Privacy Policy

Kurboed ("Kurboed," "we," "our," or "us") operates an AI-powered educational platform designed for students in classes 1 through 8 (approximately ages 6–18). This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you or your child uses our website, applications, and related services (collectively, the "Service").

This policy applies to all users worldwide. We comply with applicable child privacy and data protection laws, including:

• Children's Online Privacy Protection Act (COPPA)
• Consumer Privacy Act / Privacy Rights Act (CCPA/CPRA)
• Family Educational Rights and Privacy Act (FERPA)
• Digital Personal Data Protection Act, 2023 (DPDP Act)
• Information Technology Act, 2000
• Google Families Policy and Google API Services User Data Policy

By using our Service, you consent to the data practices described in this policy. If you do not agree, please do not use our Service.

2. Definitions

3.1 Information Provided by Parents

When a parent creates an account, we collect:

• First name and last name
• Email address
• Mobile phone number (with country code)
• Password (stored in encrypted form)
• Country code selection

3.2 Information About Students (Children)

When a parent adds a student profile, we collect:

• Student's full name (or nickname)
• Grade level (classes 1–12)

3.3 Information Generated Through Use

As students use the platform, we automatically generate and store:

• Learning progress data (assessment scores, question responses, completion status)
• Subject, topic, and level performance statistics
• Session data (assessment history, time of interaction)

3.4 Technical Information

We use essential cookies and browser local storage to operate the Service. We do not use analytics trackers, advertising pixels, or behavioral tracking tools. See Section 11 / Cookie Policy for full details.

We use collected information solely for the following purposes:

• Account Management: Create and maintain parent accounts and student profiles
• Educational Services: Deliver personalized learning content, assessments, and worksheets
• Progress Tracking: Record and display learning progress, scores, and statistics to parents
• AI-Powered Questions: Generate educational questions tailored to subject, topic, grade level, and difficulty
• Communication: Send account verification emails, password reset emails, and essential service notifications
• Security: Authenticate users, prevent fraud, and protect against unauthorized access using reCAPTCHA and JWT tokens
• Service Improvement: Improve our platform features and educational content quality

6. Information Sharing & Disclosure

We do not sell, trade, rent, or share personal information with third parties for their own marketing or commercial purposes.

We may share information only in these limited circumstances:

6.1 Service Providers

We work with trusted service providers who assist in operating our platform. These providers are contractually bound to use personal information only for the services they provide to us and in compliance with applicable privacy laws:

• Cloud Hosting: Amazon Web Services (AWS) for secure data storage and application hosting
• Authentication: Amazon Cognito for secure user authentication and token management
• Security: Google reCAPTCHA for bot protection during account registration

6.2 Legal Requirements

We may disclose personal information if required by law, court order, or government regulation, or to protect the rights, property, or safety of our users, our company, or the public.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of the transaction. We will notify affected users and ensure the same privacy protections apply to transferred data.

We implement appropriate technical and organizational measures to protect personal information:

• Encryption: Data is encrypted in transit (HTTPS/TLS) and passwords are securely hashed
• Authentication: JWT-based token authentication with automatic token refresh
• Access Controls: Role-based access control to restrict data access
• Secure Infrastructure: Hosted on AWS with industry-standard security certifications
• Bot Protection: Google reCAPTCHA to prevent automated abuse during registration

While we strive to protect personal information using commercially reasonable measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but will promptly notify affected users in the event of a data breach, as required by applicable law.

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:

• Account Data: Retained for as long as your account is active
• Student Data: Retained for as long as the student profile is active under the parent's account
• Learning Progress: Retained with the student profile to provide continuous educational services
• Session Tokens: Authentication tokens in browser local storage are cleared upon sign-out

When you delete your account or a student profile, we will delete or anonymize the associated personal data within 30 days, except where retention is required by law.

Under applicable data protection laws (including the DPDP Act), we will erase personal data once the purpose for which it was collected has been fulfilled, unless retention is required for legal compliance.

