SATpal Privacy Policy

2.1 Provide and Improve the Service

• Create and manage your account
• Deliver educational content and features
• Track your learning progress and performance
• Personalize your learning experience
• Provide AI-powered coaching and recommendations
• Generate performance analytics and insights
• Improve our algorithms and content quality
• Develop new features and services

2.2 Communication and Support

• Respond to your inquiries and provide customer support
• Send service-related notifications (account updates, security alerts)
• Send educational reminders and study tips (with your consent)
• Notify you about new features, content, or promotions
• Conduct surveys and gather feedback

2.3 Safety and Security

• Verify your identity and prevent fraud
• Protect against unauthorized access and abuse
• Enforce our Terms of Service and Community Guidelines
• Detect and prevent technical issues
• Comply with legal obligations

2.4 Analytics and Research

• Analyze usage patterns and trends
• Measure the effectiveness of our Service
• Conduct educational research (anonymized data only)
• Create aggregated statistics and reports

2.5 Marketing and Advertising

• Show you relevant advertisements (with your consent)
• Measure advertising campaign effectiveness
• Send promotional communications (you can opt out)

2.6 Legal Compliance

• Comply with applicable laws and regulations
• Respond to legal requests and prevent harm
• Protect our rights and property
• Resolve disputes and enforce agreements

3.1 Service Providers

We share information with third-party service providers who perform services on our behalf:

• Cloud Hosting: Supabase, AWS (data storage and infrastructure)
• Payment Processing: Stripe, PayPal (secure payment handling)
• Email Services: Resend, SendGrid (transactional emails)
• Analytics: Google Analytics (usage statistics)
• AI Services: Google Gemini (AI coaching features)
• Customer Support: Help desk and chat services

These providers are contractually obligated to protect your information and use it only for the services they provide to us.

3.2 Business Transfers

If we are involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred to the new owner. We will notify you before your information becomes subject to a different privacy policy.

3.3 Legal Requirements

We may disclose your information if required to do so by law or in response to:

• Court orders, subpoenas, or legal process
• Government or regulatory requests
• Requests from law enforcement
• Protection of our rights, property, or safety
• Prevention of fraud or illegal activity
• Protection of the safety of our users or the public

3.4 With Your Consent

We may share your information with third parties when you explicitly consent or direct us to do so, such as:

• Connecting your account to social media
• Sharing your progress with parents/guardians (for minors)
• Participating in leaderboards or community features
• Sharing achievements on social media

3.5 Aggregated and De-Identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you. This includes:

• Usage statistics and trends
• Educational research data
• Performance benchmarks
• Industry reports

3.6 Schools and Educators

If you access SATpal through a school or educational institution, we may share your progress and performance data with authorized school personnel, as permitted by FERPA and other applicable laws.

Retention Periods

• Account Information: Until you delete your account, plus 30 days
• Learning Data: Until you delete your account, plus 90 days for backup
• Payment Records: 7 years (for tax and accounting purposes)
• Support Communications: 3 years after resolution
• Analytics Data: 26 months (aggregated data may be retained indefinitely)
• Legal Hold: Retained as long as necessary for legal proceedings

Account Deletion

When you delete your account:

• Your profile and personal information are permanently deleted within 30 days
• Your learning data and progress are permanently deleted within 90 days
• Some information may be retained in backups for up to 90 days
• Aggregated, anonymized data may be retained indefinitely
• Legal or regulatory requirements may require longer retention

To delete your account, go to Settings → Account → Delete Account, or contact us at privacy@satpal.ai.

5.1 Access and Portability

You have the right to:

• Access your personal information
• Request a copy of your data in a portable format
• View your learning history and progress

You can download your data from Settings → Privacy → Download My Data.

5.2 Correction and Update

You can update your account information, profile, and preferences at any time through your account settings.

5.3 Deletion

You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, fraud prevention).

To delete your account: Settings → Account → Delete Account

5.4 Marketing Communications

You can opt out of marketing emails by:

• Clicking "Unsubscribe" in any marketing email
• Updating your preferences in Settings → Notifications
• Contacting us at privacy@satpal.ai

Note: You will still receive service-related communications (e.g., account updates, security alerts).

5.5 Cookie Preferences

You can manage cookie preferences through your browser settings or our cookie consent tool. See Section 9 for details.

5.6 Object to Processing

You have the right to object to certain types of processing, including:

• Direct marketing
• Processing based on legitimate interests
• Automated decision-making (if applicable)

5.7 Withdraw Consent

Where we process your information based on consent, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing before withdrawal.

Security Measures

• Encryption: Data is encrypted in transit (TLS/SSL) and at rest (AES-256)
• Authentication: Secure password hashing and optional two-factor authentication
• Access Controls: Role-based access and least privilege principles
• Monitoring: 24/7 security monitoring and intrusion detection
• Regular Audits: Periodic security assessments and penetration testing
• Employee Training: Security awareness training for all staff
• Incident Response: Documented procedures for security incidents

Your Responsibility

You can help protect your account by:

• Using a strong, unique password
• Enabling two-factor authentication
• Not sharing your login credentials
• Logging out after each session on shared devices
• Reporting suspicious activity immediately

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by law, typically within 72 hours of discovery.

