We are committed to protecting your privacy and the privacy of your children. This policy explains how we collect, use, and safeguard personal information on our educational platform.
Last updated: August 2026
Child Privacy Compliant
COPPACCPADPDP Act
Table of Contents
1. Introduction & Scope
Kurboed ("Kurboed," "we," "our," or "us") operates an AI-powered educational platform designed for students in classes 1 through 8 (approximately ages 6–18). This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you or your child uses our website, applications, and related services (collectively, the "Service").
This policy applies to all users worldwide. We comply with applicable child privacy and data protection laws, including:
Children's Online Privacy Protection Act (COPPA)
Consumer Privacy Act / Privacy Rights Act (CCPA/CPRA)
Family Educational Rights and Privacy Act (FERPA)
Digital Personal Data Protection Act, 2023 (DPDP Act)
Information Technology Act, 2000
Google Families Policy and Google API Services User Data Policy
By using our Service, you consent to the data practices described in this policy. If you do not agree, please do not use our Service.
2. Definitions
"Child" or "Student" means any user under the age of 18, specifically a student in classes 1 through 8.
"Parent" means a parent or legal guardian of a Child.
"Personal Information" / "Personal Data" means any information that identifies, relates to, or could reasonably be linked to an identifiable individual or household.
"Data Fiduciary" (under applicable data protection law) means Kurboed, as we determine the purpose and means of processing personal data.
"Data Principal" (under applicable data protection law) means the individual (or in the case of a Child, their Parent) whose personal data is being processed.
3. Information We Collect
3.1 Information Provided by Parents
When a parent creates an account, we collect:
First name and last name
Email address
Mobile phone number (with country code)
Password (stored in encrypted form)
Country code selection
3.2 Information About Students (Children)
When a parent adds a student profile, we collect:
Student's full name (or nickname)
Grade level (classes 1–12)
What We Do NOT Collect from Children
We do not collect children's email addresses, phone numbers, social media accounts, precise geolocation, photos, videos, voice recordings, or any biometric data. Children do not create their own accounts — only parents do.
3.3 Information Generated Through Use
As students use the platform, we automatically generate and store:
Learning progress data (assessment scores, question responses, completion status)
Subject, topic, and level performance statistics
Session data (assessment history, time of interaction)
3.4 Technical Information
We use essential cookies and browser local storage to operate the Service. We do not use analytics trackers, advertising pixels, or behavioral tracking tools. See Section 11 / Cookie Policy for full details.
4. How We Use Your Information
We use collected information solely for the following purposes:
Account Management: Create and maintain parent accounts and student profiles
Educational Services: Deliver personalized learning content, assessments, and worksheets
Progress Tracking: Record and display learning progress, scores, and statistics to parents
AI-Powered Questions: Generate educational questions tailored to subject, topic, grade level, and difficulty
Communication: Send account verification emails, password reset emails, and essential service notifications
Security: Authenticate users, prevent fraud, and protect against unauthorized access using reCAPTCHA and JWT tokens
Service Improvement: Improve our platform features and educational content quality
We Do NOT Use Information For
Advertising or marketing to children
Selling or renting personal data to any third party
Behavioral tracking or profiling for non-educational purposes
Creating public profiles of children
5. Children's Privacy Protections
We fully comply with applicable child privacy laws (including COPPA and the DPDP Act) for users under 13 and extend similar protections to all student users up to age 18:
5.1 Verifiable Parental Consent
Only parents or legal guardians (age 18+) can create accounts
Parents must explicitly consent to our Privacy Policy and Terms of Service during registration
Student profiles are created and managed solely by the parent
Children cannot independently create accounts or provide personal information
5.2 Minimal Data Collection
We collect only the minimum information necessary to provide educational services (student name and grade level)
We do not condition a child's participation on collecting more personal information than is reasonably necessary
5.3 Parental Rights
Parents have the right to:
Review the personal information collected about their child
Request deletion of their child's personal information
Refuse further collection or use of their child's information
Update or correct their child's information through the parent dashboard
We do not display any third-party advertisements to children. We do not use children's data for marketing purposes. We do not allow third-party ad networks or behavioral advertising on our platform.
