Privacy Policy

This Privacy Policy explains how EnlightEd ("we", "us", "our") collects, uses, stores, and protects information about you when you use our AI-powered adaptive learning platform. We comply with India's Information Technology Act, 2000, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 (DPDP Act).

By visiting our website, creating an account, or using any feature of the EnlightEd platform, you agree to this Privacy Policy together with our Terms of Service. This Policy applies to:

• Students (Classes 6–10) who access learning content, take practice tests, and receive personalised study plans — always with parental consent • Parents and Guardians who register on behalf of their child, manage accounts, and access progress reports • General visitors to our website who may browse content or contact us without creating an account

If you do not agree with this Policy, please do not use the platform. Continued use after any update to this Policy constitutes your acceptance of the revised version.

We collect and process personal data only where necessary to provide our services. The data we collect may include:

• Account Information: Name, email address, class/grade, board (CBSE/ICSE), school name (optional) • Learning Data: Quiz answers, test scores, topic progress, time spent per module, adaptive learning path • Device & Usage Data: Browser type, device type, IP address, pages visited, session duration • Communication Data: Messages sent to support, feedback forms, email interactions • Payment Data: Transaction ID, plan selected — processed by third-party payment gateway; we do not store card details

Minimal Collection Principle: We collect only the data strictly necessary to personalise your learning experience and operate the platform. We do not collect sensitive personal data like biometrics, government IDs, financial records, or health information.

We use the data we collect for the following clearly defined purposes:

• Adaptive Learning: Personalise content difficulty, generate custom study plans, and adjust the learning path for each student's pace • Progress Tracking: Give students clear visibility into their growth and give parents meaningful performance reports • Platform Operation: Manage accounts, authenticate logins, process batch purchases, and ensure technical reliability • Customer Support: Respond to queries, resolve issues, and improve service based on feedback • Safety & Security: Detect and prevent misuse, maintain content age-appropriateness, and protect all users • Platform Improvement: Use anonymised, aggregated data to improve features — individual users are never identifiable in this analysis • Legal Compliance: Meet obligations under the DPDP Act, IT Act, Consumer Protection Act, and other applicable Indian law

What We Never Do: We never sell, rent, or trade your personal data. We never use student data to serve targeted advertisements. We never build commercial profiles of students. We never share data with third parties for their own marketing purposes.

We do not sell personal data of students or parents to any third party. We may share limited, necessary data only in the following situations:

• Service Providers: Trusted vendors who help us operate the platform (cloud hosting, analytics, payment processing). These vendors are contractually bound to process data only for agreed purposes, maintain confidentiality, and follow security standards equivalent to our own. • Legal Obligations: Where required by Indian law, a court order, or a government or regulatory authority, we may disclose data to comply with our legal obligations. • Safety Situations: If we have reason to believe that disclosure is necessary to protect the safety of a student, another person, or the public, we may share information with appropriate authorities. • Business Transfers: If EnlightEd merges with, is acquired by, or transfers its assets to another entity, user data may form part of that transfer. We will notify all affected users at least 30 days in advance.

Where data is processed or stored on servers outside India, we ensure it is subject to appropriate contractual safeguards in compliance with applicable cross-border data protection obligations.

EnlightEd is designed for students aged approximately 11–16 years (Classes 6–10). Because our primary users are minors, we apply the highest standard of care to their data under the Digital Personal Data Protection Act, 2023 (DPDP Act).

Parental Consent is Mandatory: A parent or legal guardian must register on behalf of the student, review both this Privacy Policy and the Terms of Service, and provide verifiable consent before the child's account is activated. By completing registration, the parent/guardian confirms they are the lawful guardian and consents to the processing of the student's data as described in this policy.

• Students under 18 cannot register independently — parental registration is required • We do not serve behavioural or targeted advertising to students • We do not profile students for commercial purposes • Parents can view, update, or request deletion of their child's data at any time • We apply data minimisation — only data directly relevant to learning outcomes is collected from students • Age verification is performed at registration; accounts that misrepresent age will be suspended • We do not collect advertising identifiers or hardware identifiers from student devices

We implement industry-standard technical and organisational measures to protect personal data:

• Encryption of data in transit (TLS/HTTPS) and at rest • Access to personal data restricted to authorised EnlightEd personnel on a strict need-to-know basis • Regular security reviews of our infrastructure and third-party service providers • Incident response procedures — in the event of a breach, affected users and relevant authorities will be notified within timelines required by the DPDP Act

No digital system can guarantee absolute security. We encourage users to use strong, unique passwords and to never share account credentials.

Under the DPDP Act 2023 and applicable Indian law, you (and parents on behalf of their child) have the following rights:

• Right to Access: Request a copy of the personal data we hold about you or your child • Right to Correction: Request correction of inaccurate or incomplete account or profile data • Right to Erasure: Request deletion of your or your child's personal data, subject to legal retention requirements • Right to Withdraw Consent: Withdraw consent for data processing at any time; note that this may affect access to platform features • Right to Grievance Redressal: Raise a complaint with us at support@enlighted.co.in, or escalate to the Data Protection Board of India

To exercise any of these rights, write to support@enlighted.co.in. We will acknowledge within 7 days and respond fully within 30 days.

• On our website, we use cookies and similar technologies for session management, remembering preferences, analytics, and essential functionality • We do not use advertising or cross-site tracking cookies • Analytics tools are configured to anonymise IP addresses; we do not build individual user profiles for marketing • Parents and general users may disable or manage cookies through their browser settings — some platform features may be affected

• Active accounts: Data is retained for as long as the account remains active and the parent-student relationship is maintained on the platform • Account deletion: When a parent requests account deletion, personal data is securely deleted or anonymised within 90 days, subject to any legal or regulatory retention requirements • Purchase records: Transaction records are retained for 7 years as required under Indian financial and tax regulations • Support communications: Retained for up to 2 years for quality and compliance purposes • Anonymised learning data: May be retained indefinitely in aggregated, de-identified form to improve the platform

To request deletion or export of your data, email support@enlighted.co.in. We will respond within 30 days in accordance with the DPDP Act 2023.

We may update this Privacy Policy from time to time to reflect new features, legal or regulatory changes, or improvements to our security practices. When we do:

• The updated version will be published on our website with a revised "Last Updated" date • For material changes, we will notify registered parents via email at least 14 days before the changes take effect • Continued use of the platform after the notice period constitutes acceptance of the revised policy

This Privacy Policy is governed by the laws of India. Any disputes arising from or relating to this policy will be subject to the jurisdiction of the courts of Tamil Nadu, India, consistent with our Terms of Service.

If you have any questions, concerns, or grievances about this Privacy Policy or our data practices, please contact us. As required under the IT Act, 2000, we have designated a Grievance Officer to address your concerns.

Platform: EnlightEd Email: support@enlighted.co.in

Additional Compliance: • Digital Personal Data Protection Act, 2023 (DPDP Act) — Ministry of Electronics & IT, India • Information Technology Act, 2000 and SPDI Rules, 2011 • Consumer Protection Act, 2019 and Consumer Protection (E-Commerce) Rules, 2020