Privacy Policy

Last Updated: February 7, 2026  |  Effective Date: February 7, 2026

1. Introduction

Welcome to Kintrix Robotics ("we," "us," "our," or the "Company"). We operate an online learning platform accessible at computedynamics.com and its subdomains (collectively, the "Platform"), which provides STEM-focused courses, lab activities, and educational resources to schools, teachers, and students.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you access or use our Platform. It applies to all users, including school administrators, teachers, students, and parents or guardians.

We are committed to protecting your privacy. We do not sell, rent, or monetize personal data. We collect and process data solely for the purposes of delivering, securing, and improving our educational services.

This Privacy Policy is designed to comply with applicable laws in India (including the Digital Personal Data Protection Act, 2023) and the United States (including COPPA, CCPA/CPRA, and FERPA-aligned best practices).

2. Information We Collect

2.1 Account Information

When an account is created — either by you, by a school administrator on your behalf, or through self-registration — we collect the following:

Data Element	Purpose
First name and last name	Identity and display within the Platform
Email address	Authentication, account recovery, and communication
Username	Login credential
Password	Authentication (stored only as a cryptographic hash; we never store plaintext passwords)

2.2 Student Profile Information

For student accounts, we may also collect:

• Grade level — to assign age- and level-appropriate coursework
• Class section — to organize students within school rosters
• Display name — for identification within the classroom environment

2.3 Educational Records

As students use the Platform, we collect and maintain the following educational data:

• Course enrollments — which courses and classes a student is enrolled in
• Lesson and activity completion status — tracking of progress through course weeks, pages, and checklists
• Quiz attempts and responses — submitted answers, scores, and grading data
• Assignment completion records — status and timestamps of completed assignments
• Badges and achievements — awards earned based on course milestones
• Certificates — records of issued course-completion certificates
• Attendance records — presence/absence status and related notes as recorded by teachers

2.4 Teacher and Administrator Data

For teacher and administrator accounts, we collect:

• Account information (as described in Section 2.1)
• Role assignments (e.g., teacher, school administrator, tenant administrator)
• Class assignments and course management activity
• Attendance marking and grading activity
• Support ticket content (messages related to student support)

2.5 Automatically Collected Technical Data

When you access the Platform, we automatically collect certain technical information:

• IP address — for security, rate limiting, and access control
• Browser type and version — transmitted via standard HTTP headers
• Device type and operating system — transmitted via standard HTTP headers
• Pages accessed and timestamps — standard web server logs
• Authentication events — login and logout timestamps for security monitoring

We do not use third-party analytics trackers, advertising pixels, or behavioral profiling tools.

2.6 Cookies and Local Storage

We use a minimal set of cookies and browser storage mechanisms strictly necessary for Platform functionality:

Mechanism	Name	Purpose	Duration
Cookie	kintrix_access_token	Authentication (JWT access token)	Session (cleared when browser closes)
Cookie	kintrix_id_token	Authentication (JWT identity token)	Session (cleared when browser closes)
Cookie	kintrix_oauth_state	CSRF protection during login	5 minutes
Local Storage	UI preference keys (e.g., selected school year)	Remembering display preferences	Persistent until cleared

All authentication cookies are set with HttpOnly, SameSite=Lax, and Secure (in production) flags. They are not accessible to client-side JavaScript and cannot be used for cross-site tracking.

We do not use advertising cookies, third-party tracking cookies, or fingerprinting technologies.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

Purpose	Legal Basis
Authentication and access control — verifying your identity and enforcing role-based permissions	Necessary for service delivery; legitimate interest in security
Educational service delivery — providing courses, tracking progress, issuing certificates and badges	Performance of our service agreement
Classroom management — enabling teachers and administrators to manage rosters, attendance, and assignments	Necessary for service delivery
Student support — facilitating support tickets between teachers and administrators	Legitimate interest in educational support
Platform security — rate limiting, token revocation, fraud prevention, and audit logging	Legitimate interest in security
Service improvement — analyzing aggregated, non-identifiable usage patterns to improve the Platform	Legitimate interest in product improvement
Communication — contacting you regarding your account, service updates, or policy changes	Necessary for service delivery; consent where required

We do not use personal data for advertising, marketing to third parties, or automated decision-making that produces legal or similarly significant effects.

4. Authentication and Identity Management

4.1 Keycloak Identity Provider

We use Keycloak, a self-hosted, open-source identity and access management system, to manage user authentication. Keycloak is hosted on our own infrastructure — your credentials are not sent to any third-party authentication service.