5.5 Parent-Initiated Sharing
Our platform provides an optional "Sharing Feature" allowing parents to generate and download images ("Achievement Cards") containing their child's first name, learning streaks, and AI-generated encouragement.
Parental Responsibility: By using this feature to export or share images to third-party platforms (e.g., social media, messaging apps), the parent assumes full liability for the distribution of their child's information. Kurboed is not responsible for data privacy once an image is exported from our platform.
Anonymous Mode: We proactively provide an "Anonymous Mode" toggle that allows parents to remove the child's name from the image before generation, ensuring progress can be shared without exposing Personally Identifiable Information (PII).
5.6 Purchase Consent Audit Log
To comply with COPPA (US), GDPR-K (EU), and contract law — which prohibit minors from authorising financial transactions —Kurboed records a timestamped consent log entry every time a parent re-verifies their password before a subscription purchase, upgrade, or cancellation:
Data recorded: Timestamp (server-side), account identifier (user ID), action type (e.g. SUBSCRIPTION_CREATE), outcome (AUTHORIZED or DENIED), IP address, and browser/device type (user agent)
Purpose: Legal compliance with COPPA/GDPR-K, fraud prevention, and chargeback defence (evidence that an adult account holder explicitly authorised the transaction)
Failed attempts: Unsuccessful authorisation attempts (wrong password) are also recorded for security monitoring
Retention: Consent log records are retained for 7 years to align with financial record-keeping standards. Under GDPR Article 17(3)(b), these records fall within the financial records exception to the right of erasure — PII within the log may be anonymised, but the transaction record itself is retained
5.7 Legal Basis for Processing Children's Data (GDPR-K / EU)
For users in the European Union and European Economic Area, our legal basis for processing student data is:
Contractual necessity (Article 6(1)(b) GDPR): processing student name and grade level is necessary to deliver the subscribed educational service
Parental consent (Article 8 GDPR / GDPR-K): for users under 16 (or the applicable age in their member state), we rely on verifiable parental consent obtained at account registration
Student data is not used for advertising, automated profiling, or any purpose beyond delivering the educational service
Student data is not transferred outside the EU/EEA without adequate safeguards (Standard Contractual Clauses or equivalent)
EU/EEA users have the right to lodge a complaint with their national data protection authority
6. Information Sharing & Disclosure
We do not sell, trade, rent, or share personal information with third parties for their own marketing or commercial purposes.
We may share information only in these limited circumstances:
6.1 Service Providers
We work with trusted service providers who assist in operating our platform. These providers are contractually bound to use personal information only for the services they provide to us and in compliance with applicable privacy laws:
Cloud Hosting: Amazon Web Services (AWS) for secure data storage and application hosting
Authentication: Amazon Cognito for secure user authentication and token management
Security: Google reCAPTCHA for bot protection during account registration
6.2 Legal Requirements
We may disclose personal information if required by law, court order, or government regulation, or to protect the rights, property, or safety of our users, our company, or the public.
6.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of the transaction. We will notify affected users and ensure the same privacy protections apply to transferred data.
7. Data Security
We implement appropriate technical and organizational measures to protect personal information:
Encryption: Data is encrypted in transit (HTTPS/TLS) and passwords are securely hashed
Authentication: JWT-based token authentication with automatic token refresh
Access Controls: Role-based access control to restrict data access
Secure Infrastructure: Hosted on AWS with industry-standard security certifications
Bot Protection: Google reCAPTCHA to prevent automated abuse during registration
While we strive to protect personal information using commercially reasonable measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but will promptly notify affected users in the event of a data breach, as required by applicable law.
8. Data Retention
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected:
Account Data: Retained for as long as your account is active
Student Data: Retained for as long as the student profile is active under the parent's account
Learning Progress: Retained with the student profile to provide continuous educational services
Session Tokens: Authentication tokens in browser local storage are cleared upon sign-out
When you delete your account or a student profile, we will delete or anonymize the associated personal data within 30 days, except where retention is required by law.
Under applicable data protection laws (including the DPDP Act), we will erase personal data once the purpose for which it was collected has been fulfilled, unless retention is required for legal compliance.
