Privacy Policy

Edunities Sdn Bhd

This Privacy Policy explains how Edunities Sdn Bhd (Edunities) collects, uses, discloses, stores and protects personal data when the user uses the "Edunities" mobile application, Edunities web application and/or related educational services, and any further Services introduced in the future (collectively, the "Service").

Applicability

This Privacy Policy applies to all users of the Service ("Users"), including students, parents or guardians, and any other person who accesses the Service.

Personal Data Edunities Collects

Depending on how the Service is used, Edunities collects and/or generates the following categories of personal data:

• Account: email address; a display handle; the User's first name and last name; and a profile photo or avatar where one is provided by the User.
• Academic and demographic profile: birth year (and an age band derived from it), school level, school year or form, and the school selected or entered.
• Learning preferences: the role selected (such as student or parent), selected subjects, stated learning motivations, a daily study-time goal, and how the User heard about the Service.
• Learning activity and progress: lessons attempted and completed, quiz and test scores, time spent, number of attempts, and a record of questions answered incorrectly (used to provide review features).
• Gamification data: in-app hearts, diamonds, streaks, experience points, levels and the related transaction history that supports these features.
• Subscriptions and payments: subscription status and plan, store transaction identifiers and receipts supplied by the applicable app store, and any access code or discount code redeemed. Edunities does not collect or store payment card numbers; card payments are handled entirely by the applicable app store or payment provider.
• Communications and reports: information a User includes in an email or support enquiry sent to Edunities, and any in-app report a User submits about a question.
• Notification preferences: the User's reminder and notification settings.

Where the Data Comes From

Edunities receives the account, profile, onboarding and preference data described above directly from the User during registration, sign-in, onboarding and account management. Where the User signs in with Google or Apple, Edunities receives certain account information from that provider. Learning activity, progress and gamification data are generated as the User uses the Service. Subscription status and transaction references are received from the relevant app store or payment provider.

How Edunities Uses Personal Data

Edunities processes personal data only for purposes connected with operating, protecting, funding and improving the Service, including to:

• register, authenticate, sign in, secure and administer accounts;
• provide lessons, quizzes, audio, images, progress tools, and other educational and gamification functions;
• communicate essential account, security, subscription and policy information;
• use the selected school, school level and aggregated usage trends to research, plan and improve educational content;
• serve advertising to users who are not subscribers, and measure delivery of that advertising on an aggregate basis;
• process subscriptions, confirm entitlement, prevent payment or account fraud, and investigate misuse;
• respond to enquiries and provide support;
• comply with legal obligations, lawful requests, and the enforcement or defence of legal rights; and
• create aggregated or de-identified statistics that do not reasonably identify an individual.

If Edunities wishes to use personal data for a materially different purpose, Edunities will provide an additional notice and obtain consent where required.

Advertising

The Service is funded in part by advertising shown to Users who do not hold a subscription. Advertising is delivered through Google as interstitial ads and rewarded ads.

Edunities serves non-personalised advertising only. Edunities does not build advertising profiles of Users, does not use personal data to target ads, and does not request permission to track Users across other apps or websites.

Children and Parental or Guardian Involvement

For this Policy, a "Child User" is a User under 18 years of age, reflecting the age of majority under the Age of Majority Act 1971, subject to any applicable statutory exception. The Service is intended for school students and is therefore used by Child Users. A Child User may use the Service only with the consent and supervision of a parent or legal guardian.

Advertising shown to Child Users who are not subscribers is limited to non-personalised advertising, and Edunities does not build advertising profiles of Child Users. Edunities does not sell or rent children's personal data.

A parent or legal guardian may contact Edunities to request access to, correction of, or deletion of a child's personal data, subject to applicable law and reasonable verification of identity and authority.

Analytics and Technologies

Edunities uses analytics to understand aggregate use of the Service and to research which subjects, school levels and content should be improved or developed. The Service and its providers may use local storage, software development kits and similar technologies necessary for sign-in, security, subscriptions, analytics and advertising; on the web, cookies may also be used. Disabling a necessary technology may affect the relevant feature.

