Privacy Policy

1. Introduction and Scope

Adhita Xpobox Private Limited (“Company”, “we”, “us”, or “our”) operates the Xpobox educational technology platform, accessible via https://adhitaxpobox.app, including all associated software, mobile/web interfaces, 3D simulations, AI learning tools, and physical laboratory kits (collectively, the “Platform” or “Services”).

We are committed to protecting the privacy, safety, and personal data of our users—especially children and students in Classes 6 through 8. This Privacy Policy explains our practices regarding the collection, storage, processing, and protection of personal data in strict compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act, India), applicable information technology laws, and international standards for children’s online safety.

2. Special Protections for Children & Minor Users

Xpobox is designed as a phydigital learning companion for school-aged students. Because our users include minors:

• No Commercial Sale of Data: We never sell, rent, or trade student personal data, learning history, or telemetry to third parties or data brokers under any circumstances.
• Zero Behavioral Advertising: The platform contains absolutely zero third-party behavioral advertisements, sponsored targeting, or promotional marketing tracking for children.
• Parental Involvement: We encourage parent/guardian oversight. Our Parent Mastery Portal provides parents with transparent visibility into learning progress, conceptual breakthroughs, and cognitive recaps.

3. Information We Collect

We collect information strictly necessary to provide high-quality educational experiences:

• Account Information: When an account is registered, we collect the account creator’s email address, display name, and authentication tokens (via Google Sign-In or Firebase Authentication).
• Educational Interaction & Telemetry: Quiz responses, completed chapter levels, stars earned, simulation experiment runs, and interactive 3D model exploration time.
• AI Socratic Chat & Classroom Transcripts: Prompts submitted by students to the Socratic AI Tutor or Virtual Classroom are processed in real-time to generate educational explanations, step-by-step hints, and debate dialogues.
• Physical Kit Shipping Details: When ordering the Phydigital Science Kit, we collect shipping addresses, recipient names, and delivery phone numbers purely for logistics and order fulfillment.
• Technical Logs: Device type, browser user-agent, IP address, and anonymized diagnostic error logs to maintain system security and uptime.

4. How We Use Collected Information

The information collected is used solely for pedagogical and operational purposes:

• To adapt AI hints according to our 4-tier Socratic pedagogical ladder (zero-answer-blurt heuristics).
• To maintain the Living Student Model and spaced-repetition memory retention tracking (Second Brain engine).
• To generate weekly parent progress recaps and mastery dashboards.
• To fulfill orders for physical experiment equipment and kits.
• To detect, prevent, and remediate technical bugs or unauthorized abuse.

5. Third-Party Service Providers (Subprocessors)

We partner only with industry-leading, ISO 27001/SOC2-certified cloud infrastructure providers to host and secure our platform:

• Google Cloud Platform (GCP) & Vertex AI: Cloud compute, serverless hosting, and foundation model inference (Gemini models) for cognitive scaffolding and pedagogical reasoning.
• Google Firebase: Secure user authentication and Firestore encrypted database storage.
• Vercel Inc.: Global CDN edge hosting and web application delivery.

All subprocessors are contractually bound to maintain strict confidentiality and data security, and are prohibited from using personal data for any purpose other than providing contracted infrastructure services.

6. Data Retention and Security

We implement robust security measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, and strict role-based access controls.

Generated multi-agent virtual classroom sessions are subject to our 45-day cloud retention policy, after which archived session audio and temporary slide states are automatically purged from active storage to conserve resources and protect student privacy.

7. Your Rights (DPDP Act, 2023)

Parents, legal guardians, and users have the following statutory rights regarding their personal data:

• Right to Access: Request a copy of the personal and educational telemetry data we hold about you.
• Right to Correction & Erasure: Request the correction of inaccuracies or complete deletion of your account and associated learning history.
• Right to Withdraw Consent: Withdraw consent for data processing at any time, leading to account closure.
• Right to Grievance Redressal: Submit inquiries or grievances to our dedicated Grievance Officer.

8. Grievance Redressal Officer & Contact Information

In compliance with the Information Technology Act, 2000 and the DPDP Act, 2023, the details of our Grievance Officer and corporate contact are:

9. Changes to this Policy

We may periodically update this Privacy Policy to reflect platform enhancements or statutory changes. Any material updates will be posted prominently on this page with an updated “Last Updated” date.