9. Your Privacy Rights
Depending on your jurisdiction, applicable privacy laws (including COPPA, CCPA/CPRA, DPDP Act, FERPA, and others) may grant you the following rights:
9.1 Parental Rights (Children Under 13 for COPPA, Under 18 for DPDP Act)
See Section 5 above. Parents may review, correct, or delete their child's information and withdraw consent at any time.
9.2 General Data Rights
Right to Know / Access: Request disclosure of the categories and specific pieces of personal information we have collected about you, and a summary of processing activities
Right to Delete / Erasure: Request deletion of your personal information, subject to certain legal exceptions
Right to Correct: Request correction of inaccurate personal information
Right to Opt-Out of Sale: We do not sell personal information. No opt-out is necessary
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
Right to Grievance Redressal: Contact our Data Protection / Grievance Officer for any concerns about data processing
Right to Nominate: Where permitted by law, nominate another person to exercise your rights in case of death or incapacity
To exercise these rights, contact us at teams.kurboed@gmail.com. We will respond within 30–45 days as required by applicable law.
9.3 Children's Data Under Applicable Law
Under applicable child data protection laws, processing personal data of a child (under 18) requires verifiable consent from the child's parent or lawful guardian. We obtain this consent during registration. We do not undertake any processing of a child's data that is likely to cause harm to the child.
9.4 FERPA Notice
If our Service is used through a school or educational institution, the Family Educational Rights and Privacy Act (FERPA) may apply. In such cases, the educational institution acts as the data controller, and we process student education records as directed by the institution. Parents may exercise FERPA rights through the applicable educational institution.
9.5 Data Protection / Grievance Officer
In accordance with applicable data protection regulations, our Data Protection / Grievance Officer can be contacted at: teams.kurboed@gmail.com. We will acknowledge your complaint within 24 hours and resolve it within 30 days.
10. International Data Transfers
Your information may be transferred to, stored, and processed in countries where our service providers operate. We comply with applicable cross-border data transfer provisions under relevant privacy laws.
We ensure appropriate safeguards are in place for all international data transfers, including contractual obligations with our service providers to maintain equivalent data protection standards.
11. Cookies & Local Storage
We use a minimal set of essential cookies and browser local storage to operate our Service. We do not use analytics cookies, advertising cookies, or third-party tracking tools.
For full details on the specific cookies and local storage items we use, please see our Cookie Policy.
12. Third-Party Services
Our Service integrates with the following third-party services:
Amazon Web Services (AWS): Cloud hosting and data storage
Amazon Cognito: User authentication and identity management
Google Fonts: Web font delivery (Quicksand font family)
Each third-party service has its own privacy policy. We encourage you to review those policies. We do not share children's personal data with these services beyond what is necessary to operate the Service.
13. AI-Generated Content
Our platform uses secure, third-party artificial intelligence models (such as OpenAI and Google Gemini) to enhance the educational experience. We use AI for two primary purposes:
13.1 Educational Content Generation
We use AI to generate educational questions tailored to specific subjects, topics, grade levels, and difficulties.
These models do not receive any personal information during the question-generation process — they operate solely on academic parameters.
AI-generated questions are reviewed and approved by administrators before being made available to students.
13.2 Personalized Learning Insights
To provide parents with personalized feedback, we use AI to analyze student performance and generate "Learning Insights." When generating these insights:
Data Minimization: We strictly limit the data sent to the AI models. We share only pseudo-anonymized data consisting of the student's first name, grade level, and historical answer accuracy (e.g., scores, time taken, hint usage).
No Sensitive PII: We never share full names, email addresses, contact information, or any other sensitive personal identifiable information (PII) with AI providers.
Zero Data Training Policy: We utilize enterprise-tier API agreements with our AI providers which explicitly prohibit them from using your or your child's data to train or improve their public AI models. Your child's data remains private and is deleted from their servers after processing.
AI-generated content is for educational purposes only and does not replace professional academic guidance.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make material changes:
We will update the "Last updated" date at the top of this policy
We will send an email notification to registered parent accounts
We will display a prominent notice within the Service
Where required by COPPA, we will obtain renewed parental consent for any material changes affecting children's data
Your continued use of the Service after changes become effective constitutes acceptance of the updated policy.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: