Your privacy matters to us.

Plulai Education (“Plulai,” “we,” “our,” or “us”) is committed to protecting the privacy of children and families who use our platform. This policy explains what data we collect, why we collect it, and how we protect it — especially when the user is a child.

• This policy applies to all users of the Plulai platform, including children aged 6–18, their parents or guardians, and school administrators. We take special care to comply with child privacy laws including COPPA and applicable GCC regulations.

• Account information: name, email address, age group, and password (hashed) provided at registration.
• Learning data: lesson progress, XP points, streaks, quiz results, and completed projects — used solely to personalise the learning experience.
• Device & usage data: browser type, device type, approximate location (country level), and session duration for performance and security purposes.
• Communications: messages sent to our support team.
• We do not collect: government IDs, precise location, biometrics, or any sensitive personal data beyond what is listed above.

• To deliver and personalise the learning experience (AI coach adaptation, streak tracking, progress reports).
• To send weekly parent summaries and important account notifications.
• To improve the platform — we analyse aggregated, anonymised usage patterns.
• To provide customer support.
• We never use your data to serve ads, and we never sell data to third parties.

• Children under 13 may only use Plulai with verifiable parental consent. Accounts for children are created and managed by a parent or school administrator.
• AI coach responses are filtered and moderated to ensure age-appropriate content at all times.
• Parents may request to review, correct, or delete their child's data at any time by contacting hello@plulai.com.
• We do not allow children to publicly post content or communicate with other users outside of the structured learning environment.

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• We conduct regular security audits and follow industry best practices.
• Access to personal data is restricted to authorised Plulai team members on a need-to-know basis.
• In the event of a data breach, we will notify affected users within 72 hours as required by applicable law.

• Data is stored on servers located in the European Union and/or the United Arab Emirates, depending on your region.
• If data is transferred across borders, we ensure appropriate safeguards are in place including Standard Contractual Clauses where required.

• We retain account data for as long as the account is active, plus 30 days after deletion to allow for account recovery.
• Learning data (progress, XP) is deleted upon account deletion.
• Anonymised, aggregated analytics data may be retained indefinitely.

• Access: request a copy of all data we hold about you.
• Correction: request that inaccurate data be corrected.
• Deletion: request that your account and all associated data be permanently deleted.
• Portability: receive your data in a machine-readable format.
• Objection: object to certain types of processing.
• To exercise any of these rights, email hello@plulai.com. We will respond within 30 days.

• We use essential cookies only — required for authentication, security, and core platform functionality.
• We do not use advertising cookies, third-party tracking pixels, or analytics cookies that identify individuals.

• We may update this policy from time to time. We will notify you of material changes by email and by posting a notice on the platform at least 14 days before the change takes effect.

• For privacy questions, data requests, or concerns: hello@plulai.com
• Plulai Education — serving families and schools across the GCC and internationally.