Age Requirements

• Under 13: Requires verifiable parental consent
• 13-17: Requires parental notification and consent
• 18+: Can create account independently

Parental Consent and Rights

For users under 18, parents/guardians have the right to:

• Review their child's personal information
• Request deletion of their child's information
• Refuse further collection or use of their child's information
• Receive notifications about data practices
• Access their child's learning progress and activity

To exercise these rights, contact us at parents@satpal.ai with proof of guardianship.

Information We Collect from Children

We collect only the minimum necessary information from children:

• Username and password (no email required for under 13)
• Parent/guardian email (for consent and notifications)
• Learning activity and progress data
• Device and usage information (for service functionality)

We do NOT collect from children:

• Full name or address
• Phone number
• Social Security number
• Geolocation data
• Photos or videos (unless parent-approved)

FERPA Compliance (School Accounts)

When SATpal is used through a school:

• We act as a "school official" with legitimate educational interests
• Student data is used only for educational purposes
• We do not share educational records without consent (except as permitted by FERPA)
• Schools retain control over student data
• Parents can request access through the school

No Targeted Advertising to Children

We do not serve targeted advertising to users under 18. Any ads shown are contextual and age-appropriate, and we do not use children's personal information for advertising purposes.

Data Protection Standards

When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions by relevant data protection authorities
• Binding Corporate Rules (where applicable)
• Compliance with applicable data protection laws

EU-U.S. Data Privacy Framework

We comply with applicable data transfer mechanisms for transfers from the European Economic Area (EEA), United Kingdom, and Switzerland to the United States.

Your Rights

By using the Service, you consent to the transfer of your information to the United States and other countries. You have the right to obtain information about the safeguards we use for international transfers.

What Are Cookies?

Cookies are small text files stored on your device that help us recognize you and remember your preferences. We use both session cookies (deleted when you close your browser) and persistent cookies (remain until deleted or expired).

Types of Cookies We Use

Your Cookie Choices

You can control cookies through:

• Cookie Consent Tool: Manage preferences when you first visit
• Account Settings: Settings → Privacy → Cookie Preferences
• Browser Settings: Block or delete cookies in your browser
• Opt-Out Tools: NAI opt-out, DAA opt-out, Google Analytics opt-out

Note: Disabling essential cookies may affect Service functionality.

Do Not Track

Some browsers have a "Do Not Track" feature. We currently do not respond to Do Not Track signals, but you can control tracking through the methods described above.

Third-Party Links

We are not responsible for the privacy practices or content of third-party websites. When you leave our Service, we encourage you to read the privacy policies of those sites.

Third-Party Services We Use

• Supabase: Database and authentication (Privacy Policy: supabase.com/privacy)
• Google Gemini: AI services (Privacy Policy: policies.google.com/privacy)
• Stripe: Payment processing (Privacy Policy: stripe.com/privacy)
• Google Analytics: Usage analytics (Privacy Policy: policies.google.com/privacy)

Social Media

Our Service may include social media features (e.g., share buttons). These features may collect your IP address and set cookies. Your interactions with these features are governed by the privacy policies of the companies providing them.

Your CCPA Rights

• Right to Know: Request information about the personal information we collect, use, and share
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the sale of your personal information (Note: We do not sell personal information)
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights
• Right to Correct: Request correction of inaccurate personal information
• Right to Limit: Limit the use and disclosure of sensitive personal information

Categories of Information We Collect

• Identifiers (name, email, username)
• Commercial information (purchase history)
• Internet activity (browsing history, usage data)
• Geolocation data (general location)
• Education information (learning progress, test scores)
• Inferences (preferences, characteristics)

How to Exercise Your Rights

To exercise your CCPA rights:

• Email: privacy@satpal.ai
• Phone: 1-800-SATPAL (toll-free)
• Online Form: satpal.ai/privacy-request

We will verify your identity before processing your request. We will respond within 45 days.

Authorized Agent

You may designate an authorized agent to make requests on your behalf. The agent must provide proof of authorization, and we may require you to verify your identity directly with us.

Shine the Light Law

California residents may request information about our disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

Your GDPR Rights

• Right to Access: Obtain a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
• Right to Lodge a Complaint: File a complaint with your local data protection authority

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract: To provide the Service you requested
• Consent: For marketing, cookies, and optional features
• Legitimate Interests: To improve the Service, prevent fraud, and ensure security
• Legal Obligation: To comply with applicable laws

Data Controller

InnovAItion Labs Inc. is the data controller for your personal information. Our contact details:

EU Representative

If required by law, we will appoint an EU representative. Contact details will be provided here when appointed.

Supervisory Authority

You have the right to lodge a complaint with your local data protection authority. A list of EU data protection authorities is available at: edpb.europa.eu

How We Notify You

When we make material changes, we will notify you by:

• Posting a notice on the Service for at least 30 days
• Sending an email to your registered email address
• Displaying an in-app notification
• Updating the "Last Updated" date at the top of this policy

Your Acceptance

Your continued use of the Service after the effective date of the updated Privacy Policy constitutes your acceptance of the changes. If you do not agree to the updated policy, you must stop using the Service and may delete your account.

Material Changes

For material changes that significantly affect your rights, we may require you to provide explicit consent before the changes take effect.