Privacy Policy

1. Introduction

This Privacy Policy explains how Ednaimo collects, uses, stores, and protects information through the Ednaimo platform. Ednaimo is an AI-powered adaptive learning platform designed for children ages 2 to 16.

We are committed to protecting the privacy of children and their families. This policy complies with the Nigerian Data Protection Regulation (NDPR), the Children's Online Privacy Protection Act (COPPA), and other applicable data protection laws.

By creating an account on Ednaimo, you (the parent or legal guardian) agree to the practices described in this Privacy Policy. If you do not agree with this policy, please do not use the Platform.

2. Who Uses the Platform

Ednaimo is intended for use by parents and legal guardians who manage learning experiences for their children (ages 2-16). Children do not create accounts. All accounts are created and managed by parents or guardians, who add child profiles under their own account.

3. Information We Collect

3.1 Parent / Guardian Information

When you create an account, we collect:

• Email address: used for authentication and account communications
• Authentication credentials managed securely through Firebase Authentication (Google)

3.2 Child Profile Information

When you add a child profile to your account, we collect:

• First name only: used to personalize the learning experience; we do not collect last names, photos, or other identifying information for children
• Age: used to select age-appropriate content
• Grade level: used to calibrate lesson difficulty

3.3 Learning and Usage Data

As your child uses the Platform, we collect:

• Learning progress: lesson completions, quiz scores, skill mastery levels, and curriculum progression
• Engagement telemetry: COPPA-safe interaction data limited to quadrant-level heatmaps (e.g., which region of the screen a child interacted with); this data contains no personally identifiable information
• Session logs: timestamped records of learning activity, anonymized using a SHA-256 hashed child token

3.4 What We Do Not Collect

We do not collect:

• Children's last names, photos, or videos.
• Precise location data or IP-based geolocation.
• Contact information for children.
• Behavioral data for advertising purposes.
• Data from third-party tracking or analytics services.

4. How We Use Your Information

We use collected information solely for the following purposes:

We do not use any collected data for behavioral advertising, profiling for marketing, or any purpose unrelated to the educational services described above.

5. AI Processing Disclosure

Ednaimo uses artificial intelligence to generate and adapt educational content for children. Specifically:

• AI models used: Google Gemini models, accessed through Google Vertex AI
• What AI does: Generates age-appropriate lessons, quizzes, and explanations tailored to each child's grade level and learning progress
• What AI receives: Child's age, grade level, and learning progress data (no names or identifying information are sent to the AI model)
• What AI does not do: The AI does not make decisions about children beyond educational content adaptation. It does not profile children for non-educational purposes.

AI-generated content is designed to supplement, not replace, structured curriculum standards.

6. Data Storage and Security

6.1 Where Data Is Stored

All data is stored on Google Cloud Platform (GCP) in the Africa-South 1 region (Johannesburg, South Africa). This region was selected to minimize latency for Nigerian users and to keep data within the African continent.

6.2 Data Retention

• Session logs: Automatically deleted after 30 days (time-to-live policy)
• Child tokens in session logs: Anonymized via SHA-256 hashing before storage
• Account data (parent and child profiles): Retained until you delete your account or request deletion
• Learning progress data: Retained as long as the associated child profile exists

6.3 Security Measures

We implement the following security measures to protect your data:

• Encryption in transit (TLS/HTTPS for all communications)
• Encryption at rest (GCP default encryption for stored data)
• Firebase Authentication for secure account access
• Role-based access controls limiting internal data access
• Regular security reviews of infrastructure and application code

7. Children's Privacy (COPPA Compliance)

We take children's privacy seriously and comply with the Children's Online Privacy Protection Act (COPPA).

7.1 Parental Consent

Before any child data is collected, we require verifiable parental consent through one of the following methods:

• Credit card micro-transaction: A $0.50 USD charge is placed on the parent's credit card and subsequently refunded. This transaction serves solely to verify parental identity.
• Signed consent form: A physical or electronic consent form signed by the parent or guardian and submitted to us for verification.

7.2 Parental Controls

Parents and guardians have full control over their children's data:

• Review: View all data associated with your child's profile at any time through the parent dashboard
• Delete: Remove a child's profile and all associated data at any time
• Refuse further collection: Remove your child from the Platform, which stops all future data collection for that child
• Export: Download your child's learning data through the parent dashboard

7.3 Limited Collection

We collect only the minimum data necessary to provide the educational service. Children never interact with the Platform without a parent-managed profile, and children cannot independently provide personal information.

8. Cookies and Tracking

Ednaimo uses essential cookies only:

• Session cookies: required for authentication and maintaining your logged-in state

We do not use:

• Advertising or marketing cookies
• Third-party tracking cookies
• Analytics cookies from external providers
• Social media tracking pixels

9. Data Sharing and Third Parties

We do not sell, rent, or share personal data with third parties for their own purposes. Data is shared only with the following service providers, solely to operate the Platform:

These providers act as data processors under our instructions and are bound by their own privacy and security commitments. No data is shared with advertisers, data brokers, or any other third parties.

10. Your Rights Under the NDPR

Under the Nigeria Data Protection Regulation (NDPR), you have the following rights:

• Right of Access: Request a copy of all personal data we hold about you and your children
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data and your children's data
• Right to Data Portability: Export your data in a structured, machine-readable format via the parent dashboard
• Right to Object: Object to specific processing of your data
• Right to Restrict Processing: Request that we limit how we process your data

How to Exercise Your Rights

You can exercise most of these rights directly through the parent dashboard, including data export and child profile deletion. For other requests, contact us at operations@ednaimo.com.

We will respond to all data rights requests within 30 days of receipt.

11. International Data Considerations

Ednaimo is operated for users in Africa and data is stored in South Africa (GCP africa-south1 region). AI processing through Google Vertex AI may involve data transit through Google's infrastructure. We ensure that all data processing complies with the NDPR's requirements for cross-border data transfers, including appropriate safeguards and contractual protections.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the "Last Updated" date at the top of this document
• We will notify you via email (using the address associated with your account)
• Continued use of the Platform after notification constitutes acceptance of the updated policy

If changes affect how we handle children's data, we will obtain fresh parental consent where required.

13. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your information, please contact us:

Email: operations@ednaimo.com