Translation Notice

This page has been translated for your convenience. The English version is the legally binding document. In case of any discrepancies, the English version shall prevail.

Comprehensive Privacy Policy

Last Updated: August 1, 2025

Effective Date: August 1, 2025

IMPORTANT PRIVACY NOTICE:

This Privacy Policy explains how Wisdom Link AI Limited ("we," "us," "our") collects, uses, processes, and protects your personal information when you use our EduQ AI educational platform and related services ("Service").

By using our Service, you acknowledge that you have read, understood, and agree to this Privacy Policy and our data processing practices.

SPECIAL NOTICE FOR PARENTS & GUARDIANS:

We are committed to protecting children's privacy. Special protections apply to users under 13 years of age in compliance with COPPA (Children's Online Privacy Protection Act) and similar international regulations. Please review Section 8 carefully.

AI DATA PROCESSING NOTICE:

Our Service uses artificial intelligence technology powered by SambaNova Systems and AWS Bedrock. Your interactions with AI features are processed to provide educational services. Your chat messages and interactions are NOT used to train AI models. See Section 4 for detailed information about AI data processing.

1. Company Information & Scope

a. Data Controller

Company: Wisdom Link AI Limited

Service: EduQ AI Educational Platform

Business Registration: Hong Kong SAR

Contact: info@eduq-ai.com

Website: www.eduq-ai.com

b. Policy Scope

This Privacy Policy applies to:

EduQ AI Platform: Web application, mobile apps, and related services
All Users: Students, parents, educators, and administrators worldwide
All Data: Personal information, educational content, usage data, and AI interactions
Third-Party Services: Integrated services like SambaNova AI, AWS, and payment processors

c. Legal Basis for Processing

We process personal data based on:

Consent: When you agree to our data processing practices
Contract Performance: To provide educational services you've requested
Legitimate Interest: To improve our services and ensure security
Legal Obligation: To comply with applicable laws and regulations
Parental Consent: For users under the age of digital consent

2. Information We Collect

📊 DATA COLLECTION SUMMARY:

We collect only the minimum data necessary to provide educational services. All data collection is transparent, purposeful, and subject to your control.

a. Account & Profile Information

Information you provide directly:

Basic Profile: Name, email address, date of birth, profile picture (optional)
Educational Context: School/institution, grade level, subjects of interest, learning goals
Account Preferences: Language settings, notification preferences, accessibility options
Parent/Guardian Information: Contact details for users under 18 (required for COPPA compliance)
Payment Information: Billing details processed securely through third-party payment processors

b. Educational Content & Performance Data

Learning-related information:

Submitted Content: Homework, assignments, worksheets, and documents you upload
AI Interactions: Questions asked, responses received, chat transcripts with AI tutor
Performance Metrics: Quiz scores, completion rates, time spent on activities
Learning Progress: Skill assessments, knowledge gaps, improvement trends
Study Materials: Notes, bookmarks, saved resources, custom study plans
Assessment Results: Test scores, feedback, recommendations for improvement

c. Technical & Usage Data

Automatically collected information:

Device Information: Device type, operating system, browser version, screen resolution
Connection Data: IP address, internet service provider, connection type
Usage Analytics: Pages visited, features used, time spent, click patterns
Performance Data: Load times, error reports, crash logs, system performance
Location Data: General location (country/region) for service optimization
Cookies & Tracking: Session cookies, preference cookies, analytics cookies

d. AI-Specific Data Collection

🤖 AI DATA PROCESSING:

When you interact with our AI features powered by SambaNova:

Chat Conversations: Full transcripts of AI tutoring sessions
Learning Patterns: How you interact with AI responses and follow-up questions
Content Analysis: AI processing of your uploaded documents and assignments
Response Quality: Feedback on AI responses to improve service quality
Usage Patterns: Frequency and types of AI interactions

e. Communications & Support Data

When you contact us:

Support Requests: Help tickets, bug reports, feature requests
Email Communications: Messages sent to/from our support team
Feedback & Surveys: User experience feedback, satisfaction surveys
Community Interactions: Forum posts, comments, peer interactions (if applicable)

f. Third-Party Data Sources

Information from external sources:

Educational Institutions: Student rosters, grade information (with permission)
Parent/Guardian Accounts: Family account linking and supervision data
Social Login: Basic profile information if you sign in with Google/Apple (optional)
Payment Processors: Transaction status and billing information

3. How We Use Your Information

🎯 PURPOSE LIMITATION PRINCIPLE:

