Neurema Privacy Policy

1) Who we are and how to contact us

Neurema ("Neurema", "we", "us") operates the Services.

• Email: neurema.in@gmail.com
• Postal address: No.24, 2nd Floor, Karna Shree Layout, 1st Cross, Medahalli, Virgonagar Post, Bengaluru, Karnataka, India 560049
• Grievance Officer (India): To be updated
• Email: neurema.in@gmail.com
• Address: Bangalore, Karnataka, India
• Phone: To be updated

2) What we collect

We aim to collect only what we need to provide the Services.

2.1 Account and profile

• Basic account identifiers (e.g., name or display name, email/phone if provided, password hash)
• Institution ID or class/roster information (if your account is provisioned by a school/organization)

2.2 Learning activity (treated as personal data when linked to an account)

• Topics you add, study schedules, timers, checklists
• Practice answers, scores, progress, and review cadence
• In-app interactions (e.g., taps/clicks, session timestamps) used to power recall scheduling and insights

2.3 Device and app data

• App version, device type, operating system, crash logs, and performance diagnostics
• Country/region (coarse), language, time zone

2.4 Cookies and similar technologies

Cookies or local storage on web to keep you signed in, remember preferences, and measure basic usage

2.5 Payments (future feature)

Free through 31 January 2026 (IST). We are not collecting payment information during the free access period. After paid plans launch, payment data will be handled by processors (e.g., Stripe, Razorpay) according to their policies; we do not store full card numbers.

2.6 What we do not collect

• We do not collect biometric or health data (e.g., EEG) at this time.
• We do not require government IDs.

3) Why we use your information (purposes)

• Provide the Services, including recall scheduling, progress tracking, and helpful study nudges
• Maintain safety, integrity, and performance of the Services (e.g., security, debugging, preventing misuse)
• Communicate with you about changes, features, or support
• For institution users: provide progress dashboards and reports to authorized educators/administrators
• Improve the Services via analytics and de-identified/aggregated insights
• Comply with law and enforce our Terms and Conditions

4) Legal bases / lawful grounds

Depending on your region, we rely on one or more of the following legal bases:

• Consent (e.g., parental/guardian consent for child accounts; optional analytics preferences)
• Contract (to provide the Services you request)
• Legitimate interests (to secure and improve the Services, prevent fraud/misuse)
• Legal obligation (to comply with applicable law or requests from authorities)

5) Children’s privacy and consent (all ages supported)

Neurema is designed for learners of all ages. Where required by local law, children and minors must use Neurema with verifiable parental/guardian consent or through their school/institution.

5.1 Parental consent workflow (how we verify)

At sign-up (or when an account is created by a school), we use one of the following lawful methods:

1. Parent/guardian email link: A consent link is sent to the parent/guardian email. Consent is recorded upon confirmation.
2. One-time code: A code is sent via email/SMS to a verified parent/guardian contact and must be entered to activate the account.
3. School-managed consent: A school/organization may create student accounts under a roster, confirming it has obtained all required consents and notices from parents/guardians.

We may ask for minimal information to verify the requester’s identity and relationship to the child. If consent is not provided within a reasonable time, the account may be limited or deleted.

5.2 Parent/guardian rights

Parents/guardians can review, correct, or request deletion of a child’s personal data processed for the Services and withdraw consent at any time by emailing neurema.in@gmail.com. We will respond within applicable legal timeframes and may need to verify identity.

5.3 Additional protections for children

• We do not use children’s data for targeted advertising.
• We do not sell children’s personal data.
• We limit profiling to what is strictly necessary to provide study and recall features.

6) Institution and classroom use

• Schools/organizations may provision and manage accounts and assign topics/schedules.
• Neurema processes learning data to provide Services to the institution and enrolled learners.
• Institutions may receive dashboards/reports about learner progress for educational purposes.
• Institutions must ensure they have provided appropriate notices and obtained any required parental/guardian consent.
• Off-boarding: when an institution ends its relationship with Neurema, we follow the agreement and this Policy for data export, deletion, or converting to a personal account (with parent/guardian approval for child accounts).

7) Analytics and improvement

We use analytics (which may include de-identified or aggregated data) to understand feature usage, performance, and to improve scheduling and insights. Where required, we will request your consent or provide an opt-out.

8) Sharing your information

We share personal data only as needed to provide the Services or as required by law:

• Service providers (e.g., cloud hosting, analytics, customer support). They must follow our instructions and protect your data.
• Payment processors (future feature): Stripe, Razorpay, or similar providers to handle payments when paid plans launch.
• Institution administrators/teachers for institution-managed accounts.
• Legal and safety reasons (e.g., complying with lawful requests, enforcing our Terms, protecting rights and safety).
• Business changes (e.g., merger or acquisition). We will continue to protect your data and notify you where required.

We do not sell personal data.

9) International transfers

We may store or process data in countries other than yours. When we transfer personal data internationally, we use appropriate safeguards permitted by law (for example, standard contractual clauses or equivalent mechanisms) to protect your information.

10) Security

We use administrative, technical, and physical safeguards designed to protect personal data (e.g., encryption in transit, access controls, logging, least-privilege practices). No system is perfectly secure, so we encourage you to keep your credentials safe and notify us of any suspected issues.

11) Data retention

We keep personal data only as long as necessary to provide the Services, comply with law, resolve disputes, and enforce agreements. Typical examples:

• Account data: retained while your account is active and for a limited period after deletion (for backups/legal).
• Learning activity: retained while needed to power recall scheduling and progress features; deleted or de-identified after account deletion.
• Institution data: follows the applicable agreement and off-boarding process.

You can request deletion at any time (see Section 13).

12) Your rights and choices

Depending on your region, you may have rights to:

• Access and portability (get a copy of your data)
• Correction (fix inaccurate information)
• Deletion (ask us to delete your data)
• Withdraw consent (where processing is based on consent)
• Object or restrict certain processing (where permitted by law)

To exercise these rights, email neurema.in@gmail.com. We will verify your request and respond within the time required by law. For child accounts, we will verify the parent/guardian.

13) Cookies and similar technologies

You can control cookies through your browser or device settings. Disabling certain cookies may impact core functionality (e.g., staying signed in). Where required, we display a banner or settings to manage consent for non-essential cookies.

14) Third-party sites and services

The Services may link to third-party websites or services we do not control. Their privacy practices are governed by their policies, not this one.

15) Changes to this Policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice (e.g., email, in-app message, or site banner). The updated Policy takes effect on the stated effective date.

16) Region-specific information (summary)

• India: We honor applicable children’s data protections and grievance redressal requirements. Contact the Grievance Officer listed above.
• EU/EEA/UK: We apply the legal bases described in Section 4, respect local age-of-consent rules for online services (typically 13–16 with parental authorization), and use appropriate transfer safeguards.
• US (including COPPA contexts): For users under 13, we obtain verifiable parental consent before collecting personal information.

17) Definitions

• Personal data / personal information: Information relating to an identified or identifiable person (including when linked to an account or device identifier).
• Learning activity / learning data: Topics, answers, scores, scheduling, timers, progress, and interaction events used to power study features.
• De-identified / aggregated data: Data that cannot reasonably be used to identify a person. We do not attempt to re-identify such data.