Privacy Policy

The operator and data controller for GradiBee is SOPWIL. The Service is offered primarily for families in Sri Lanka.

Privacy and data-protection requests: privacy@gradibee.app. All other inquiries (accounts, billing, family credits, refunds, product): info@gradibee.app.

We process personal data in accordance with applicable Sri Lankan law, including the Personal Data Protection Act, No. 9 of 2022 (“PDPA”), to the extent it applies to us and to your use of the Service. Where the EU General Data Protection Regulation (“GDPR”) applies (for example if you are in the EEA or UK), we honour the right to erasure in Article 17 as described below.

This Policy applies to the GradiBee website and progressive web app (PWA) at gradibee.app and related domains we operate (including redirects such as www.gradibee.app).

It covers accounts for learners (typically Grades 5–13), parents or guardians, and administrators. It does not apply to third-party websites or services we link to (for example PayHere, FitSMS, or Google Gemini), which have their own privacy practices.

This Policy describes our practices as implemented in the Service. It does not create warranties beyond those required by law.

GradiBee is designed for school-age learners with parent or guardian involvement. Learners may optionally note a school grade (5–13) on their profile for information only. We do not collect date of birth as a separate field.

The household receives a limited signup trial (about 30 minutes of tutor time across subjects, on the parent). Tutor time counts when a learner chats or generates a practice paper, not while they are merely signed in. After the trial, continued access requires a parent or guardian subscription. Parents remain responsible for supervising minors’ use of the Service.

A parent creates an account at /takemein. Creating the account requires agreement to this Policy and the Terms of Service. Learners are added by a signed-in parent on Family (name and grade).

Parents may add learners on Family (name and grade), view family progress features, and (where enabled) open a short-lived read-only “observe” view of a linked learner’s space. Observe does not allow the parent to chat, submit practice papers, or change the learner’s Trail as that learner. If the household has no learners yet, a signed-in parent may try curriculum chat and practice papers on leftover signup-trial tutor time as themselves at /parent/try. That try session is the parent’s account (not a child identity), does not write Trail, Seals, or Pulse, and ends when they add a child.

Tutors are meant to stay on the subscribed grade and subject. Adult or off-subject questions are refused. This is not a warranty that every unsafe message is caught.

We do not knowingly sell children’s personal data. Parents can erase their own account and linked learner accounts from Profile. Learners can request erasure in-app; a linked parent reviews the request, then GradiBee completes it. If you believe a child has provided data inappropriately, you may also email privacy@gradibee.app. Completed erasure cannot be reversed.

Account and identity: for mobile-OTP parents, a Sri Lankan mobile number (`login_phone`) and optional verified email; for email parents, learners, and admins, an email address; optional hashed password; role (learner/student, parent, or admin); optional referral code; for learners, optional grade (informational only); optional display name; optional profile avatar image (stored as image bytes and MIME type, size-limited).

Parent create at /takemein: you may use email or a Sri Lankan mobile. Email create stores email, role (parent), and the times you accepted the Terms of Service and this Policy — we show a one-time password and email it plus parent guides from info@gradibee.app. Mobile create stores the number on login_phone (email stays empty until you verify one on Profile), hashed one-time codes with short expiry, and those same consent times — we send a 6-digit SMS code, create the parent when the code is verified, and sign you in. Learners are added by a signed-in parent on Family (name and grade), not via this public form.

Family and consent: parent–learner link (`linked_parent_id`); optional login username; learner sign-in email (plus-tag on the parent address for new children); consent granted time and method (for example parent link or guardian consent via a consent link).

Learning and product use: usage events (such as chat or practice-paper activity, hours, token counts, duration); subscription and pack records (hours, tokens, pricing); signup trial time remaining; GradiBee Trail progress, Echo teach-back excerpts, awards, glow-related scores, and related trail events; tutor notices and referral records.

Product feedback: optional in-app answers to short questions (ratings, choices, and free-text comments), which question was shown, the role at the time, and a derived sentiment label used to improve the Service. You can skip or postpone any question. Feedback is not required to use GradiBee.

Optional bug reports: if you tap Report a problem in Help, we collect the description you type, technical diagnostics (page path, app version, viewport, browser, language, and color scheme), and — only if you agree — a picture of the page or a photo you attach. These reports are filed as GitHub issues on SOPWIL/GradiBee for engineering. Bug reports are not required to use GradiBee.

