Privacy Policy
Last updated: 12 November 2026
Controller: [Company legal name], [registered address]. Contact: privacy@polymentra.ai. This policy is written to meet the EU and UK GDPR, India’s Digital Personal Data Protection Act and similar laws.
Data we collect and why
| Data | Why | Legal basis |
|---|---|---|
| Account data: name, email, language, country | Create and run your account | Contract |
| Prompts, files, chats and generated output | Send to the AI model you choose and show you the answer and history | Contract |
| Course progress, quiz results, certificates | Track learning and issue certificates | Contract |
| Polymentra Family: children’s results, school reports, plans | Analyse progress and create family plans – only with parent consent | Consent / contract |
| Payment data (handled by Paddle – we never see full card numbers) | Billing, tax, fraud prevention | Contract / legal obligation |
| Usage and device data, cookies | Security, fixing bugs, improving the product | Legitimate interest / consent for non-essential cookies |
| Waitlist and marketing preferences | Send launch news and offers | Consent – opt out any time |
Who we share data with
- AI model providers (directly or through OpenRouter, fal.ai, Replicate) – only the content needed to answer your request, under their API data terms.
- Paddle – payments and tax.
- Hosting and infrastructure – Vercel, Supabase, Cloudflare, monitoring tools.
- Video and voice tools – HeyGen, ElevenLabs (course production and voice features).
- Authorities when required by law. We never sell personal data.
AI training
Polymentra does not use your chats, files or children’s data to train AI models. We use provider settings that do not use API data for training.
Children and Polymentra Family
- Children’s profiles are created and controlled by a parent or guardian, who gives consent for each child.
- Children’s data is never used for advertising, never sold and never shared with schools or tutors without the parent’s permission.
- Location (for weekend and holiday ideas) and health data (sleep, activity) are optional, off by default and can be switched off at any time.
- We do not knowingly collect data from children under 13 except through a parent-controlled Family profile.
International transfers
Providers may process data outside your country (for example in the USA or EU). We use Standard Contractual Clauses or equivalent safeguards.
How long we keep data
Chats and Family data: until you delete them or close your account (plus 30 days in backups). Billing records: as tax law requires. Analytics: up to 24 months.
Your rights
Access, correction, deletion, export, objection and withdrawing consent – from your account settings or by emailing privacy@polymentra.ai. You may also complain to your local data protection authority.
Security
Encryption at rest (AES-256) and in transit (TLS 1.3), row-level access controls, multi-factor authentication for staff, and continuous monitoring.