Edunities does not itself collect device GPS location and does not derive a User's location from an IP address within the application. A User's general location is known only from the state entered in the profile and the school selected during registration or account management. Edunities' hosting, payment and advertising providers may process IP addresses at the network level as part of delivering, securing and measuring the Service, in accordance with their own terms.

Artificial Intelligence

Edunities may use artificial intelligence ("AI") tools to help draft lessons, questions, explanations, images or other content. Edunities reviews and may amend that material against its educational and quality requirements before it is made available to Users.

AI tools are used in an internal content-production workflow and not to make decisions that produce legal or similarly significant effects on a User. Edunities does not send User personal data or User inputs to an AI provider as part of this workflow and does not use such data or inputs to train an AI model.

When Edunities Discloses Personal Data

Edunities discloses personal data only as reasonably necessary to:

• cloud hosting, database, analytics, advertising, email, customer-support and security service providers that process data for Edunities under appropriate contractual and security requirements (including the Service's backend, authentication and advertising providers);
• sign-in providers (Google and Apple) where the User chooses to authenticate through them;
• any application store, subscription-billing or payment provider, for billing, entitlement, chargeback and fraud-prevention purposes;
• professional advisers, insurers, auditors, prospective investors or transaction parties, under duties of confidentiality;
• courts, regulators, law-enforcement bodies or other authorities where required or permitted by law.

Edunities does not sell or rent personal data. Advertising is handled on a non-personalised basis as described above.

Transfers Outside Malaysia

Some service providers may process or store personal data outside Malaysia. Where personal data is transferred across borders, Edunities will take reasonable steps to ensure an appropriate level of protection and will rely on a lawful basis and any applicable safeguards necessary to maintain that standard of protection.

Data Retention and Deletion

Edunities retains account and related personal data while an account remains active. A User may delete their account from within the Service; on deletion, Edunities removes the account and its linked personal data from the live database through a server-side cascade. Where an account is otherwise closed, cancelled, expired or subject to a valid deletion request, Edunities will generally delete, destroy or irreversibly de-identify the personal data within 60 days.

Certain limited records may be retained longer where required by law, or reasonably necessary to establish, exercise or defend legal claims, resolve disputes, prevent fraud or investigate serious misuse. Aggregated or de-identified data that does not reasonably identify an individual may be retained.

Security and Data Breaches

Edunities uses reasonable organisational, technical and physical measures appropriate to the nature of the data, including access controls and row-level access restrictions so that Users can generally access only their own data, authentication, encryption where appropriate, secure development practices, backups, staff confidentiality and vendor oversight. No system is completely secure, and Users should protect their credentials and notify Edunities of any suspected unauthorised access.

If a personal data breach occurs, Edunities will take reasonable steps to address it and will notify the relevant authorities and affected Users where required.

Users' Rights

Subject to applicable law and any additional rights the law provides, Users may:

• know the personal data collected from them;
• request correction or updating of inaccurate or incomplete data;
• withdraw consent or request that certain processing be limited;
• object to marketing and opt out of any personalised advertising where available;
• request deletion of an account or data where applicable; and
• request data portability where technically feasible and required by law.

Required and Optional Information

Fields marked as required are needed to create or operate the relevant account or feature; if required information is not provided, Edunities may be unable to create the account or provide that feature. Optional information may be withheld without losing access to unrelated functions.

Third-Party Services and Links

The Service may link to or integrate with third-party services, including sign-in, payment, hosting and advertising providers. Their privacy practices are governed by their own notices. Edunities is not responsible for a third party's independent processing but remains responsible for its own obligations when appointing a processor or disclosing data.

Privacy Policy Updates

Edunities may update this Policy to reflect changes to the Service, its data practices or the law. Edunities will post the revised Policy with a new effective date and, where required for a material change, provide additional notice and seek consent.

Contact

Enquiries relating to Edunities Sdn Bhd may be sent to:
Email: support@edunities.com