Privacy Policy
Version 1.1 · Effective: October 14, 2026 · Updated October 16, 2026 (§12 cookies & §13 Canada added) · Applies to: exaledu.com and the Exal EDU platform
Our promise to parents: for any child under 13, we collect nothing until a parent gives verifiable consent. Consent always comes first — before any profile, progress tracking, message, or analytics about your child.
1. Who we are
Exal EDU (“we”, “us”) is an online education platform offering 1:1 and group tutoring — languages (English, French, Chinese, Arabic), Quran & Character, and curriculum support for Grades 1–12. For privacy questions or to exercise any parent right, contact us at support@exaledu.com.
2. What we collect
From parents: full name, email, password (hashed), payment details (handled by our payment processor — card numbers never touch our servers), optional phone number for class reminders.
From children under 13 — only after parental consent:
| Category | Examples | Why |
|---|---|---|
| Identity (minimal) | First name or parent-chosen alias, avatar from a preset gallery | Classroom display |
| Age band | Birth month + year only | Age-appropriate placement and content |
| Learning data | Course enrollment, lesson progress, quiz results | Delivering and improving the service |
| Session metadata | Attendance, session times, technical logs | Scheduling, safety, quality |
| Messages in-platform | Chat with tutors inside our platform only | Safety-monitored learning communication |
From students 13+ and tutors (adults): account details, learning data, and for tutors: credentials, background-check results, payment and tax details as legally required.
What we NEVER collect from children: full date of birth, real photo uploads, home address, precise geolocation, biometric identifiers, device contacts/photos. And we never: sell personal data, show advertising to children, or use children’s data to train AI models — ever.
3. Consent comes first (children under 13)
- A neutral age screen asks birth month/year — never “are you 13 or older?”
- If the learner is under 13, the child profile is frozen: no collection of any kind.
- A parent completes verifiable parental consent (card verification at $0, or our two-step email confirmation for free trials).
- Only then does the child profile activate. The consent date is logged.
- If consent isn’t completed within 30 days, the registration’s contact details are deleted automatically.
Consent has two separate switches: (A) collection & use to run the service — required; (B) disclosure to third parties (e.g., advertising) — optional, off by default, and never required to use the platform.
4. How we use data
- Deliver lessons, scheduling, progress reports, and certificates
- Communicate with parents (notices, reminders, digests) — marketing only with opt-in
- Process payments, prevent fraud, meet legal obligations
- Safety monitoring of in-platform communication
- Improve the service using de-identified, aggregate data
5. Third parties that touch data
| Recipient | What they receive | Purpose |
|---|---|---|
| Stripe (payments) | Parent payment details, consent verification ($0 card check) | Billing & verifiable parental consent |
| Google Workspace | Staff/parent email correspondence, operational documents | Email, calendar, document collaboration |
| Zoom / Google Meet | Live session audio/video (alias shown, no real names required) | Delivering live classes |
| WhatsApp Business provider | Parent phone number & messages (opt-in only) | Class reminders and support conversations |
| Analytics provider | Aggregate, de-identified usage statistics — no child profiles | Product improvement |
| Cloudflare (hosting) | Technical connection data (IP, browser) | Security, performance, hosting |
Every recipient is assessed for confidentiality and security before any disclosure, is contractually bound to protect the data, and receives the minimum necessary. Children’s data is disclosed to third parties only with the separate optional consent (switch B).
6. Retention schedule
We keep children’s data only as long as needed for the purpose collected. Indefinite retention is prohibited.
| Data category | Kept for | Deletion method |
|---|---|---|
| Active account data (parent + child) | While the account is active | Secure deletion on closure |
| Consent records (proof, scope, timestamp) | Life of account + 3 years (compliance evidence) | Then secure deletion |
| Inactive accounts | Purged after 12 months inactive (warnings at 9 and 11 months) | Automated purge |
| Parent deletion requests | Honored within 30 days, including vendors | Tracked deletion ticket + vendor certificates |
| Consent verification artifacts (ID/face images) | Destroyed promptly after verification | Immediate secure wipe |
| Session/AI transcripts | 30 days rolling, unless parent deletes sooner | Automated |
| Registrations without consent | Deleted 30 days after the parent notice | Automated |
7. How we protect data (security program)
We operate a written security program with: a designated Security & Privacy Coordinator; annual risk assessments; ongoing testing and monitoring (access reviews, vulnerability scans, penetration tests before launch and yearly); an annual program evaluation; and vendor security assurance with contractual safeguards. Payment card data is processed under PCI-DSS by our processor and never stored on our servers.
8. Parent rights — review, delete, revoke
You can, at any time, free of charge:
- Review the personal information we hold about your child
- Delete it — completed within 30 days, including at our vendors
- Revoke consent — collection stops immediately and the child account is blocked
- Refuse further collection while keeping what was already consented
How: from your parent dashboard, or email support@exaledu.com with the subject “Parent Request”. We verify your identity first, then act — reviews within 10 business days, deletions within 30 days.
9. International transfers
We serve families globally. Data may be processed in the United States and other countries where our providers operate, under contractual safeguards equivalent to this policy.
10. Changes to this policy
If we change what we collect or how we use it, we will notify parents by email before the change applies, and seek new consent where the law requires it.
11. Contact
Privacy questions, parent requests, or concerns: support@exaledu.com · Exal EDU, United States.
12. Cookies & tracking — consent first
Our site shows a cookie consent banner on your first visit. No non-essential cookie or tracker fires before you choose. You can change your choice at any time via the “Cookie settings” link in the footer — it is stored on your device only.
| Category | Default | What it does |
|---|---|---|
| Necessary | Always on | Runs the site: login sessions, security, load balancing. Cannot be switched off. |
| Analytics | OFF until you allow | GA4 anonymous usage statistics — ad personalization signals disabled, IP anonymized, restricted data processing where offered. |
| Marketing | OFF always by default | Measures campaigns aimed at parents only. We never build remarketing audiences from a minor’s session. |
Tracker inventory (v1.0): consent banner (this site) · GA4 — planned, gated behind Analytics consent · Meta Pixel — not installed; may only ever run in parent-targeted campaigns · chat widget — planned, necessary-category support tool, no cross-site tracking · embedded video — privacy-enhanced/no-cookie embeds only.
Absolute rule — no targeted ads to minors, ever: we never show targeted advertising to children, never build ad audiences from child sessions, and never let any tracker follow a child across the web. Advertising targets parents only. This rule is part of our COPPA program and is not subject to consent — it simply never happens.
13. Canada — PIPEDA & Quebec Law 25
For Canadian families, we comply with PIPEDA and — for Quebec residents — Quebec’s Law 25:
- Meaningful consent, clear language: we collect only what this policy lists, for the purposes stated, and consent is gathered in plain language before collection.
- Your rights: access and correct your data, withdraw consent, and — for Quebec residents — request data portability. Email us (below); we answer within one month.
- Breach duties: if a breach creates a real risk of significant harm, we notify you and the federal privacy commissioner (OPC) — and the Quebec CAI where required — and we keep a record of every incident.
- Children: our global rule is stricter than Canada’s — verifiable parental consent for every child under 16 (Quebec’s under-14 parental-consent rule is covered automatically).
Privacy Officer (Law 25 designation): Exal EDU LLC, acting through its Founder & Director — privacy@exaledu.com (or support@exaledu.com) · United States.