal information, contact us and we will delete it promptly.
International Transfers
We are based in Pakistan. The service providers listed above may store and process information on servers outside Pakistan, including in the European Union and the United States, which may have different data protection laws. By using the Platform you consent to that transfer, and we choose providers that offer appropriate contractual and technical safeguards.
Changes to This Policy
We may update this Privacy Policy as the Platform evolves or as the law requires. When we do, we will change the “Last updated” date at the top of this page. If the changes are material, we will tell you by email or with a prominent notice on the Platform. Continuing to use the Platform after an update means you accept the revised policy.
Contact Us
For any question about this policy, or to exercise your privacy rights, reach us at: