Privacy Policy

Spark Finity AI (“we”, “us” or “our”) is an AI-powered educational technology company that teaches school syllabi and curricula to students using artificial intelligence. Our platform delivers personalised learning experiences aligned with national and international school boards, serving students and educators primarily across India, the Asia-Pacific region, and worldwide.

This Privacy Policy explains how we collect, use, store, share and protect your personal information when you use our website, application and related services (collectively, the “Platform”).

If you are a parent or guardian reading this on behalf of a student, please read Section 7 (Children's Privacy) carefully. Our platform serves school-age children and we take their privacy with the utmost seriousness.

Account and registration data:

• Full name, email address and password (hashed)
• Date of birth and grade/class level
• School name and location (city/state/country)
• Parent or guardian name and contact details (for users under 18)
• Profile photo (optional)

Learning and academic data:

• Subjects selected and lessons completed
• Quiz scores, test results and performance analytics
• Time spent on each topic, chapter or lesson
• AI-generated assessments and personalised recommendations
• Notes, assignments and content created on the platform
• Interaction history with the AI tutor

Technical and device data:

• IP address and approximate geographic location
• Device type, operating system and browser version
• App version and unique device identifiers
• Log files, session data and crash reports
• Cookies and similar tracking technologies (see our Cookie Policy)

Communications data: messages and support tickets, feedback, reviews, survey responses and email correspondence with Spark Finity AI.

Payment data: billing name and address, transaction history and subscription plan details. We do not store raw payment card details — all payment processing is handled by certified, PCI-DSS compliant third-party gateways such as Razorpay or Stripe.

We do not collect sensitive personal data such as biometric data, racial or ethnic origin, political opinions, religious beliefs, health records or sexual orientation. We will never sell your personal data to third parties.

We process personal data only for specific, legitimate purposes:

We do not sell, rent or trade your personal data. We share it only in these limited circumstances:

• Service providers (data processors) — cloud hosting (AWS, Google Cloud), payment processors (Razorpay, Stripe), analytics providers, email and notification services and customer support software. All are contractually bound to process data only on our instructions.
• Educational partners — where we work with a school, we may share anonymised or aggregated performance reports with authorised teachers and administrators. Individual student data is shared only with the school a student is enrolled through.
• Legal and regulatory requirements — where required by applicable law, court order or government authority, or to protect the rights, property or safety of Spark Finity AI, our users or the public.
• Business transfers — in a merger, acquisition or restructuring, data may transfer to the successor entity under the same protections.

Because we serve learners worldwide, personal data may be stored or processed outside your country of residence. Where data leaves the EU/EEA or India, we rely on appropriate safeguards such as Standard Contractual Clauses and equivalent contractual protections with our processors.

Spark Finity AI is an educational platform for school students. A significant portion of our users are minors under 18. We have designed special protections for young learners.

Age thresholds and consent:

• Users under 13 (globally): verifiable parental or guardian consent is required before account creation, and we collect only the minimum data necessary.
• Users 13–17 in India: consent is obtained from a parent or guardian in accordance with the DPDP Act, 2023.
• Users 13–16 in the EU/EEA: parental consent is required under GDPR Article 8.
• Users 13–17 in the US: we comply with COPPA requirements.

What we do differently for minors:

• No behavioural advertising cookies for users under 13
• No sharing of student data with advertising networks
• AI tutor interactions are safe, age-appropriate and curriculum-focused
• Content moderation prevents exposure to inappropriate material
• Account creation for children requires parent/guardian verification

Parents and guardians may at any time review the personal data held about their child, correct or update inaccurate information, request deletion of the account and data, and withdraw consent.

When personal data is no longer required we securely delete or anonymise it. Deletion requests are processed within 30 days, subject to any legal holds.

Technical measures:

• AES-256 encryption for data at rest
• TLS 1.3 encryption for all data in transit (HTTPS)
• Multi-factor authentication for admin access
• Regular automated vulnerability scanning and penetration testing
• Strict access controls based on least privilege
• Secure software development lifecycle practices

Organisational measures:

• Privacy-by-design integrated into product development
• Regular staff training on data protection and security
• Data Protection Impact Assessments for high-risk processing
• Incident response plan with defined escalation procedures

Under GDPR (EU/EEA users) you have the right to:

• Access, rectification and erasure of your personal data
• Restriction of processing and data portability
• Object to processing based on legitimate interests or direct marketing
• Withdraw consent at any time, without affecting prior lawful processing
• Lodge a complaint with your national Data Protection Authority

Under India's DPDP Act, 2023 you have the right to:

• Access information about the personal data being processed
• Correction, completion, updating or erasure of personal data
• Grievance redressal through our Grievance Officer
• Nominate a representative in case of death or incapacity

We also honour equivalent rights under Singapore's PDPA, Australia's Privacy Act 1988, South Korea's PIPA and other regional frameworks. To exercise any right, email privacy@sparkfinityai.com — we respond within 30 days and may need to verify your identity first.

Our AI assesses areas of strength and weakness to generate customised study plans. Some recommendations (such as which topic to study next) constitute automated decision-making; they are designed to assist learning and do not produce significant legal effects. Where GDPR applies, you may request human review of any automated decision that significantly affects you.

Our AI tutors are purpose-built for education and trained to provide curriculum-appropriate content only. We do not use student interaction data to train general-purpose commercial AI models without explicit consent.

Our platform may link to third-party websites, educational resources or embedded content. This policy does not apply to those external sites and we are not responsible for their privacy practices.

We may update this Privacy Policy to reflect changes in law, technology or business practice. When we make material changes we update the effective date, post a prominent notice, and notify registered users where required by law.

• Privacy and data team: privacy@sparkfinityai.com
• Grievance Officer (India): grievance@sparkfinityai.com
• EU representative (GDPR): gdpr@sparkfinityai.com

You may also lodge a complaint with your local data protection authority:

• India: Ministry of Electronics & IT (MeitY) / Data Protection Board of India
• EU: your national Data Protection Authority (e.g. CNIL, BfDI)
• UK: Information Commissioner's Office — ico.org.uk
• Australia: Office of the Australian Information Commissioner — oaic.gov.au
• Singapore: Personal Data Protection Commission — pdpc.gov.sg

This Privacy Policy was last reviewed and approved on 27 August 2026 and should be read alongside our Cookie Policy.