This Privacy Policy explains how Polymath ("we", "us", "our") collects, uses, shares, and protects personal data when you use our learning platform.
This Policy is issued in accordance with the Personal Data Protection Act 2023 of Pakistan ("PDPA"), the Prevention of Electronic Crimes Act 2016, the Punjab Children Welfare Act 2018, and other applicable laws. Where you are resident in another jurisdiction (for example, the European Economic Area, the United Kingdom, or the United States), additional rights and protections may apply, and we will honour them where required by law.
A separate Children's Privacy & Parental Consent Notice describes specific protections for users under the age of eighteen (18). Please read both documents.
1. Who is the data controller?
The data controller is Polymath, a sole-proprietorship of Meer Feerasta ("M"), having a registered address in Lahore, Punjab, Pakistan.
Our Data Protection Officer ("DPO") can be contacted at dpo@polymath.feerasta.ai for any questions, requests, or complaints relating to your personal data.
2. What data do we collect?
We collect the following categories of personal data:
(a) Account data. Name, email address, mobile telephone number, password (stored only as a salted hash), preferred language, and similar account information provided at registration.
(b) Profile data for children. Where an Account Holder enrols a child, we collect the child's first name (or chosen nickname), date of birth (or age band), grade level, school name (optional), and the parent or guardian's relationship to the child.
(c) Learning activity data. Lesson progress, quiz answers, tracing attempts, time-on-task, achievements, certificates earned, and aggregate analytics.
(d) Voice and speech data. When a child uses voice features (Tutor Agent, Reading Coach, voice greetings), we collect short audio recordings, transcripts produced by automatic speech recognition, and metadata such as recording duration and locale. Voice data is treated as sensitive personal data.
(e) Device and technical data. IP address, device type, operating system, browser version, time zone, anonymised diagnostic logs, and crash reports. We collect minimum necessary data for security and reliability.
(f) Payment data. Where you subscribe to a paid plan, our payment provider collects card or wallet details directly. We receive only a transaction reference, masked card details (last four digits, brand), and the amount paid. We do not store full card numbers.
(g) Communications. Records of emails, WhatsApp messages, support tickets, and chat with our team.
(h) Cookies and similar technologies. As described in our Cookie Policy.
We do not knowingly collect biometric identifiers, racial or ethnic origin, religious beliefs, sexual orientation, political opinions, or trade union membership, except where strictly necessary and lawful (for example, the provision of an Urdu-script preference does not amount to processing of religious or ethnic data).
3. Why do we process your data?
We process personal data on the following lawful bases under the PDPA:
| Purpose | Lawful basis |
|---|---|
| To create and manage your account | Performance of contract |
| To deliver lessons, score answers, and personalise content | Performance of contract |
| To process payments and issue invoices | Performance of contract; legal obligation (tax) |
| To send transactional notifications (account confirmations, receipts, password resets) | Performance of contract |
| To send marketing newsletters | Consent (you may withdraw at any time) |
| To detect and prevent fraud, abuse, and security threats | Legitimate interests |
| To audit AI safety and review safeguarding flags | Legitimate interests; legal obligation |
| To comply with court orders, regulatory inquiries, and other lawful requests | Legal obligation |
| To improve, debug, and develop new features | Legitimate interests, with anonymisation where feasible |
Where you (or, for a child, the Account Holder) have given consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out beforehand.
4. With whom do we share your data?
We do not sell personal data. We share data only with the following categories of recipient and only to the extent necessary:
(a) Sub-processors and infrastructure providers. We host data on Supabase, Inc. (Tokyo region for the primary database; United States for control-plane services). Voice data is transcribed by OpenAI (Whisper API) and synthesised by ElevenLabs, both based in the United States. AI tutoring uses Anthropic, Inc. (United States). Live virtual classrooms run on Daily.co (United States). Email notifications are delivered via Resend (United States). WhatsApp messages are delivered via the WhatsApp Business Platform operated by Meta Platforms, Inc.
Each sub-processor is bound by a data-processing agreement requiring confidentiality, security, and use of data only for the purposes we instruct.
(b) Payment service providers. As listed in your subscription confirmation. They are subject to State Bank of Pakistan regulations and PCI DSS.
(c) School and donor administrators. If a child is enrolled through a school or a sponsorship programme, the school administrator and (where applicable) the named donor may receive aggregated progress reports. Only personal data necessary for the educational relationship is shared.
(d) Government, regulatory, and law-enforcement bodies. Where required by Pakistan law, including the Pakistan Telecommunication Authority, the Federal Investigation Agency, the Federal Board of Revenue, and the courts.
(e) Professional advisors. Lawyers, accountants, and auditors bound by professional duties of confidentiality.
(f) Successors. In the event of a corporate merger, acquisition, or asset sale, your data may be transferred to the successor entity, subject to equivalent privacy commitments.
5. Cross-border transfers
Several sub-processors are located outside Pakistan. By using the Service you acknowledge that personal data, including voice data, may be transferred to and processed in jurisdictions outside Pakistan, including Japan, the United States, and the European Union.
We rely on contractual safeguards (data-processing agreements with standard terms, including international transfer addenda where appropriate) and on the right of children's parents or guardians to withdraw consent at any time.
If the National Commission on Personal Data Protection issues binding adequacy determinations or transfer mechanisms in future, we will adapt our practices accordingly.
6. How long do we keep data?
We retain personal data only as long as necessary for the purposes for which it was collected.
| Category | Retention period |
|---|---|
| Account data | Until the account is deleted, plus thirty (30) days for backup purposes |
| Learning activity data | Until the account is deleted; aggregated and anonymised analytics retained indefinitely |
| Voice recordings (raw audio) | Up to ninety (90) days, then deleted |
| Voice transcripts | Until the account is deleted |
| Safeguarding flags | Up to seven (7) years, in line with child-protection guidance |
| Payment records and invoices | At least six (6) years, in line with tax law |
| Communications | Up to three (3) years from last contact |
You may request earlier deletion in accordance with Section 8.
7. How do we secure your data?
We apply industry-standard administrative, technical, and physical safeguards, including encryption in transit (TLS 1.2 or higher) and at rest, role-based access control, audit logging, vulnerability scanning, and least-privilege principles.
Despite our efforts, no system is perfectly secure. We will notify affected users and the National Commission on Personal Data Protection without undue delay if a personal data breach is likely to result in a high risk to your rights, in line with the PDPA.
8. Your rights
Subject to applicable law, you have the right to:
- (a) access the personal data we hold about you;
- (b) rectify inaccurate or incomplete personal data;
- (c) erase your personal data ("right to be forgotten") where the data is no longer necessary for the purposes collected, you have withdrawn consent, or processing is unlawful;
- (d) restrict processing of your personal data in certain circumstances;
- (e) port your personal data to another service provider in a structured, machine-readable format;
- (f) object to processing based on legitimate interests, including for direct marketing;
- (g) withdraw consent at any time, where processing is based on consent;
- (h) lodge a complaint with a competent data-protection authority, including the National Commission on Personal Data Protection in Pakistan.
To exercise any of these rights, write to dpo@polymath.feerasta.ai from the email address on your account, or use the Account Settings page. We will respond within thirty (30) days. We may verify your identity before acting on a request.
9. Children's privacy
Where the User is under the age of eighteen (18), additional protections apply. Please read the Children's Privacy & Parental Consent Notice, which forms part of this Policy.
10. Cookies
Please refer to our Cookie Policy.
11. Changes to this Policy
We may update this Policy from time to time. The version published at polymath.feerasta.ai/legal/privacy is the controlling version. Material changes will be notified to registered users by email at least thirty (30) days before they take effect.
12. Contact and complaints
- Privacy and data protection officer:
dpo@polymath.feerasta.ai - Postal: Polymath, [registered address], Lahore, Punjab, Pakistan
- Public contact directory:
/legal/contact - File a grievance:
/legal/grievance - National Commission on Personal Data Protection (when constituted): contact details to be published at the Ministry of Information Technology and Telecommunication.