Privacy Policy

This Privacy Policy establishes how EduVerse™ ("Platform", "we", "us") collects, processes, stores, and protects personal data of users ("you", "User") in accordance with the Information Technology Act 2000 (India), the Indian IT (Amendment) Act 2008, GDPR (for EU/EEA users), and COPPA (for users under 13).

This document is issued under the EduVerse™ Total Quality Management (TQM) framework and is subject to periodic review as required by ISO 9001:2015 §9.3.

This policy applies to:

• All registered users — students, tutors, administrators, and owners
• Visitors who access the platform without registration
• All personal data collected via web, mobile, or API interfaces
• All personnel and third-party processors handling EduVerse™ user data

4.1 — Account & Identity Data

• Full name, email address, and password (hashed via Firebase Auth)
• Profile photo and display name
• Date of birth and age verification data
• Parent/guardian name and contact (for users under 18)
• Educational information: grade, board, subjects, school name, city, country

4.2 — OAuth Provider Data

When signing in via Google OAuth, we receive:

• Email address and public profile (name, photo)
• OAuth tokens (stored securely in Firebase Auth; never exposed to client)

4.3 — Technical & Usage Data

• IP address and geolocation (country, city, coordinates) — collected under EUWA §3
• IANA timezone identifier — collected under EUWA §4
• Browser user agent, device type, and operating system
• Login timestamps, session duration, and navigation events
• Learning progress, test scores, and assignment submissions
• Payment transaction references (no raw card data — processed by third parties)

4.4 — Consent Records

Clickwrap consent metadata is stored per EVP-CLP-01, including timestamp, IP, user agent, agreement version, and verbatim consent statement text.

• To create and manage your account and authenticate your identity
• To provide personalised educational services and tutor matching
• To display accurate session schedules in your local timezone
• To process payments, issue invoices, and maintain financial records
• To send critical platform notifications (session reminders, account alerts)
• To maintain legally required consent audit logs (EVP-CLP-01)
• To comply with legal obligations and respond to lawful authority requests
• To detect fraud, abuse, and security threats
• To improve the platform based on usage analytics (aggregated/anonymised)

We do NOT sell, rent, or commercially license your personal data to any third party.

No data is shared with advertisers, data brokers, or any other commercial third parties.

EduVerse™ implements industry-standard technical and organisational measures:

• Encryption in transit: TLS 1.2+ for all API and web traffic
• Encryption at rest: Firebase/Google Cloud AES-256 encryption
• Authentication: Firebase Auth with OAuth 2.0; WebAuthn passkey support
• Consent records: Append-only Firestore collection with no admin override
• Access control: Role-based access (student / tutor / owner) enforced server-side
• Firestore Security Rules: Per-user document access restrictions

No security system is infallible. In the event of a data breach affecting your rights, we will notify affected users within 72 hours of discovery as required by GDPR Art. 33.

• Users under 13 years require verifiable parental consent before registration (COPPA §312.5).
• Users aged 13–17 may register with guardian awareness; parental oversight is facilitated via progress reports.
• We collect only data strictly necessary for the provision of educational services to minors.
• We do not display targeted advertising to users under 18.
• Parental consent records are retained per EVP-CLP-01 §8.

We do not use third-party advertising cookies or cross-site tracking pixels. You can clear cookies via your browser settings; this will require re-authentication.

EduVerse™ data is stored and processed on Google Cloud / Firebase infrastructure which operates globally. For transfers outside the EEA, Google applies Standard Contractual Clauses (SCCs) as an appropriate safeguard under GDPR Art. 46. By accepting the EUWA, you acknowledge and consent to such transfers.

We may update this policy periodically. When material changes are made — particularly those affecting data collection scope, purpose, or user rights — users will be notified by email and/or required to re-consent via the EUWA mechanism. The version and effective date are tracked in the Document Control block above.

We aim to respond to all data rights requests within 30 days of receipt.