Privacy Policy

At Zungga Technologies Private Limited (“Zungga”, “we”, “us”, “our”), protecting your privacy and the privacy of your children is not just a legal obligation — it is a core value. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use our platform at www.zungga.com and associated applications (collectively, the “Platform”).

By using the Platform, you consent to the collection and use of your personal data as described in this Policy. Parents and guardians who create child profiles on the Platform provide consent on behalf of their children for the processing described herein.

If you have questions about this Policy, please contact our Grievance Officer at privacy@zungga.com (see Section 12 for details).

We collect personal data in several categories depending on the type of user and how the Platform is used:

A. Parent Account Data (collected directly from adults):

B. Child Activity Data (linked to parent account, collected with parental consent):

C. Technical & Usage Data (collected automatically):

• •IP address, browser type, operating system, device type
• •Pages visited, clicks, session duration, feature usage patterns
• •Error logs and crash reports (for improving stability)
• •Cookies and similar tracking technologies (see Section 9)

We do not collect sensitive personal data such as biometrics, health information, religious or political beliefs, or financial account details beyond what is processed by our payment partner.

We use personal data only for purposes that are lawful, limited, and proportionate. Specifically:

• •Service delivery: To create and manage your account, provide course access, deliver personalised learning, and enable parent reporting
• •Communications: To send transactional emails (account confirmations, receipts, password resets), learning progress summaries, and service notifications
• •Subscription management: To process payments, manage billing cycles, and handle refund or cancellation requests
• •Product improvement: To analyse aggregated usage patterns (anonymised), identify bugs, and improve course content and platform features
• •Safety & security: To detect, prevent, and respond to fraud, abuse, or security incidents
• •Legal compliance: To comply with applicable laws including the DPDP Act, 2023, court orders, and regulatory requirements
• •Marketing (opt-in only): To send newsletters, new pathway announcements, or platform updates — only if you have explicitly opted in. You may opt out at any time via the unsubscribe link in our emails or via your account settings.

We never use children's personal data for marketing, profiling, or behavioural analysis beyond what is strictly necessary to operate the educational service.

We share data in limited circumstances with trusted service providers who help us operate the Platform:

All third-party service providers are bound by contractual data processing agreements that prohibit them from using your data for their own purposes or disclosing it to others.

International transfers: Some of our service providers (including our AI provider) may process data on servers located outside India. Where this happens, we take reasonable steps to ensure your data remains protected in line with this Policy and applicable law.

We may disclose personal data if required to do so by law, court order, or governmental authority, or where we believe disclosure is necessary to protect the rights, property, or safety of Zungga, our users, or the public.

Given that our Platform is designed for children, we apply the highest standards of data protection to all child-related data, in full compliance with the DPDP Act, 2023.

Our specific child data protection commitments:

• •No direct child accounts: Children access the Platform only through parent-created and parent-managed child profiles. Children cannot self-register.
• •No behavioural advertising: We do not display advertisements to children. We do not use children's data for targeted advertising, behavioural profiling, or cross-platform tracking.
• •No public-facing content: Student project submissions are displayed only within the Platform to the student, their parents, and assigned instructors — never publicly online.
• •No third-party data sale: Child data is never sold, rented, or shared with advertisers, data brokers, or marketing companies.
• •Minimal data collection: For child profiles, we collect only first name, age/grade, and learning activity data. We do not collect children's email addresses, phone numbers, or government IDs.
• •Parental visibility and control: Parents can view all data associated with their child's profile, request corrections, and delete child profiles at any time.
• •Age-appropriate design: The Platform's design, language, and interactions are tailored for children, including clear, simple interfaces free from manipulative design patterns.

We retain personal data only for as long as necessary to provide the Services or as required by law:

Upon account deletion, personal data is removed from our active systems within 30 days. Backup systems may retain copies for up to an additional 90 days before permanent deletion.

As a data principal under the Digital Personal Data Protection Act, 2023, you have the following rights:

To exercise any of these rights, contact our Grievance Officer at privacy@zungga.com with your registered email address and a clear description of your request. We will acknowledge your request within 48 hours and aim to fulfil it within 30 days.

If you are dissatisfied with our response, you may escalate your complaint to the Data Protection Board of India (once operational) as provided under the DPDP Act, 2023.

You have the right to request deletion of your personal data and your child's data from our systems. Here's how the process works:

Please note the following before submitting a deletion request:

• •Deletion of your parent account will also delete all associated child profiles and learning data, including badges, XP, achievements, and project submissions. This action is irreversible.
• •Financial transaction records (payment receipts, invoices) may be retained for up to 7 years as required by Indian tax law, even after account deletion. These records will not be used for marketing or profiling.
• •If you have an active subscription, you must first cancel it before requesting data deletion. Cancellation is available in your account settings.
• •Anonymised, aggregated data that cannot be traced back to you may be retained for analytical purposes.

Zungga uses cookies and similar technologies to provide and improve the Platform. Here's a breakdown of what we use and why:

You can control cookies through your browser settings. Disabling essential cookies will prevent the Platform from functioning.

Zungga implements industry-standard technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction:

• •Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS enforced across all endpoints)
• •Encryption at rest: User data stored in our Neon PostgreSQL database is encrypted at rest
• •Secure authentication: Passwords are hashed using bcrypt with salting. We never store plaintext passwords.
• •Payment security: We do not store card details. All payment data is handled by Razorpay, a PCI DSS-compliant payment gateway.
• •Access controls: Strict role-based access controls limit employee access to personal data on a need-to-know basis
• •Regular security reviews: We conduct periodic security assessments and work to promptly address identified vulnerabilities
• •Incident response: We maintain an incident response plan. In the event of a data breach, we will notify affected users and the Data Protection Board of India as required by applicable law.

If you suspect your account has been compromised, contact us immediately at security@zungga.com.

This Privacy Policy — like our Terms of Service — is subject to change at any time to reflect changes in our practices, technology, legal requirements, government regulations, or other factors. Where a change is required for legal or regulatory compliance, or to protect user (especially child) safety, it may take effect immediately.

For material changes — those that significantly affect your rights or how we use your or your child's data — we will:

• •Send a notification to your registered email address at least 14 days before the changes take effect
• •Display a prominent banner on the Platform drawing attention to the update
• •Where required by the DPDP Act, obtain fresh consent

Your continued use of the Platform after the effective date of any policy update constitutes your acceptance of the revised Privacy Policy. Past versions are available on request by emailing privacy@zungga.com.

In accordance with the Information Technology Act, 2000, the IT Rules, 2021, and the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer to address data protection concerns:

For general queries, technical support, and billing issues:

• •General Support: support@zungga.com
• •Security incidents: security@zungga.com
• •Legal / Compliance: legal@zungga.com

If you are not satisfied with the resolution provided by our Grievance Officer, you may escalate your complaint to the Data Protection Board of India as provided under the Digital Personal Data Protection Act, 2023, once such mechanisms are operational.