Privacy Policy

Introduction and Scope

Adaptive AI ("we", "us", "our") operates the Adaptive AI platform at adaptive-ai.app and related services (collectively, the "Platform"). This Privacy Policy explains how we collect, use, store, share, and protect personal data when you access or use our Platform. It applies to all users worldwide, including visitors who have not created an account. By using the Platform, you acknowledge that you have read and understood this policy. If you do not agree, please discontinue use of the Platform.

Data Controller

Adaptive AI is operated by Avulakunta Vinay Kumar, based in Hyderabad, Telangana, India. For all privacy-related queries, data subject requests, or concerns, you may contact the data controller directly at support@adaptive-ai.app. We aim to respond to all privacy requests within 30 days.

Data We Collect

We collect the following categories of personal data:

• Identity & Account Data: full name, email address, username, profile photo (if provided), and authentication credentials (stored as hashed tokens via Supabase Auth).
• Learning & Progress Data: courses viewed, lessons completed, quiz scores, job-readiness metrics, streak history, XP points, badges, certificates earned, weak-area diagnostics, and spaced-repetition intervals.
• Content You Create: flashcards, mindmaps, portfolio entries, code playground projects, study room messages, and documents you upload for AI summarisation.
• Usage & Analytics Data: pages visited, features used, session duration, click interactions, search queries within the Platform, and error logs.
• Device & Technical Data: IP address, browser type and version, operating system, device identifiers, time zone, and referring URLs.
• Communications: support tickets, contact form submissions, and any messages sent to us.
• Third-Party Auth Data: if you sign in with Google, we receive your name, email address, and profile picture as provided by Google OAuth.

How We Collect Data

• Directly from you when you register, complete your profile, take quizzes, or contact us.
• Automatically through cookies, server logs, and analytics scripts as you navigate the Platform.
• From third-party services such as Google OAuth when you choose to sign in with your Google account.
• From AI interactions: when you use AI mentor, AI tutor, or document querying features, your prompts are sent to our AI inference provider to generate a response.

Legal Basis for Processing (GDPR & DPDPA)

Where applicable law requires a legal basis for processing, we rely on the following:

How We Use Your Data

• To create and manage your account and authenticate your identity securely.
• To personalise your learning path, surface relevant courses, and adapt difficulty to your progress.
• To generate AI-powered responses in the AI mentor, tutor, and document summariser features.
• To track your progress, award certificates, and maintain your learning history across sessions.
• To operate leaderboards, streaks, XP systems, and gamification features.
• To display your portfolio and allow you to share projects or certificates.
• To improve the Platform by analysing how features are used in aggregate.
• To send you transactional emails (account confirmation, password reset, certificate issuance).
• To send service announcements and updates about significant platform changes.
• To investigate, prevent, and respond to security incidents, fraud, and abuse.
• To comply with applicable legal obligations and respond to lawful government requests.

AI Features and Data Processing

When you use any AI-powered feature (AI mentor, AI tutor, flashcard generator, quiz generator, career advisor, document summariser, etc.), your input and relevant context (such as the current course topic or document content) is sent to our AI inference provider, Groq, Inc., to generate a response. This transmission occurs over encrypted HTTPS. Groq processes this data under a Data Processing Agreement with us and does not use your queries to train its public models. Responses are generated in real time and not stored indefinitely on Groq's servers. We store your AI conversation history on our own infrastructure (Supabase) so you can review past interactions. You may delete your AI conversation history at any time from your account settings.

Cookies and Similar Technologies

We use the following types of cookies and local storage:

• Essential cookies: required for authentication and session management. Without these, you cannot stay signed in.
• Preference cookies: remember your settings such as theme preference and notification preferences.
• Analytics cookies: help us understand how users navigate the Platform so we can improve it. These are aggregated and anonymised where possible.
• We do not use third-party advertising or tracking cookies.

Data Sharing and Third-Party Sub-processors

We share personal data only as described below. We do not sell your data.

• Supabase, Inc. (USA): database hosting, authentication, and file storage. All data is encrypted in transit and at rest. Supabase is SOC 2 Type II certified.
• Groq, Inc. (USA): AI inference for all AI-powered features. Bound by a Data Processing Agreement.
• Google LLC (USA): OAuth 2.0 sign-in. If you use "Sign in with Google", Google receives authentication events as described in Google's Privacy Policy.
• YouTube / Google LLC (USA): embedded video players for course lessons. YouTube may set cookies on your device.
• Vercel, Inc. (USA): application hosting, CDN, and serverless functions. Processes request logs and IP addresses.
• Sentry, Inc. (USA): error and performance monitoring. Captures anonymised stack traces when the app encounters errors.
• Legal authorities: we disclose personal data when required to comply with a valid court order, subpoena, or statutory obligation, or to protect the safety of our users.

International Data Transfers

Adaptive AI is operated from India. Our sub-processors (Supabase, Groq, Vercel, Sentry, Google) are headquartered in the United States. When your data is transferred outside India or the European Economic Area, we rely on: (a) the Standard Contractual Clauses (SCCs) approved by the European Commission, incorporated into our Data Processing Agreements with US sub-processors; and (b) adequacy decisions or equivalent transfer mechanisms where available. By using the Platform, you consent to your data being transferred to and processed in the countries where our sub-processors operate, subject to the safeguards described above.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide the service. Specific retention periods:

• Account and profile data: retained until you delete your account, plus 30 days for recovery purposes.
• Learning progress, certificates, and quiz scores: retained for the life of your account and exported upon request.
• AI conversation history: retained for 12 months, then automatically purged unless you delete it earlier.
• Usage and analytics logs: retained in aggregated, anonymised form for up to 24 months.
• Support communications: retained for 3 years from the date of the last interaction.
• Security and fraud-prevention logs: retained for up to 12 months.
• Financial records (if you make a purchase): retained for 7 years as required by Indian tax law.

Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These include:

• TLS 1.2+ encryption for all data in transit between your device and our servers.
• AES-256 encryption for data at rest in Supabase.
• Row-level security (RLS) policies in the database to ensure users can only access their own data.
• Bcrypt-hashed authentication tokens; we never store plaintext passwords.
• Regular dependency and security audits.
• Two-factor authentication available for user accounts.
• Limited staff access to production data on a need-to-know basis.

Children's Privacy

Adaptive AI is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. Users in the European Economic Area must be at least 16 years of age, or have verifiable parental consent, to use the Platform. If we become aware that we have collected personal data from a child under the minimum age without appropriate consent, we will delete that data promptly. If you are a parent or guardian and believe your child has registered without your consent, please contact us at support@adaptive-ai.app with the subject line "Child Account Removal" and we will act within 72 hours.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Right of Access: request a copy of the personal data we hold about you.
• Right to Rectification: ask us to correct inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): request deletion of your personal data, subject to legal retention obligations.
• Right to Data Portability: receive your learning data in a structured, machine-readable format (JSON or CSV).
• Right to Restriction of Processing: ask us to temporarily stop processing your data while a dispute is resolved.
• Right to Object: object to processing based on legitimate interests, including profiling for personalisation.
• Right to Withdraw Consent: where processing is based on consent (e.g., marketing emails), withdraw at any time without affecting prior processing.
• Right to Lodge a Complaint: if you are in the EU/EEA, you may lodge a complaint with your national Data Protection Authority (DPA). In India, you may contact the Data Protection Board of India once operational.

Marketing Communications

We will only send you marketing emails if you have explicitly opted in during registration or from your account settings. Every marketing email includes an unsubscribe link. You can also withdraw consent at any time by emailing support@adaptive-ai.app. Transactional emails (such as account confirmation, certificate issuance, and security alerts) are exempt from opt-out requirements as they are necessary for the service.

Third-Party Links

The Platform contains links to third-party websites and services, including job boards, external resources, and partner sites. This Privacy Policy applies only to Adaptive AI. We are not responsible for the privacy practices of any third-party website. We encourage you to review the privacy policy of every website you visit.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in the law, our practices, or the features we offer. When we make material changes, we will: (a) update the "Last updated" date at the top of this page; (b) notify registered users by email or in-app notification at least 14 days before the change takes effect. Your continued use of the Platform after the effective date constitutes acceptance of the updated policy. If you do not agree with the changes, you may delete your account before the effective date.

Governing Law

This Privacy Policy is governed by the laws of India, including the Information Technology Act 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011, and, once enacted, the Digital Personal Data Protection Act 2023. For users in the European Economic Area, we additionally comply with the General Data Protection Regulation (GDPR) as applicable.

Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us. We are committed to working with you to resolve any concerns.