Depending on your jurisdiction, applicable privacy laws (including COPPA, CCPA/CPRA, DPDP Act, FERPA, and others) may grant you the following rights:

9.1 Parental Rights (Children Under 13 for COPPA, Under 18 for DPDP Act)

See Section 5 above. Parents may review, correct, or delete their child's information and withdraw consent at any time.

9.2 General Data Rights

• Right to Know / Access: Request disclosure of the categories and specific pieces of personal information we have collected about you, and a summary of processing activities
• Right to Delete / Erasure: Request deletion of your personal information, subject to certain legal exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale: We do not sell personal information. No opt-out is necessary
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
• Right to Grievance Redressal: Contact our Data Protection / Grievance Officer for any concerns about data processing
• Right to Nominate: Where permitted by law, nominate another person to exercise your rights in case of death or incapacity

To exercise these rights, contact us at teams.kurboed@gmail.com. We will respond within 30–45 days as required by applicable law.

9.3 Children's Data Under Applicable Law

Under applicable child data protection laws, processing personal data of a child (under 18) requires verifiable consent from the child's parent or lawful guardian. We obtain this consent during registration. We do not undertake any processing of a child's data that is likely to cause harm to the child.

9.4 FERPA Notice

If our Service is used through a school or educational institution, the Family Educational Rights and Privacy Act (FERPA) may apply. In such cases, the educational institution acts as the data controller, and we process student education records as directed by the institution. Parents may exercise FERPA rights through the applicable educational institution.

9.5 Data Protection / Grievance Officer

In accordance with applicable data protection regulations, our Data Protection / Grievance Officer can be contacted at: teams.kurboed@gmail.com. We will acknowledge your complaint within 24 hours and resolve it within 30 days.

10. International Data Transfers

Your information may be transferred to, stored, and processed in countries where our service providers operate. We comply with applicable cross-border data transfer provisions under relevant privacy laws.

We ensure appropriate safeguards are in place for all international data transfers, including contractual obligations with our service providers to maintain equivalent data protection standards.

11. Cookies & Local Storage

We use a minimal set of essential cookies and browser local storage to operate our Service. We do not use analytics cookies, advertising cookies, or third-party tracking tools.

For full details on the specific cookies and local storage items we use, please see our Cookie Policy.

12. Third-Party Services

Our Service integrates with the following third-party services:

• Amazon Web Services (AWS): Cloud hosting and data storage
• Amazon Cognito: User authentication and identity management
• Google reCAPTCHA: Bot protection during registration (subject to Google's Privacy Policy and Terms of Service)
• Google Fonts: Web font delivery (Quicksand font family)

Each third-party service has its own privacy policy. We encourage you to review those policies. We do not share children's personal data with these services beyond what is necessary to operate the Service.

Our platform uses secure, third-party artificial intelligence models (such as OpenAI and Google Gemini) to enhance the educational experience. We use AI for two primary purposes:

13.1 Educational Content Generation

• We use AI to generate educational questions tailored to specific subjects, topics, grade levels, and difficulties.
• These models do not receive any personal information during the question-generation process — they operate solely on academic parameters.
• AI-generated questions are reviewed and approved by administrators before being made available to students.

13.2 Personalized Learning Insights

To provide parents with personalized feedback, we use AI to analyze student performance and generate "Learning Insights." When generating these insights:

• Data Minimization: We strictly limit the data sent to the AI models. We share only pseudo-anonymized data consisting of the student's first name, grade level, and historical answer accuracy (e.g., scores, time taken, hint usage).
• No Sensitive PII: We never share full names, email addresses, contact information, or any other sensitive personal identifiable information (PII) with AI providers.
• Zero Data Training Policy: We utilize enterprise-tier API agreements with our AI providers which explicitly prohibit them from using your or your child's data to train or improve their public AI models. Your child's data remains private and is deleted from their servers after processing.

AI-generated content is for educational purposes only and does not replace professional academic guidance.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make material changes:

• We will update the "Last updated" date at the top of this policy
• We will send an email notification to registered parent accounts
• We will display a prominent notice within the Service
• Where required by COPPA, we will obtain renewed parental consent for any material changes affecting children's data

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.