Privacy Policy

1. Who we are

The Platform is operated by Queen’s Education Group (Pvt) Ltd, a private company incorporated in Sri Lanka under the Companies Act No. 07 of 2007, Company Registration No. PV 00260107 (“Queen’s Education”, “we”, “us”), founded by and whose content is owned by Dr. Hayeshika Fernando.

Registered address: Queen’s Education Group (Head Office), Colombo 03, Sri Lanka

Privacy contact / Data Protection Officer: [email protected], 031 223 8073

Child-safety contact: [email protected]

2. Scope

This Policy explains what personal data we collect through the website and apps, how we use, share and protect it, and your rights. By using the Platform (or, for a child, by a parent or guardian allowing the child to use it) you acknowledge this Policy. Where the law requires consent, including a guardian’s consent for a child, we rely on it.

3. The personal data we collect

a. Account and profile

• Student’s first and last name.
• Mobile phone number, the login identity. It is required and verified by a one-time password (OTP) sent by SMS.
• Grade / academic year (e.g. Grade-5, AL-2026).
• Profile photo (optional and skippable). Photos are stored privately and shown only through short-lived signed links; they are never served from a public CDN.
• Home address, city, district, province and postal code.
• School and public-exam index number (optional).
• A system-generated student code and login timestamps.

We do not collect students’ email at sign-up (phone plus OTP only). Email is for staff, or if a student later adds one.

We do not collect date of birth, age, gender or national ID (NIC).

b. Authentication

Your phone number and OTP codes, and encrypted sign-in session tokens stored on your device.

c. Payment and orders

Records of payments, orders, items purchased, amounts, dates, coupon codes, and the buyer contact captured at checkout. We never receive or store your full card or bank credentials. Card and online-wallet details are entered on the payment gateway’s own hosted page (see Section 8).

d. Store delivery

For physical products we collect the recipient name, phone and delivery address.

e. Learning activity

Enrolments and access; classes and recordings watched and your progress; exam attempts, answers, scores and leaderboard position; live-class attendance; downloads; and study-pack ownership.

f. Voice support-call data (see Section 7)

Your live microphone audio, a call log (caller, agent, category, times, duration), and an audio recording of the call.

g. Support chat and tickets

The text you send to our support chat, help assistant and support tickets. Students can chat only with our staff, not with other students, and chat is text-only with no attachments.

h. Technical and usage data

Device type, operating system, app version, IP address, timestamps, a push-notification token (mobile), and aggregated in-house usage analytics. We use no third-party advertising, marketing or behavioural analytics tools, and we do not track you across other apps or websites.

i. Crash and error diagnostics (Android app)

If the Android app crashes or hits an error, a diagnostic report is sent to Firebase Crashlytics, a Google service, so that we can find and fix the fault. A report contains the technical details of the fault: the error and where in the app it happened, your device model, operating system version, app version, and an identifier generated by Crashlytics for the app installation. It does not contain your name, phone number, address, photo, messages or any class or payment information. The iOS app does not send crash reports.

4. Device permissions (mobile app)

We do not request location, contacts, calendar, or the ability to read your SMS.

5. How we use your information

To create and manage accounts and verify identity (phone plus OTP); to provide classes, live sessions, recordings, exams, materials and the store; to run the support voice line and chat; to process payments and refunds; to send reminders and updates; to keep the Platform secure and prevent abuse; to improve our content (aggregated where practicable); and to comply with the law. We do not sell your personal data and do not use it for third-party advertising.

6. Artificial-intelligence (AI) processing

• Help assistant: text you send is processed to find matching answers using AI (Google Gemini). Please do not share sensitive personal information in the chat.
• Exam preparation: teacher-uploaded exam PDFs are processed by Google Gemini to turn them into questions. This uses teacher content, not student personal data.

7. Voice support-call recording (important)

When you call our support line, every answered call is recorded (audio) for quality, training, dispute resolution and safety. Recordings and call logs are stored securely. Recordings are held as private, encrypted files and can be played back only by authorised supervisors through short-lived signed links, with access logged. Recordings are retained for 90 days from the date of the call, and are then automatically deleted.

8. How we share information (third parties)

We share personal data only as needed to run the service, with providers bound to protect it. We do not let them use your data for their own purposes and do not sell data.

We may also disclose data where required by law or court order, or to protect the safety of a child or any person, or our rights.

9. International transfers

Some providers store or process data outside Sri Lanka. Our file storage is in the European Union (AWS, Stockholm), and messaging, payment-adjacent and AI providers may be in the EU or the United States. We take steps to keep the data protected to a standard consistent with the PDPA.

10. Children’s privacy (important)

The Platform is intended for and used by children. A parent or guardian is responsible for registering the student, providing accurate information, and consenting to this Policy and the collection and use of the child’s data, including the child’s photo, home address and voice recordings. A guardian may at any time access, correct or delete the child’s data or withdraw consent at [email protected].

11. Legal basis

We rely on one or more of: consent (including a guardian’s); performance of our contract; legitimate interests in running and securing the service; and legal obligations.

12. Cookies and device storage

In the apps

The mobile and desktop apps do not use cookies. They store a small amount of data on your own device to keep you signed in, remember your language and appearance settings, and hold a push-notification token. Signing out clears the sign-in data.

On the website

We use cookies that are strictly necessary to run the site and keep you signed in, and device storage to remember your preferences. Usage measurement is done in house. We use no third-party advertising or behavioural analytics cookies.

Embedded video

When you play a video it is delivered by YouTube, Vimeo or Cloudflare. Playing a video allows that provider to set its own cookies or storage in your browser or app, and your IP address reaches them. We use YouTube’s no-cookie embed domain to reduce this, but it is not eliminated. See Section 8.

You can control or clear cookies in your browser settings. Blocking strictly necessary cookies may stop you signing in.

13. Data retention

We keep personal data only as long as we need it, and then delete or anonymise it. Our retention periods are:

We may keep data for longer where the law requires it, for example for accounting and tax records, or where it is needed for an ongoing dispute or investigation.

14. How we protect your data

Encrypted sign-in sessions; access controls and staff permissions with full audit logging; private, signed-URL delivery of student photos and media (never a public CDN); encrypted call recordings; on-screen content protection against screenshots on video screens; and two-factor authentication for staff accounts. No system is perfectly secure, but we work to protect your data and to notify affected users and the authority of a breach where the law requires.

15. Your rights

Subject to the PDPA, you (or a guardian) may access, correct, delete, or restrict or object to the use of personal data, withdraw consent, request account deletion, and complain to the Data Protection Authority of Sri Lanka. Contact [email protected].

Deleting an account

Our students are children, so an account can only be deleted at the request of a parent or guardian. You can make that request in any of these ways:

• in the app, under Settings → Privacy → Request account deletion;
• on the web at hayeshikafernando.lk/delete-account;
• through our in-app support chat, or by calling our support line on 031 223 8073.

We confirm every request with the parent or guardian by sending a verification code to the mobile number registered on the account. Once confirmed, the account is suspended straight away and the personal data is deleted or anonymised within 30 days. Payment and accounting records are kept for the period set out in Section 13, because the law requires it.

16. Changes to this Policy

We may update this Policy and will post the new version with an updated date. Significant changes are notified through the website, a message or email.

17. Contact us

Queen’s Education Group (Pvt) Ltd (PV 00260107)

Queen’s Education Group (Head Office), Colombo 03, Sri Lanka

Privacy / Data Protection: [email protected] · Child safety: [email protected]

Telephone: 031 223 8073 · hayeshikafernando.lk