Keycloak manages:

• Username and password verification (passwords are cryptographically hashed)
• Issuance of authentication tokens (JSON Web Tokens / JWTs)
• Role assignments (student, teacher, school administrator, tenant administrator)
• Session management

4.2 Authentication Flow

When you log in:

1. You are redirected to our Keycloak authentication server
2. You enter your credentials directly on our authentication server
3. Upon successful authentication, secure session cookies are set in your browser
4. These cookies are validated on every subsequent request

4.3 Multi-Tenant Architecture

The Platform operates a multi-tenant architecture where each school or organization is isolated in its own authentication realm. This means:

• Your credentials and profile are accessible only within your school's environment
• Administrators of one school cannot access users from another school
• Data isolation is enforced at both the authentication and database layers

4.4 Social Login

The Platform architecture supports social login via OpenID Connect. If your school enables social authentication (e.g., Google OAuth), the following applies:

• We request only basic profile scopes: name, email address, and profile picture URL
• We do not request access to your contacts, files, calendar, or any other data
• We store only the information necessary for account creation and login
• You may revoke social login access at any time through the respective provider's account settings

Note: Social login availability depends on your school's configuration. Not all schools enable social login.

5. Data Sharing and Third-Party Processors

We do not sell, rent, or trade personal data. We share data only with the following categories of service providers, strictly as necessary for Platform operation:

5.1 Infrastructure Providers

Provider	Service	Data Processed	Location
Microsoft Azure	Cloud hosting (compute, database, storage, key vault)	All Platform data (encrypted at rest and in transit)	East US and Central US regions
Cloudflare	DNS management, DDoS protection, TLS termination	IP addresses, request metadata (URLs, headers)	Global edge network
Azure Blob Storage	Static asset delivery (course images, fonts, CSS/JS)	IP addresses from browser asset requests	East US

5.2 Data Sub-Processors

Component	Provider	Purpose
PostgreSQL Database	Microsoft Azure (Flexible Server)	Primary data storage; SSL-encrypted connections
Redis Cache	Self-hosted on Azure VM	Session management, rate limiting, token revocation
Keycloak	Self-hosted on Azure VM	Identity and access management

5.3 Font Delivery

The Platform may load web fonts from Google Fonts (fonts.googleapis.com). When loaded, your browser makes a direct request to Google's servers, which may expose your IP address and browser metadata to Google. Google's Privacy Policy applies to these requests.

5.4 Legally Required Disclosures

We may disclose personal data if required to do so by law, regulation, legal process, or enforceable governmental request, including:

• Compliance with applicable Indian or U.S. law
• Response to valid subpoenas, court orders, or government investigations
• Protection of the rights, property, or safety of our users or the public

5.5 School Administrators

Within a school tenant, administrators with appropriate roles may access:

• Student rosters and enrollment records
• Attendance records and academic progress
• Teacher activity and class management data
• Aggregated analytics (enrollment funnels, completion rates, attendance trends)

This access is necessary for school operational purposes and is subject to the same data protection obligations.

6. Data Storage and Security

6.1 Where Your Data Is Stored

Data Type	Storage Location	Encryption
User accounts and profiles	Azure PostgreSQL (Central US)	Encrypted at rest (Azure-managed keys); SSL in transit
Authentication credentials	Keycloak on Azure VM (East US)	Passwords are cryptographically hashed; SSL in transit
Session and cache data	Redis on Azure VM (East US)	In-memory with AOF persistence; encrypted in transit
Secrets and API keys	Azure Key Vault (East US)	Hardware Security Module (HSM)-backed encryption
Static assets (images, CSS, JS)	Azure Blob Storage (East US)	Encrypted at rest

6.2 Security Measures

We implement the following technical and organizational security measures:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher
• Encryption at rest: All database storage is encrypted using Azure-managed encryption keys
• Access control: Role-based access control (RBAC) enforced at the application, API, and database layers
• Authentication tokens: JWTs are signed using RSA cryptography and validated on every request
• Token revocation: Compromised tokens can be immediately invalidated via a Redis-backed blocklist
• Network security: Production servers are protected by Network Security Groups (NSGs) restricting access to authorized IP ranges
• Secret management: All credentials, API keys, and certificates are stored in Azure Key Vault
• HttpOnly cookies: Authentication tokens are stored in HttpOnly cookies, preventing access from client-side scripts
• CSRF protection: OAuth state parameters protect against cross-site request forgery
• Rate limiting: Per-IP and per-tenant rate limits protect against brute-force attacks
• Security headers: Standard security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Content-Security-Policy) are applied to all responses

6.3 Incident Response

In the event of a data breach or security incident:

• We will investigate and contain the incident promptly
• Affected users and, where applicable, their schools or guardians will be notified without unreasonable delay
• Relevant regulatory authorities will be notified as required by applicable law
• We will take corrective measures to prevent recurrence

We do not guarantee absolute security. No system connected to the internet is completely immune to security threats. However, we strive to implement industry-standard protections appropriate to the sensitivity of the data we process.

