Privacy Policy

Introduction

Nulu ("we", "us") operates the Nulu English Language Mastery Platform. This Privacy Policy explains how we collect, use, store, and protect the personal data of students, teachers, parents, and school administrators in compliance with the Saudi Personal Data Protection Law (PDPL) issued by the Saudi Data and Artificial Intelligence Authority (SDAIA).

Data We Collect

We collect only the data necessary to provide and improve our educational services:

• Profile information: full name, email address, school affiliation, role (student/teacher/parent/admin), gender, grade level, preferred language
• Learning activity: reading progress, assessment scores, skill mastery levels, curriculum completion, vocabulary practice records
• AI interaction metadata: timestamps and usage counts for AI Teaching Assistant sessions (message content is not stored)
• Technical data: IP address, browser type, and device information collected automatically for security and performance
• Children's data: For students under 18, all data is collected with the school's authorisation acting in loco parentis. Parental consent is recorded where applicable.

How We Use Your Data

• Delivering personalised English language learning experiences aligned to CEFR standards
• Tracking and reporting student progress to teachers, parents, and school administrators
• Adaptive learning: adjusting difficulty, spaced repetition, and content recommendations
• Generating certificates and achievement records
• Platform security, fraud prevention, and safeguarding

Data Storage and Security

All data is stored on Supabase infrastructure. Database access is protected by Row-Level Security (RLS) policies ensuring users can only access data appropriate to their role. All data is encrypted in transit (TLS 1.2+) and at rest. We target migration to AWS Bahrain (me-south-1) region for Saudi data residency requirements.

Data Retention

Student learning data is retained for the duration of the school's active licence plus 12 months. Upon licence expiry or school request, all student data is permanently deleted. Individual users may request deletion at any time through their school administrator.

Third-Party Services

We use the following third-party services to operate the platform:

• Supabase (database, authentication, file storage)
• Vercel (web hosting and deployment)
• Google Gemini (AI Teaching Assistant for teachers only)
• Daily.co (video sessions between teachers and students)
• Sentry (error monitoring — no personal data transmitted)
• Google Imagen (AI-generated vocabulary illustrations — no student data transmitted)
• Resend (transactional email delivery for invitations and notifications)

We do not sell, rent, or share personal data with third parties for marketing purposes.

Your Rights Under PDPL

Under the Saudi Personal Data Protection Law, you have the right to:

• Access: Request a copy of all personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request permanent deletion of your personal data
• Portability: Receive your data in a machine-readable format (JSON)
• Withdraw Consent: Withdraw consent for data processing at any time

To exercise any of these rights, contact your school administrator or email us at the address below. We will respond within 30 days.

Children's Privacy

Our platform is designed for K-12 students (ages 5-18). We take special care to protect children's data. Student accounts are created by school administrators — students cannot self-register. AI features are restricted by role (students do not have access to the AI Teaching Assistant). All content is age-appropriate and culturally suitable for GCC audiences.

Contact Us

For privacy-related enquiries, data access requests, or to report a concern, please contact your school administrator or reach us at:

privacy@ctss-edu.com

Data Protection Officer details will be published upon appointment as required by PDPL.