This Notice describes the additional protections that apply when a user of Polymath ("the Service") is under the age of eighteen (18) years. It is to be read together with the Privacy Policy.
Polymath is designed for children aged approximately four (4) to fifteen (15), and many of our users are below the age at which Pakistan and other jurisdictions require parental consent for online data processing. We take this responsibility seriously.
1. Who can sign up a child?
Only the child's parent or legal guardian, or an authorised institutional representative (such as a school administrator) acting under a written consent from the parent or guardian, may create an account for a child on Polymath.
By creating a child profile, you confirm that:
- (a) you are the parent, legal guardian, or duly authorised institutional representative of the child;
- (b) you consent to Polymath collecting and processing the child's personal data, including voice recordings, as described in this Notice and the Privacy Policy;
- (c) you understand that you may withdraw consent at any time and that you may request deletion of the child's data.
We log your consent timestamp, IP address, and the version of this Notice in force at the time, in line with PDPA-2023 record-keeping requirements.
2. What data do we collect from children?
We collect only the personal data reasonably necessary to provide the educational service, including:
- (a) first name or chosen nickname (last names are optional and discouraged);
- (b) age band or date of birth (used to set lesson difficulty; age is never displayed to other users);
- (c) preferred language (English or Urdu) and grade level;
- (d) responses to learning activities (tracing strokes, quiz answers, reading recordings, voice replies to the Tutor Agent);
- (e) progress, achievements, time-on-task, and aggregated performance metrics;
- (f) device and basic technical data necessary for security and reliability.
We do not request from children, and ask Account Holders not to provide on a child's behalf, the following: home address, school identification number, national identification number (CNIC), photograph or video of the child's face, religious or ethnic information, telephone number, or any password the child uses elsewhere.
3. Voice and speech data
The Service uses voice features as a deliberate accessibility choice, because many of our users (and their parents) cannot read English or Urdu. Voice features include the Tutor Agent, the Reading Coach, and voice greetings on lesson pages.
When a child speaks into the Service:
- (a) a short audio recording is captured locally in the browser or app and streamed to our servers over an encrypted connection;
- (b) the audio is transcribed using a third-party automatic speech recognition service (currently OpenAI Whisper, United States);
- (c) the transcript and a derived score (accuracy, fluency) are stored against the child's account;
- (d) the raw audio is retained for up to ninety (90) days for safeguarding review and platform debugging, then automatically deleted;
- (e) we do not use children's voice recordings to train any third-party AI model. Sub-processors are contractually prohibited from using the data for training.
Synthesised speech delivered to the child by the Service (mascot voice, narration) is generated by ElevenLabs (United States) from text we send. The synthesised audio is cached on our servers and reused to keep costs low; the underlying text reflects educational content authored by Polymath.
4. Safeguarding
Polymath operates an automated safeguarding system that scans children's voice and text input for indicators of distress, disclosure of abuse, self-harm, or unsafe environments. When the system raises a flag, the following happens:
- (a) the flag is logged with severity, category, and a short excerpt;
- (b) urgent flags are forwarded by automated alert (containing only the flag identifier and severity, without the child's words) to a designated reviewer at Polymath;
- (c) the reviewer reads the full flag in our admin tool and decides whether to act;
- (d) where the flag indicates a credible risk to a child's safety, Polymath may, at its discretion and where consistent with Pakistan law, contact the child's parent or guardian and, in cases of suspected criminal conduct, the relevant authorities.
We are not a substitute for a doctor, counsellor, child protection officer, or law-enforcement agency. Parents and guardians remain primarily responsible for the welfare of their children. If you believe a child is in immediate danger, please contact local emergency services (Rescue 1122, the Madadgaar National Helpline 1098, or the Punjab Helpline for Children 1121).
Lawyer note (to be reviewed): Pakistan does not yet impose a general statutory duty on private digital platforms to report suspected child abuse, but the Punjab Children Welfare Act 2018 and the Sindh Child Protection Authority Act 2011 create specific reporting and cooperation duties. We will follow lawful directions from the relevant Child Protection Authority and from courts.
5. Mandatory parental consent — what we ask, when
The first time a parent or guardian creates a child profile, we present:
- A summary of what data the child will share (name, age band, voice, learning answers).
- A summary of who processes that data (Polymath plus listed sub-processors).
- A summary of cross-border transfer (United States, EU).
- A clear "I am the parent or legal guardian" affirmation checkbox.
- A clear "I have read and accept the Terms, Privacy Policy, and this Children's Privacy Notice" checkbox.
The submit button is disabled until both checkboxes are ticked. We capture timestamp, IP address, and the document versions in force.
We re-prompt for consent any time we make a material change to (a) the categories of data collected, (b) the sub-processors used, or (c) the purposes of processing.
6. School and donor enrolment
If your child is enrolled by a school or sponsored by a donor through Polymath:
- (a) the school must obtain your consent on a paper or electronic form prior to enrolment, and provide that form to Polymath on request;
- (b) only aggregated and anonymised progress reports are shared with donors; specific learning records, voice recordings, and individualised dashboards are visible only to authorised school staff and to you as the parent or guardian;
- (c) you retain the right to withdraw consent at any time, in which case we will delete the child's account and associated personal data within thirty (30) days, save where retention is required by law (for example, financial audit records).
7. Your rights as a parent or guardian
In addition to the rights set out in our Privacy Policy, you have the right to:
- (a) view all personal data and learning records associated with your child's account;
- (b) request rectification of any inaccurate data;
- (c) request deletion of any or all personal data, subject to lawful retention (for example, safeguarding flags retained per Section 8);
- (d) export your child's progress in a machine-readable format;
- (e) refuse or withdraw consent at any time, including for a specific feature (for example, voice agents) while continuing to use the rest of the Service.
To exercise any of these rights, write to dpo@polymath.feerasta.ai.
8. Retention of safeguarding records
For the protection of children, safeguarding flags and the underlying excerpts may be retained for up to seven (7) years. They are stored encrypted, with strict access control, and are reviewed only by Polymath staff trained in child-protection handling, and on lawful order by competent authorities. We will not disclose them otherwise.
9. No targeted advertising
We do not, and will not, serve targeted advertising to children. We do not share children's data with advertising networks, ad-tech companies, or analytics services that profile users for advertising purposes.
10. Updates and complaints
We may update this Notice from time to time. Material changes will trigger a fresh consent prompt to Account Holders. The version published at polymath.feerasta.ai/legal/childrens-privacy is the controlling version.
For complaints, contact dpo@polymath.feerasta.ai. You also have the right to complain to the National Commission on Personal Data Protection or to the Punjab Child Protection and Welfare Bureau.