7. Children's Privacy and Student Data Protection

7.1 COPPA Compliance (United States)

The Platform is designed to be used by students in school settings, which may include children under 13 years of age. We comply with the Children's Online Privacy Protection Act (COPPA) as follows:

• School consent: When the Platform is used through a school, the school acts as the agent of the parent for the purpose of providing consent under COPPA. Schools are responsible for obtaining any necessary parental consent before creating student accounts.
• Minimal data collection: We collect only the information reasonably necessary to provide educational services.
• No behavioral advertising: We do not serve targeted advertising to any user, including children.
• No social features: The Platform does not include public chat rooms, forums, or social networking features accessible to students.
• Parental rights: Parents may contact their school or contact us directly (see Section 15) to review, correct, or request deletion of their child's personal information.

7.2 FERPA-Aligned Practices (United States)

Although FERPA (Family Educational Rights and Privacy Act) obligations apply primarily to schools and school districts, we support FERPA compliance through the following practices:

• School official exception: We function as a "school official" with a legitimate educational interest, processing student education records solely on behalf of and under the direction of the school.
• No re-disclosure: We do not disclose student education records to third parties without school authorization, except as permitted or required by law.
• Data minimization: We access and process only the student data necessary for the contracted educational services.
• Audit and inspection: Schools may audit our data practices as they relate to student education records upon reasonable request.

7.3 Student Data Protections (India)

Under the Digital Personal Data Protection Act, 2023 (DPDP Act), the processing of children's personal data requires verifiable parental consent. Where the Platform is deployed for schools in India:

• Schools are responsible for obtaining verifiable parental consent before creating student accounts
• We process children's data solely for educational purposes as directed by the school
• We do not track, profile, or target children for any non-educational purpose
• Parents or guardians may exercise their rights under the DPDP Act as described in Section 8

8. Your Rights

8.1 Rights Under Indian Law (DPDP Act, 2023)

If you are located in India, you have the following rights:

• Right to access — You may request confirmation of whether we process your personal data and obtain a summary of such data.
• Right to correction — You may request correction of inaccurate or incomplete personal data.
• Right to erasure — You may request deletion of personal data that is no longer necessary for the purpose for which it was collected.
• Right to grievance redressal — You may lodge a complaint with our Grievance Officer (see Section 15) or with the Data Protection Board of India.
• Right to nominate — You may nominate another person to exercise your rights in the event of your death or incapacity.

8.2 Rights Under U.S. Law (CCPA/CPRA — California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (as amended by the CPRA):

• Right to know — You may request details about the categories and specific pieces of personal information we have collected about you.
• Right to delete — You may request deletion of personal information we have collected.
• Right to correct — You may request correction of inaccurate personal information.
• Right to non-discrimination — We will not discriminate against you for exercising any of these rights.
• Right to opt out of sale — We do not sell personal information. No opt-out is necessary.
• Right to limit use of sensitive personal information — We use sensitive personal information only for providing our educational services.

Categories of personal information collected (for CCPA disclosure purposes):

• Identifiers (name, email, username)
• Education information (grades, progress, attendance)
• Internet or electronic network activity (login timestamps, pages visited)
• Inferences drawn from the above (course completion analytics)

We have not sold personal information in the preceding 12 months. We do not sell personal information.

8.3 Exercising Your Rights

To exercise any of the above rights, please contact us using the information in Section 15. We will respond to verified requests within:

• 30 days for requests under the DPDP Act
• 45 days for requests under the CCPA/CPRA (extendable by an additional 45 days with notice)

For student data, requests should be directed through the school administrator or to us directly. Schools retain control over student education records.