Billing: order identifiers, amounts (typically LKR), SKU/pack information, status, payment-notify payloads from PayHere, and bank-deposit pay-in references. A Sri Lankan mobile number is collected at checkout when you pay with PayHere so wallets can complete; it is sent to PayHere and is not stored as an account field. We do not store full payment card numbers on GradiBee’s servers; card entry and card data are handled by PayHere’s checkout.

SMS delivery callbacks: FitSMS may POST delivery receipts to GradiBee when we register or change a sender ID, and after we send a code. Those receipts can include destination, sender id, status, and the message text. We acknowledge the callback so the sender ID can be saved. We do not store the message body or destination from that callback.

Technical data: authentication session cookies; a short-lived observe cookie when a parent observes a learner; IP addresses may be used transiently for rate limiting (for example adding children, OTP requests, and SMS delivery callbacks) and are not stored as a durable account field for that purpose.

We do not currently collect as account fields: legal name beyond optional display name, postal address, date of birth, school name, or precise device geolocation. Parent mobile numbers used for OTP sign-in are account identifiers as described above. If that changes, we will update this Policy.

Chat messages are sent to our servers to generate tutor replies but are not retained by GradiBee as durable chat transcripts. Echo excerpts and usage metrics are retained as described below.

We use personal data to: create and secure accounts; email one-time passwords and the matching student or parent guides; send SMS one-time codes to parent mobiles; provide curriculum-locked tutors, practice papers, and Trail features; enforce family linking, signup trial limits, and observe mode; process and record subscriptions and payments; measure pack usage (hours/tokens); prevent abuse, fraud, and security incidents; operate, maintain, and improve the Service; display aggregate, non-identifying platform statistics; and comply with law or respond to lawful requests.

We do not sell personal data. We do not use personal data to train third-party foundation models for our own commercial sale of datasets. Processing by Google Gemini is described in the next section.

When tutors run in live mode, learner messages, recent conversation context (kept briefly in server memory for the active chat session only — not written to Postgres), retrieved curriculum context, Echo teach-back text, a drawing sent as an answer to a draw question, and related metadata may be sent to Google Gemini to generate answers, checks, practice materials, or embeddings. Drawing bytes are not written to that memory or to Postgres.

GradiBee does not store durable chat transcripts in our database. Active chat context expires from server memory after about two hours or when you sign out. Echo excerpts and learning metrics may be stored in our database. Curriculum content we index is GradiBee-owned or otherwise authorised teaching material, not your private chat history.

Google processes that content under its own terms and privacy policies for Gemini. We do not control whether Google uses API inputs for its own model improvement beyond what our contracts and product settings allow. You should assume that content sent for AI generation leaves GradiBee’s systems and may be processed outside Sri Lanka.

AI outputs can be incomplete or incorrect. See our Terms of Service for educational disclaimers.

We use essential cookies for the Service to function: an Auth.js / NextAuth httpOnly session cookie for signed-in access (typically about 12 hours from login), and a short-lived httpOnly observe cookie (gradibee-observe, typically about 30 minutes) when a parent uses observe mode. If you tick Remember me on sign-in, we also store your mobile number, email, or username in the browser on that device so the field can be filled next time. We do not store your password or SMS code in that Remember me data.

We do not currently enable third-party product analytics cookies (for example PostHog). First-party operational analytics (usage, sessions, and billing funnels) are stored in our own database for platform operations and are covered by erasure / right-to-forget. Configuration for third-party tools may exist for future use; if we enable non-essential third-party tracking, we will update this Policy and, where required, seek appropriate consent.

You can clear cookies in your browser; doing so will sign you out and end observe sessions.

We use service providers that process data on our behalf or as independent operators of payment/AI/SMS infrastructure, including: Render (application hosting); Neon (PostgreSQL database); PayHere (payment processing); Google Gemini (AI generation and embeddings); FitSMS (transactional SMS one-time codes to parent mobiles); GitHub (optional in-app bug reports and screenshots filed as issues on SOPWIL/GradiBee); our mail host for transactional messages from info@gradibee.app (learner credentials, admin-created account passwords, and the matching student or parent guides).

