Children's Privacy Notice

This Children's Privacy Notice ("Notice") is written for parents and guardians. It explains, in plain language, how Civilsphere Educational Services Private Limited ("Prepdha", "we", "us", "our") collects, uses, protects, and shares the personal data of children who use the Prepdha learning platform, websites, mobile and tablet apps, and any school-issued devices we provide (together, the "Platform").

Prepdha is an AI-powered, Board-aligned (CBSE & IGCSE) learning and retention platform for school students in Classes 1–12. Because almost all of our student users are under the age of 18, the protection of children's data is not an add-on for us — it shapes how the Platform is designed, what we collect, and what we deliberately choose not to do.

This Notice supplements, and should be read together with, our main Privacy Policy, our Parental Consent Notice, our Cookie Policy, and our Grievance Redressal Policy. Where this Notice and the Privacy Policy address the same subject, this Notice governs for children's data.

At a glance (the short version)

If you read nothing else, here is what matters most:

• A "child" in India means anyone under 18. Almost every student on Prepdha is a child in the eyes of the law.
• We will not process your child's personal data until we have your verifiable consent as a parent or guardian — or until a school that is lawfully responsible for your child instructs us to.
• We do not track, profile, or behaviourally monitor your child, and we do not show advertising to your child.
• Your child's account is restricted by design so they cannot expose personal details about themselves on the Platform.
• You stay in control: you can see your child's data, correct it, delete it, and withdraw consent at any time.
• The AI doubt solver is supervised — you and your child's teachers can see how it is being used.

The rest of this Notice explains each of these in detail.

1. The law this Notice is built on

We handle children's data in accordance with India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), together with the Information Technology Act, 2000 and the rules made under it.

A few key points from that framework that directly affect your child:

• Who is a child. Under the DPDP Act, a child is an individual who has not completed 18 years of age. This is a wider definition than many other countries use, and it means our Classes 6–10 students are children under the law.
• Verifiable parental consent. Before processing a child's personal data, a data fiduciary must obtain verifiable consent from the child's parent or lawful guardian. A child ticking "I am over 18", or simply typing a parent's email, does not meet this standard.
• Hard prohibitions. The law specifically prohibits tracking, behavioural monitoring, and profiling of children, and the serving of targeted advertising to children. It also sets a broader standard: no processing that is likely to cause a detrimental effect on the well-being of a child.
• Strong enforcement. Breaches of the children's-data provisions can attract penalties of up to ₹200 crore, which is one reason we take this so seriously.

We apply these protections now, ahead of the staggered dates on which the various obligations become formally enforceable, so that families using Prepdha are protected from day one.

2. Key terms, in plain language

• Child — a person under 18 years of age.
• Parent / lawful guardian — the adult who is legally responsible for the child and who can give consent on the child's behalf.
• Personal data — any information that can identify your child, on its own or combined with other information (for example, name, class, school, device identifiers, and learning records).
• Data Fiduciary — the organisation that decides why and how personal data is processed. Depending on how your child reached Prepdha, this is either your child's school or Prepdha (see Section 3).
• Data Processor — an organisation that processes data on behalf of, and on the instructions of, a Data Fiduciary.
• Processing — anything done with personal data: collecting, storing, using, analysing, sharing, or deleting it.

3. How a child comes to use Prepdha — and who is responsible

There are two routes onto the Platform, and the route determines who is the Data Fiduciary (the party legally responsible for the data) and who gives consent.

Route A — Through your child's school. When a school subscribes to Prepdha and enrols its students, the school is the Data Fiduciary. The school decides how the Platform is used for its students and instructs Prepdha as its service provider (Data Processor). In this arrangement, the school is responsible for the lawful basis for adding students — including any consents required from parents — and Prepdha processes the data strictly on the school's documented instructions and under a signed Data Processing Agreement. The school's own privacy notice will also apply.

Route B — Through you, the parent or guardian, directly. When you sign up for your child yourself through our website or app — for example, for a free trial or a direct subscription — Prepdha is the Data Fiduciary. In that case, we ask you for verifiable parental consent before we process your child's data, and we are directly responsible to you for that account.

In both routes, the protections described in this Notice apply to your child's data.

4. What personal data we collect about a child

We follow the principle of data minimisation: we collect only what we genuinely need to teach, support, and protect your child. We do not ask children for information unrelated to learning.

We do not seek out special-category information about your child beyond what is necessary for education, and we do not require children to share anything that is not needed for learning.