9. Data Retention

Data Category	Retention Period
Active user accounts	Retained for the duration of the account's active use
Student educational records	Retained for the duration of the student's enrollment plus the remainder of the academic year, unless the school requests earlier deletion
Inactive accounts	Accounts with no login activity may be flagged for review. We will notify the associated school before taking any action on inactive accounts
Authentication logs	Retained for a reasonable period for security purposes, then purged
Session and cache data	Automatically expired (Redis data evicted per LRU policy; max 512 MB)
Backup data	Database backups are maintained per Azure's retention schedule for disaster recovery and are subject to the same access controls as primary data
Deleted data	Upon a valid deletion request, data will be removed from active systems promptly. Data in backups may persist until the backup rotation cycle completes, after which it will no longer be recoverable

Schools and administrators may request bulk export or deletion of their tenant's data by contacting us.

10. International Data Transfers

Our Platform serves users in India and the United States. Data may be processed across the following regions:

Processing Location	Purpose
United States (Azure East US, Central US)	Primary hosting, database, authentication, and application services
Cloudflare global edge network	DNS resolution, DDoS protection, and TLS termination (data transits through the nearest edge location)

For users in India: Your personal data may be transferred to and processed in the United States for the purposes described in this policy. Such transfers are conducted in accordance with the DPDP Act, 2023, including any conditions prescribed by the Central Government regarding cross-border data transfers.

For users in the United States: Your data is primarily processed within the United States.

We ensure that all cross-border data transfers are protected by appropriate technical and organizational safeguards, including encryption in transit and at rest, access controls, and contractual protections with our service providers.

11. Third-Party Links and Integrations

The Platform may contain links to third-party websites or resources (for example, external documentation or reference materials within course content). We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any external sites you visit.

The Platform uses the following open-source software components, all self-hosted on our infrastructure:

• Keycloak (identity management) — Red Hat / CNCF
• PostgreSQL (database) — PostgreSQL Global Development Group
• Redis (caching) — Redis Ltd.
• Astro (web framework) — The Astro Technology Company
• Nginx (web server) — F5, Inc.

These components process data only within our infrastructure and do not transmit data to their respective vendors.

12. AI and Automated Processing

As of the date of this policy, the Platform does not employ artificial intelligence, machine learning models, or automated decision-making systems that process personal data or produce decisions with legal or similarly significant effects on users.

If AI-powered features are introduced in the future, this policy will be updated to describe:

• The nature and purpose of such processing
• The categories of data used
• How users can access or contest AI-generated decisions
• Applicable safeguards

13. Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:

• India: We will notify the Data Protection Board of India and affected individuals in accordance with the DPDP Act, 2023 and any rules prescribed thereunder.
• United States: We will notify affected individuals and relevant state authorities in accordance with applicable state data breach notification laws (including California Civil Code § 1798.82).
• Schools: We will promptly notify affected schools so they can fulfill their own notification obligations to parents and students.

Notification will include a description of the breach, the categories of data affected, likely consequences, and measures taken or proposed to address the breach.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes:

• We will update the "Last Updated" date at the top of this policy
• We will provide reasonable notice, such as a notification within the Platform or via email to school administrators
• Continued use of the Platform after the effective date of a revised policy constitutes acceptance of the changes

We encourage you to review this policy periodically.

15. Contact Information and Grievance Redressal

General Inquiries

For questions or concerns about this Privacy Policy or our data practices:

Kintrix Robotics
Email: [email protected]
Website: Contact Page

Grievance Officer (India — DPDP Act, 2023)

In compliance with the Digital Personal Data Protection Act, 2023, we have appointed a Grievance Officer. You may contact the Grievance Officer for any complaints or concerns regarding the processing of your personal data:

Email: [email protected]
Response time: Within 30 days of receipt of your complaint

If you are not satisfied with the resolution provided by the Grievance Officer, you may file a complaint with the Data Protection Board of India.

CCPA/CPRA Requests (California Residents)

California residents may submit requests under the CCPA/CPRA to:

Email: [email protected]
Subject line: "California Privacy Request"

We will verify your identity before processing any request and respond within 45 days.

Schools and Administrators

School administrators may contact us regarding student data management, data export, or tenant-level data deletion at:

Email: [email protected]

16. Consent

By creating an account or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

• For school-administered accounts: The school, acting as the authorized representative and in loco parentis (where applicable), provides consent on behalf of students for the processing of personal data necessary for educational service delivery.
• For self-registered accounts: By completing the registration process, you consent to the collection and processing of your personal data as described in this policy.
• Withdrawal of consent: You may withdraw your consent at any time by contacting us at [email protected] or by requesting account deletion through your school administrator. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.

This Privacy Policy is effective as of February 7, 2026.