These providers may process data under their own privacy policies. We encourage you to review PayHere’s and Google’s Gemini-related policies when you use checkout or live tutors.

Our hosting, database, payment, SMS, and Gemini AI processing may store or process data in countries outside Sri Lanka. By using the Service, you acknowledge that personal data may be transferred internationally as needed to operate GradiBee.

We take reasonable contractual and technical steps appropriate to our size and the Service, but we cannot guarantee that every foreign jurisdiction offers the same protections as Sri Lanka.

We retain account, learning, family, and billing records while your account remains active and for as long as reasonably needed thereafter for operations, security, dispute resolution, accounting, and legal compliance.

Account-request rows (emails and consent times) are kept while the request is open and for a reasonable audit period after it is fulfilled or declined. One-time SMS challenge hashes are kept until they expire, are used, or the related account is erased. Administrators may decline unfulfilled leftover requests. Erasure or permanent wipe of a related account anonymizes matching request emails and deletes that mobile’s OTP rows.

Session tokens last up to 12 hours from the moment you sign in (they are not extended by continued use). Observe grants are short-lived (on the order of about 30 minutes). Consent links may expire after a limited period (for example several days). An optional Remember me identifier (mobile, email, or username only) stays on the device until you untick Remember me or clear site data.

Trail progress counts and related awards may be retained in de-identified form after erasure. Echo teach-back text, in-app feedback answers, and other identifiers are removed when an account is erased. Linked GitHub bug-report issues are closed and the issue text is redacted; GitHub may still retain attachment URLs on their systems.

Parents can erase their account (and linked learners) in Profile. Learners can request erasure in-app; linked parents review the request and GradiBee completes it. Completed erasure cannot be reversed. We may limit repetitive in-app requests (for example one open request at a time, and a waiting period after a decline).

After erasure we keep only de-identified operational, billing, usage, and Trail metrics (no email, name, photo, password, mobile login, or payment payload). You may also email privacy@gradibee.app. Payment, SMS, and AI processors (PayHere, FitSMS, Google Gemini) may retain data under their own policies; GradiBee cannot wipe those copies.

We use measures appropriate to the Service, including password hashing, hashed short-lived SMS codes, HTTPS and HSTS in production, Content-Security-Policy, httpOnly session cookies, server-side chat context (not client-trusted history), and role-based access controls (including read-only observe for parents).

No method of transmission or storage is completely secure. We do not warrant absolute security. Please keep learner sign-in details private. Parents may add a password later on Profile; SMS codes are a sign-in factor and should not be shared.

Subject to the PDPA, GDPR Article 17 where it applies, and other applicable law, you may have rights to request access to, correction of, or deletion of personal data we hold about you, and to withdraw consent where processing is based on consent (for example certain guardian consent flows), without affecting the lawfulness of prior processing.

Parents or guardians may erase linked learner accounts in-app as described in this Policy, or contact us, subject to verification. We may refuse or limit requests where the law allows (for example excessive or repetitive requests, or where fulfilling a request would adversely affect others’ rights, security, or legal obligations).

To exercise rights in the product, use Profile (and, for learners, the parent and admin review flow). You may also email privacy@gradibee.app with enough detail for us to identify the account. We will respond within a reasonable period consistent with applicable law.

We do not sell personal data. We share personal data with processors and service providers as needed to run the Service; when required by law, regulation, legal process, or to protect SOPWIL, users, or the public; in connection with a merger, acquisition, or asset transfer (with notice where required); or with your direction or consent.

We may publish aggregate statistics that do not reasonably identify an individual (for example total usage counts on the landing page).

We send transactional SMS one-time codes for parent sign-in, and transactional account email from info@gradibee.app (learner credentials, admin-created passwords, the matching student or parent guides, and related login notices). We do not currently operate a marketing email or SMS list for GradiBee.

If we introduce marketing messages later, we will update this Policy and honour applicable consent and unsubscribe requirements.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be highlighted on the Service or communicated by other reasonable means.

Continued use of GradiBee after an update means you accept the revised Policy, except where mandatory law requires a different form of consent.

Questions about this Privacy Policy or personal data: privacy@gradibee.app. Hours, family credits, refunds, and all other inquiries: info@gradibee.app.

Please also read our Terms of Service and Refund Policy, which govern use of GradiBee, leftover hours, and payments.