5. How we use your child's data, and our lawful basis

We use your child's personal data to:

• provide the Platform — create the account, deliver lessons, practice, assessments, flashcards, and notes;
• personalise learning — run our diagnostics, spaced-repetition scheduler, AI flashcards, AI doubt solver, and adaptive difficulty so the path suits your child's level and pace;
• show progress — to your child, to you, and to your child's teachers and school;
• support and communicate — respond to questions and provide service messages; and
• keep the Platform safe — detect and prevent misuse, abuse, and security incidents.

Our lawful basis for processing a child's data is the verifiable consent of the parent or guardian (for direct sign-ups), or the lawful instruction of a school that is responsible for the child (for school deployments), together with our need to perform the service and to meet legal obligations.

AI features assist learning and operate under the oversight of your child's teachers and school. They are not used to make decisions that have legal or similarly significant effects on your child without a human being involved.

We do not sell children's data, and we do not use it for behavioural or targeted advertising.

6. What we will never do with your child's data

To be completely clear, in line with the DPDP Act's special protections for children, Prepdha will not:

• track or behaviourally monitor your child across the Platform for any purpose beyond delivering and improving the educational service;
• profile your child to predict behaviour or build a marketing or advertising profile;
• serve your child targeted or behavioural advertising, or allow third parties to do so through the Platform;
• sell, rent, or trade your child's personal data; or
• process your child's data in a way that is likely to harm their well-being.

Gamification features such as XP, streaks, and leaderboards exist to support motivation and healthy study habits — not to maximise screen time or to manipulate engagement.

7. How your child's account is kept safe by design

Prepdha student accounts are restricted accounts. We deliberately limit or switch off features that could let a child reveal personal information about themselves or be contacted by strangers. In practice this means:

• no open-ended public profiles or free-text fields where a child could publish identifying details;
• no public posting of personal information or photographs — unlike open discussion forums, Prepdha does not provide spaces where a child's personal details, contact information, or images are made visible to other users;
• leaderboards and social features that show only the minimum needed to motivate learning (such as a first name or display name and a score), never personal contact details; and
• in-product prompts that discourage children from sharing personal information anywhere on the Platform.

The goal is simple: your child can learn, practise, and compete for XP and streaks without putting their personal details out into the open.

8. AI features and your visibility as a parent

Prepdha's AI doubt solver helps your child when they get stuck on a question. Because this involves a child interacting with an AI system, we build in safeguards:

• Adult oversight. You (for your linked child) and your child's teachers can review your child's doubt-solver history, so an adult always has visibility into how your child is using the AI.
• Kept to academics. The doubt solver is designed for academic questions, and we prompt your child not to enter personal information — such as their full name, home address, phone number, or photos of themselves — into it.
• Minimal retention. We keep doubt-solver inputs only for as long as needed to answer the question and to improve the feature, and we do not retain any image a child shares for longer than necessary to respond.
• No training on your child's identity. We do not use your child's identifiable data to train third-party foundation models for purposes unrelated to providing the Platform.

9. Verifiable parental consent — how it works

Where consent is the basis for processing your child's data (Route B above), we obtain verifiable consent from you before we process your child's data. "Verifiable" means we take reasonable, legally recognised steps to confirm two things: that you are an adult, and that you are the parent or guardian of the child being enrolled.

To do this, we use appropriate technical and organisational measures and exercise due diligence, which may include:

• reliable details we already hold — for example, where you are already a registered adult user of Prepdha, we can rely on the identity and age details we hold for you; and
• identity or age details you voluntarily provide, or a government-authorised virtual token — including a token mapped to your identity issued through a Digital Locker service (such as DigiLocker), used to confirm that you are an identifiable adult.

We also operate age-gating so that we can identify when a user is a child and route them through the parental-consent flow rather than treating them as an adult.

Your consent is:

• specific — given for the purposes we describe, not a blanket permission;
• informed — you receive a clear notice of what data we collect and why before you consent; and
• withdrawable — you can take it back at any time, and withdrawing is as easy as giving it.

We keep a secure, traceable record of your consent — what you consented to, when, and how it was verified — so we can demonstrate that consent was properly obtained. For the exact wording shown during the consent flow, see our Parental Consent Notice.

Children and adults with disabilities. Where a user is a person with a disability who has a lawful guardian, we obtain consent from that guardian, verifying guardianship through the appropriate legally recognised means.

