Privacy Policy

Introduction

Nulu ("we", "us") operates the Nulu English Language Mastery Platform. This Privacy Policy explains how we collect, use, store, and protect the personal data of students, teachers, parents, and school administrators.

Data We Collect

We collect the following data to provide our educational services:

• Profile information: full name, email address, school affiliation, role (student/teacher/parent/admin), gender, grade level, preferred language
• Learning activity: reading progress, assessment scores, skill mastery levels, curriculum completion, vocabulary practice records
• AI interaction data: usage of the AI Teaching Assistant feature for teachers, including session timestamps
• Technical data: IP address, browser type, and device information collected automatically for security and performance
• Children's data: For students under 18, accounts are created by school administrators. We recommend schools obtain parental consent before enrolling students.

How We Use Your Data

• Delivering personalised English language learning experiences aligned to CEFR standards
• Tracking and reporting student progress to teachers, parents, and school administrators
• Adaptive learning: using AI to adjust difficulty, content recommendations, and learning progression
• Generating certificates and achievement records
• Platform security, error monitoring, and safeguarding

Data Storage and Security

Data is stored on Supabase cloud infrastructure (currently hosted in Asia-Pacific region). All data is encrypted in transit (TLS 1.2+) and at rest. Access is controlled through role-based authentication and server-side authorization checks.

Data Retention

Student learning data is retained for the duration of the school's active licence. Schools may request deletion of their data at any time. Individual users may request deletion through their school administrator.

Third-Party Services

We use the following third-party services to operate the platform. These services may process data outside of Saudi Arabia:

• Supabase — database, authentication, file storage (Asia-Pacific region)
• Vercel — web hosting and deployment (global CDN)
• Google Gemini — AI Teaching Assistant for teachers AND teacher-driven exercise generation from teacher-pasted vocabulary lists (US-based). Only the unit label, grade, CEFR level, and vocabulary words are sent; no student identifiers are transmitted.
• Daily.co — video sessions between teachers and students (US-based)
• Sentry — error monitoring (US-based)
• Google Imagen — AI-generated vocabulary illustrations, no student data transmitted (US-based)
• Resend — transactional email delivery for invitations and notifications (US-based)

We do not sell, rent, or share personal data with third parties for marketing purposes.

Your Rights

You have the right to:

• Access: Request information about what personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data
• Portability: Request your data in a portable format
• Withdraw Consent: Withdraw consent for data processing at any time

To exercise any of these rights, contact your school administrator or email us at the address below.

Children's Privacy

Our platform is designed for K-12 students (ages 5-18). Student accounts are created by school administrators — students cannot self-register. AI features are restricted by role. All content is designed to be age-appropriate and culturally suitable for GCC audiences.

Contact Us

For privacy-related enquiries or data requests, please contact your school administrator or reach us at:

support@nulu.me

For questions about data protection, please contact us at the email address above.