We use your data only for the specific purposes outlined below. We do not sell, rent, or trade your personal information to third parties for marketing purposes.

a. Core Educational Services

Primary service delivery:

Personalized Learning: Adapt content difficulty and style to your learning preferences
AI Tutoring: Provide intelligent responses and educational guidance
Progress Tracking: Monitor learning progress and identify areas for improvement
Content Generation: Create customized practice materials and assessments
Performance Analytics: Generate reports for students, parents, and educators
Skill Assessment: Evaluate knowledge levels and recommend learning paths

b. Account Management & Support

Service administration:

Account Creation: Set up and maintain user accounts and profiles
Authentication: Verify user identity and secure account access
Customer Support: Respond to help requests and resolve technical issues
Billing & Payments: Process subscription payments and manage billing
Communication: Send service updates, educational content, and important notices
Parental Controls: Enable parent/guardian oversight for minor accounts

c. Service Improvement (Anonymized Analytics Only)

🤖 AI DATA USAGE POLICY:

Your chat messages and AI interactions are NOT used to train AI models. Chat transcripts sent to third-party AI providers (SambaNova, AWS Bedrock) are subject to those providers' data processing agreements and are not retained by those providers for model training purposes.

We use only anonymized, aggregated usage analytics (not chat content) to improve our service:

Usage Patterns: Anonymized feature usage statistics to improve platform design
Error Correction: Identify and fix technical issues
Feature Development: Understand which features are most useful

Your Control: You can opt out of analytics at any time in your account settings.

d. Platform Security & Safety

Security and compliance:

Fraud Prevention: Detect and prevent unauthorized access and misuse
Content Moderation: Monitor for inappropriate content and behavior
System Security: Protect against cyber threats and data breaches
Compliance Monitoring: Ensure adherence to educational and privacy regulations
Audit & Investigation: Investigate policy violations and security incidents

e. Research & Analytics (Anonymized)

📚 ANONYMIZED ANALYTICS:

We use anonymized, aggregated data (never personal chat content) for service improvement:

Learning Science Research: Study effective teaching methods and learning patterns using anonymized aggregate data
Product Development: Develop new features and educational tools
Performance Optimization: Improve platform speed and reliability

Important: Uploaded documents are processed by AWS Textract for educational purposes and original files are deleted within 24 hours of processing. Chat messages are never used for AI model training.

f. Legal & Regulatory Compliance

Legal obligations:

COPPA Compliance: Protect children's privacy and obtain parental consent
Data Protection Laws: Comply with GDPR, CCPA, and other privacy regulations
Educational Regulations: Meet requirements for educational technology providers
Legal Requests: Respond to valid legal process and government requests
Terms Enforcement: Enforce our Terms of Service and community guidelines

4. Third-Party Data Sharing & AI Processing

🔗 THIRD-PARTY DISCLOSURE:

We share data with carefully selected third-party service providers to deliver our educational services. All third parties are contractually bound to protect your data.

a. AI Provider Disclosure

🤖 AI PROVIDER DISCLOSURE:

Our AI tutoring features are powered by third-party large language model providers, including SambaNova Systems and AWS Bedrock. When you use AI features:

Data Shared: Your questions, subject context, grade level, and learning context (not personal identifiers or payment data)
Processing Purpose: Generate educational responses and tutoring guidance
No Model Training: Chat messages sent to AI providers are NOT used for model training and are subject to those providers' data processing agreements
Data Not Shared: Personal identifiers, payment data, or other students' data are never sent to AI providers
Retention: AI providers do not retain your personal data after processing

Your Control: You can opt out of AI features at any time in your account settings.

b. Essential Service Providers

Infrastructure and core services:

Amazon Web Services (AWS): Cloud hosting, data storage, and computing services
Payment Processors: Secure payment processing for subscriptions (Stripe, PayPal, etc.)
Email Services: Transactional emails and notifications
Content Delivery Networks: Fast and secure content delivery worldwide
Analytics Providers: Usage analytics and performance monitoring (anonymized)

c. Educational Partners

With your explicit consent:

Schools & Institutions: Progress reports and performance data for enrolled students
Parent/Guardian Accounts: Learning progress and activity summaries
Educational Content Providers: Curriculum alignment and content recommendations
Assessment Partners: Standardized test preparation and scoring services

d. Legal & Safety Disclosures

When required by law or safety:

Legal Compliance: Court orders, subpoenas, and regulatory requests
Safety Concerns: Child safety issues, threats of harm, or illegal activity
Terms Enforcement: Violations of our Terms of Service or community guidelines
Business Transfers: Mergers, acquisitions, or asset sales (with notice)

e. Data Processing Agreements

Third-party protection requirements:

Contractual Obligations: All partners sign data processing agreements
Privacy Standards: Must meet or exceed our privacy protection standards
Purpose Limitation: Can only use data for specified educational purposes
Data Minimization: Access only to data necessary for their specific function
Security Requirements: Must implement appropriate technical and organizational measures

5. Data Protection & Security Measures

🔒 SECURITY COMMITMENT:

We implement industry-leading security measures to protect your data. However, no system is 100% secure. We continuously monitor and improve our security practices.

a. Technical Security Measures

Data protection technologies:

Encryption: AES-256 encryption for data at rest, TLS 1.3 for data in transit
Access Controls: Multi-factor authentication, role-based permissions, least privilege access
Network Security: Firewalls, intrusion detection, DDoS protection
Data Isolation: Separate environments for different user types and data sensitivity levels
Secure Development: Security code reviews, vulnerability scanning, penetration testing
Backup & Recovery: Encrypted backups, disaster recovery procedures, business continuity planning

b. Organizational Security Measures

Human and process security:

Staff Training: Regular privacy and security training for all employees
Background Checks: Security screening for personnel with data access
Access Monitoring: Logging and monitoring of all data access activities
Incident Response: 24/7 security monitoring and incident response procedures
Privacy by Design: Privacy considerations built into all system designs
Regular Audits: Internal and external security audits and assessments

c. Data Anonymization & Pseudonymization

Privacy protection techniques:

Personal Identifier Removal: Automatic removal of names, emails, and other identifiers
Data Aggregation: Combining data from multiple users to prevent individual identification
Statistical Disclosure Control: Adding noise to prevent re-identification
Pseudonymization: Replacing identifiers with pseudonyms for research purposes
Differential Privacy: Mathematical techniques to protect individual privacy in datasets

d. Data Breach Response

🚨 BREACH NOTIFICATION PROCEDURES:

In the unlikely event of a data breach:

Immediate Response: Contain the breach and assess the impact within 24 hours
Authority Notification: Report to relevant authorities within 72 hours (where required)
User Notification: Notify affected users within 72 hours if high risk to privacy
Remediation: Take immediate steps to prevent further unauthorized access
Investigation: Conduct thorough investigation and implement preventive measures

6. Data Retention & Deletion

⏰ RETENTION PRINCIPLE:

We retain personal data only as long as necessary for the purposes outlined in this policy or as required by law. We regularly review and delete data that is no longer needed.

a. Retention Periods by Data Type

Data Type	Retention Period	Reason
Account Information	Active account + 2 years	Service provision, legal compliance
Educational Content (Personal)	Active account + 3 years	Learning continuity, progress tracking
Educational Content (Anonymized)	Indefinitely	AI model training, content generation, research
AI Chat Transcripts	Active account + 1 year	Service improvement, quality assurance
Usage Analytics	2 years (anonymized)	Platform optimization, research
Payment Records	7 years	Legal and tax requirements
Support Communications	3 years	Customer service, dispute resolution
Security Logs	1 year	Security monitoring, incident response

b. Automated Deletion Procedures

We have implemented automated systems to:

Regular Reviews: Monthly reviews of data retention compliance
Automated Deletion: Automatic deletion of data past retention periods
Anonymization: Convert personal data to anonymous research data where appropriate
Secure Disposal: Cryptographic erasure and secure deletion of sensitive data
Audit Trails: Maintain logs of all data deletion activities

7. Your Privacy Rights & Controls

🎛️ YOUR CONTROL:

You have significant control over your personal data. These rights may vary based on your location and applicable privacy laws.

a. Universal Privacy Rights

Available to all users:

Access: Request a copy of all personal data we hold about you
Correction: Update or correct inaccurate personal information
Deletion: Request deletion of your personal data (subject to legal requirements)
Portability: Receive your data in a machine-readable format
Opt-out: Withdraw consent for optional data processing activities

b. Rights by Jurisdiction

Jurisdiction	Applicable Law	Your Rights
European Union / EEA	GDPR	Access, rectification, erasure ("right to be forgotten"), data portability, restriction of processing, objection to processing, right not to be subject to automated decision-making, right to lodge a complaint with a supervisory authority
Singapore	PDPA (Personal Data Protection Act)	Access to personal data, correction of inaccurate personal data, withdrawal of consent (with reasonable notice)
Hong Kong SAR	PDPO (Personal Data (Privacy) Ordinance)	Access to personal data, correction of inaccurate personal data, right to be informed of data use purposes
California, USA	CCPA / CPRA	Right to know what personal information is collected, right to delete, right to opt-out of sale of personal information (we do not sell personal information), right to non-discrimination for exercising privacy rights, right to correct inaccurate personal information
United States (Children)	COPPA	Parental right to review child's data, delete child's data, and revoke consent at any time

c. GDPR Legal Basis for Processing

⚖️ GDPR LEGAL BASIS:

For users in the EU/EEA, we process personal data on the following legal bases:

Consent (Art. 6(1)(a) / Art. 9(2)(a)): For children's data and optional analytics — you may withdraw consent at any time
Contractual Necessity (Art. 6(1)(b)): To deliver the educational services you have subscribed to
Legitimate Interest (Art. 6(1)(f)): For anonymized service improvement analytics and security monitoring, where our interests do not override your rights
Legal Obligation (Art. 6(1)(c)): To comply with applicable laws, including financial record-keeping requirements

d. How to Exercise Your Rights

📧 Contact Methods:

Email: info@eduq-ai.com
Subject Line: "Privacy Rights Request - [Your Request Type]"
Required Information: Full name, email address, specific request details
Identity Verification: We may request additional verification for security

e. Deletion Request Timeframes

Jurisdiction / Law	Deletion Timeframe	Notes
COPPA (Parental requests, USA)	Within 48 hours	Immediate processing for children's data deletion requests
GDPR (EU/EEA)	Within 30 days	May extend to 60 days for complex requests with notice
PDPA (Singapore)	Within 30 days	Reasonable time as required by PDPC guidelines
CCPA/CPRA (California)	Within 45 days	Extendable to 90 days with written notice
All other jurisdictions	Within 30 days	We acknowledge receipt within 3 business days

Note: Anonymized consent records and payment metadata are retained after deletion as required by law. Anonymized data cannot be re-linked to you.

f. Account Settings & Privacy Controls

Self-service privacy controls in your account:

Profile Management: Update personal information and preferences
Communication Preferences: Control email notifications and marketing communications
Data Sharing Settings: Control sharing with educational institutions and parents
AI Features: Enable or disable AI tutoring and data processing
Analytics Opt-out: Opt out of usage analytics and research participation
Account Deletion: Permanently delete your account and associated data

8. Children's Privacy Protection (COPPA Compliance)

👨‍👩‍👧‍👦 SPECIAL PROTECTION FOR CHILDREN:

We are committed to protecting children's privacy and comply with the Children's Online Privacy Protection Act (COPPA) and similar international regulations. Special rules apply to users under 13 years of age.

a. Age Verification & Parental Consent

For users under 13 years of age:

Age Verification: We verify age during account registration
Parental Consent Required: Verifiable parental consent must be obtained before account creation
Consent Methods: Email consent with follow-up verification, signed consent forms, or video conferencing
Consent Documentation: We maintain records of all parental consent
Account Supervision: Parents have full oversight and control over child accounts

b. Limited Data Collection for Children

📊 MINIMAL DATA COLLECTION:

For children under 13, we collect only the minimum information necessary for educational services:

Required Information: First name, age, grade level, parent/guardian contact information
Educational Data: Learning progress, completed activities, and educational content interactions
Technical Data: Limited to essential service functionality (no behavioral tracking)
No Collection: Full name, email address, phone number, or other personal identifiers
No Sharing: Personal information is never shared with third parties for marketing

c. Enhanced Privacy Protections

Additional safeguards for children:

No Advertising: No personalized advertising or marketing to children
Content Filtering: Enhanced content filtering and age-appropriate materials only
Communication Restrictions: No direct communication features with other users
Data Minimization: Automatic deletion of unnecessary data
Secure Processing: Additional encryption and security measures for children's data
Staff Training: Specialized training for staff handling children's accounts

d. Parental Rights & Controls

Parents and guardians have the right to:

Review Data: Access all personal information collected about their child
Correct Information: Update or correct any inaccurate information
Delete Account: Request deletion of their child's account and all associated data
Restrict Collection: Limit the types of information collected
Monitor Activity: Receive regular reports on their child's learning progress
Withdraw Consent: Revoke consent and delete the account at any time

e. Educational Exception Considerations

🏫 SCHOOL-SPONSORED ACCOUNTS:

When schools create accounts for educational purposes:

School Authorization: Schools may authorize accounts for educational activities
Parental Notification: Parents are notified of school-sponsored account creation
Educational Purpose: Data collection limited to legitimate educational purposes
Parental Override: Parents can still request account deletion or data restrictions
School Responsibility: Schools must comply with their own privacy policies and FERPA requirements

f. Contact for Children's Privacy Matters

📞 CHILDREN'S PRIVACY CONTACT:

For all matters related to children's privacy:

Email: support@eduq-ai.com
Subject: "Children's Privacy - [Your Request]"
Response Time: We respond to children's privacy requests within 24 hours
Verification: We may request verification of parental status for security

9. International Data Transfers & Global Compliance

🌍 GLOBAL OPERATIONS:

As a Hong Kong-based company serving users worldwide, we ensure appropriate safeguards for international data transfers and comply with local privacy laws.

a. Data Transfer Safeguards

Protection mechanisms for international transfers:

Adequacy Decisions: Transfers to countries with adequate data protection (EU Commission decisions)
Standard Contractual Clauses: EU-approved contracts for transfers to third countries
Binding Corporate Rules: Internal policies ensuring consistent global protection
Certification Schemes: Participation in recognized privacy certification programs
Specific Safeguards: Additional protections based on destination country requirements

b. Regional Compliance

Region/Country	Applicable Laws	Specific Protections
European Union	GDPR	Enhanced rights, DPO contact, supervisory authority complaints
United States	COPPA, CCPA, FERPA	Children's privacy protection, California privacy rights
United Kingdom	UK GDPR, DPA 2018	ICO oversight, enhanced children's protections
Canada	PIPEDA	Privacy Commissioner oversight, breach notification
Australia	Privacy Act 1988	Australian Privacy Principles compliance
Hong Kong SAR	PDPO	Cross-border transfer restrictions, PCPD oversight

c. Data Localization & Storage

Where your data is stored and processed:

Primary Storage: AWS data centers in Singapore (Asia-Pacific region)
Backup Storage: Encrypted backups in multiple geographic regions
AI Processing: SambaNova cloud infrastructure (with data protection agreements)
CDN Services: Global content delivery networks for performance optimization
Local Requirements: Data residency compliance where legally required

10. Privacy Policy Updates & Changes

📋 POLICY CHANGES:

We may update this Privacy Policy to reflect changes in our practices, technology, legal requirements, or other factors. We will provide appropriate notice of significant changes.

a. Types of Changes

We distinguish between different types of policy updates:

Minor Changes: Clarifications, contact information updates, or non-material changes
Material Changes: Changes to data collection, use, sharing, or retention practices
Legal Updates: Changes required by new laws or regulations
Service Changes: Updates related to new features or service modifications

b. Notification Procedures

How we notify you of changes:

Email Notification: Direct email to all registered users for material changes
Platform Notice: Prominent notice on our website and in the application
Advance Notice: 30 days advance notice for material changes
Parental Notice: Special notification to parents for changes affecting children
Opt-out Period: Opportunity to opt out or delete account before changes take effect

c. Your Options

When we update our Privacy Policy, you can:

Continue Using: Continued use indicates acceptance of the updated policy
Review Changes: We highlight all changes and provide summaries
Contact Us: Ask questions about changes or their impact on your data
Opt Out: Withdraw consent for new data processing activities
Delete Account: Permanently delete your account if you disagree with changes

11. Contact Information & Data Protection

📞 Privacy Contact Information

Contact Methods

General Privacy Inquiries:
info@eduq-ai.com

Children's Privacy (COPPA):
support@eduq-ai.com

Data Protection Requests:
info@eduq-ai.com

Response Times

• General Privacy Questions: Within 48 hours
• Data Rights Requests: Within 30 days (may extend to 60 days)
• Children's Privacy Matters: Within 24 hours
• Data Breach Notifications: Within 72 hours (if applicable)

12. Privacy Policy Acknowledgment

✅ Your Privacy Agreement

By using the EduQ AI service, you acknowledge that you have:

Read and Understood: This comprehensive Privacy Policy in its entirety
Agreed to Data Processing: The collection, use, and processing of your personal data as described
Understood AI Processing: How your data is used with SambaNova AI technology
Acknowledged Third-Party Sharing: The limited sharing with service providers and partners
Understood Your Rights: Your privacy rights and how to exercise them
Parental Consent (if applicable): Obtained proper parental consent for users under 13

🔒 Our Privacy Commitment

We are committed to protecting your privacy and will continue to enhance our privacy practices as technology and regulations evolve. Your trust is essential to our mission of providing excellent educational services.

This Privacy Policy is effective as of August 1, 2025