10. Who we share your child's data with

We do not sell children's data. We share it only where it is necessary to run the Platform:

• Your child's school and teachers — authorised teachers and school staff can see the learning and performance data of their own students, which is essential to how the Platform works.
• You, the parent/guardian — for the children linked to your account.
• Service providers (Data Processors) acting on our behalf — for example, secure cloud hosting, communications, and analytics — under contracts that require them to protect the data and use it only to provide their service to us. They are not permitted to use children's data for their own purposes or for advertising.
• For legal and safety reasons — where we are required by law, or to protect the rights, safety, and security of users (especially children) and the public.

We do not transfer your child's data to recipients who are not bound by appropriate protections.

11. How long we keep your child's data

We keep your child's personal data only for as long as we need it. Our standard periods are:

Where your child's school is the Data Fiduciary, retention follows the school's instructions and our contract with it. When the purpose is fulfilled, when you withdraw consent, or when a school instructs us, we erase the relevant data, except where the law requires us to keep it. We will, where required, notify you before erasure.

12. How we keep your child's data secure

We apply security safeguards appropriate to the sensitivity of children's data, including:

• role-based access controls, so that (for example) a teacher sees only their own students;
• segregation of student data and limits on who can access it internally;
• encryption of data in transit;
• logging and monitoring to detect unusual activity; and
• confidentiality obligations and training for our staff.

If a personal data breach affecting your child occurs, we will act on it promptly and follow the notification requirements under the DPDP framework, including notifying the affected individuals and the Data Protection Board of India within the required timelines.

13. Where your child's data is processed

We primarily store and process your child's data in India. Where any processing or storage occurs outside India — for example, through a service provider — we do so in accordance with the DPDP framework and any conditions specified by the Government, and we require appropriate protections to be in place.

14. Your rights as a parent or guardian

On behalf of your child, you can ask us to:

• access the personal data we hold about your child and information about how we process it;
• correct, complete, or update inaccurate or incomplete data;
• erase your child's data where it is no longer needed and the law does not require us to keep it;
• withdraw consent at any time; and
• nominate another person to exercise these rights in the event of your death or incapacity.

You can also raise a complaint through our Grievance Redressal Policy (Section 16).

To exercise any of these rights, contact us using Section 17. To protect your child, we may need to verify your identity and your relationship to your child before we act. Where your child's school is the Data Fiduciary, we may direct your request to the school or act on its instructions.

15. Withdrawing your consent

You can withdraw your consent at any time, using the controls in your parent account or by contacting us (Section 17). Withdrawal is designed to be as easy as giving consent.

When you withdraw consent:

• we stop further processing of your child's data for the purposes you had consented to;
• withdrawal does not undo processing that was already carried out lawfully before you withdrew; and
• because some processing is essential to providing the service, withdrawing consent may mean your child can no longer use some or all of the Platform. We will explain the effect of withdrawal when you ask.

16. Raising a concern or complaint

If you have any concern about how your child's data is handled, please contact our Grievance Officer (Section 17). We will:

• acknowledge your grievance, typically within 2 business days (48 hours); and
• investigate and aim to resolve it within 30 days, and within any timeline required by law.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India under the DPDP framework, or pursue other remedies available to you under the law.

17. How to contact us about your child's data

• Data Protection / Privacy contact: Kumar S — communications@prepdha.com
• Grievance Officer: Kumar S — communications@prepdha.com
• Civilsphere Educational Services Private Limited 202, R Hub, Madhapur, Hyderabad 500081 Phone: +91 79954 67223

We take every concern about a child's data seriously and will respond promptly.

18. A note on educational-institution provisions

The DPDP Rules contain limited, conditional provisions that may relieve certain bodies — including educational institutions — from some children's-data requirements when processing student data strictly for defined educational purposes. The exact scope of these provisions, and how far they extend to edtech platforms, is still being clarified. Prepdha takes the protective reading: we do not rely on these provisions to avoid obtaining verifiable parental consent or to weaken the safeguards described in this Notice. If the position changes, we will update this Notice accordingly.

19. Changes to this Notice

We may update this Notice from time to time to reflect changes in our Platform, our practices, or the law. When we make a significant change, we will update the "Last updated" date above and, where appropriate, take reasonable steps to let you know. We encourage you to review this Notice periodically.

---

*This Notice is provided to help parents and guardians understand how Prepdha protects children's data. It reflects our commitments under the DPDP Act, 2023 and the DPDP Rules, 2025. If you have any questions, please contact us using the details in Section 17.*