Privacy Policy

For purposes of this Privacy Policy, the following terms have the meanings set forth below.

"Astute Verse"

"Astute Verse," "we," "our," or "us" means ASTUTE VERSE PRIVATE LIMITED, together with its affiliates, subsidiaries, successors, and permitted assigns, as applicable.

"Service"

"Service" means the websites, applications, software, AI Features, educational platforms, APIs, and related products, services, and functionality provided by Astute Verse.

"Customer"

"Customer" means the school, school district, educational institution, organization, or other entity that enters into an agreement with Astute Verse for the use of the Service.

"Authorized User"

"Authorized User" means an individual authorized by a Customer to access or use the Service, including students, educators, teachers, school administrators, staff members, parents, legal guardians, or other individuals authorized by the applicable Customer.

"Personal Data"

"Personal Data" means any information relating to an identified or identifiable natural person, or any information that is otherwise defined as personal information, personal data, or a similar term under applicable law.

"Customer Data"

"Customer Data" means any information, content, Educational Records, Personal Data, prompts, responses, files, documents, learning interactions, assessments, or other data that is submitted to, uploaded to, generated through, stored within, or otherwise processed through the Service on behalf of a Customer.

"Educational Records"

"Educational Records" means education records, student records, or similar educational information protected under applicable education or privacy laws, including FERPA where applicable.

"AI Features"

"AI Features" means the artificial intelligence, machine learning, generative AI, and related automated capabilities made available as part of the Service.

"Security Incident"

"Security Incident" means an actual, confirmed event involving the unauthorized access to, acquisition of, disclosure of, alteration of, destruction of, or loss of Personal Data, Customer Data, or Educational Records processed through the Service.

The purpose of this Privacy Policy is to explain how Astute Verse processes Personal Data and Customer Data in connection with the Service. This Privacy Policy describes the processing of information necessary to:

• Provide, operate, maintain, and improve the Service;

• Authenticate Authorized Users and manage secure access to the Service;

• Deliver educational functionality and AI Features;

• Support authorized educational activities and Customer-directed use of the Service;

• Maintain the security, integrity, availability, and reliability of the Service;

• Comply with applicable legal, regulatory, and contractual obligations; and

• Protect the rights, safety, and legitimate interests of Customers, Authorized Users, and Astute Verse.

1.1 Scope

This Privacy Policy applies to the processing of Personal Data and Customer Data by Astute Verse in connection with the Service. It applies to information processed on behalf of Customers in connection with the provision and operation of the Service, including information relating to Authorized Users, educational institutions, and other individuals authorized to access or use the Service.

This Privacy Policy should be read together with the Terms of Service, the Data Sharing Policy, the Data Processing Agreement (where applicable), and any applicable Customer agreement or other written commercial agreement governing the use of the Service. In the event of any conflict between this Privacy Policy and an applicable written commercial agreement, the commercial agreement will prevail to the extent of the inconsistency.

Astute Verse is committed to protecting the privacy of Customers and Authorized Users through responsible data processing practices. The following privacy principles guide how Astute Verse collects, processes, uses, protects, and manages Personal Data and Customer Data in connection with the Service.

2.1 Data Minimization

Astute Verse collects and processes only the Personal Data and Customer Data that is reasonably necessary to provide, operate, maintain, and improve the Service, support authorized educational activities, fulfill the Customer's documented instructions, maintain the security and reliability of the Service, comply with applicable legal and contractual obligations, and perform the purposes described in this Privacy Policy.

2.2 Purpose Limitation

Astute Verse processes Personal Data and Customer Data only for the educational, operational, security, legal, contractual, and support purposes described in this Privacy Policy or otherwise authorized by the applicable Customer. Astute Verse does not process Personal Data for purposes that are incompatible with those purposes.

2.3 Privacy Protection

Astute Verse implements appropriate administrative, technical, organizational, and physical safeguards designed to protect Personal Data and Customer Data against unauthorized access, disclosure, alteration, loss, misuse, or destruction. Access to Personal Data and Customer Data is limited to authorized personnel and approved service providers with a legitimate business need and appropriate authorization.

2.4 Responsible Use of Data

Astute Verse does not sell Personal Data, Customer Data, or Educational Records. Astute Verse does not use Customer Data for behavioral advertising, cross-context behavioral advertising, commercial profiling, or other unrelated marketing activities.

2.5 Continuous Privacy Improvement

Astute Verse regularly reviews and enhances its privacy, security, and data governance practices to support compliance with applicable laws, contractual obligations, evolving industry standards, and the continued protection of Personal Data and Customer Data.

Astute Verse provides access to the Service through authentication and authorization mechanisms managed by the Customer or the Customer's designated identity provider. Access to the Service is restricted to Authorized Users and is intended solely to support authorized educational activities and Customer-directed use of the Service.

3.1 Institution-Managed Authentication

The Service is generally accessed through school-, district-, or organization-managed authentication systems, including Single Sign-On ("SSO"), where available. User identities, authentication credentials, and access permissions are provisioned and managed by the Customer or the Customer's designated identity management systems.

3.2 Authorized User Access

In typical educational deployments, Authorized Users do not create separate consumer accounts directly with Astute Verse. Access to the Service is established through institution-managed identity systems and role assignments configured by the Customer.

3.3 Access Information

Astute Verse processes only the Personal Data and Customer Data reasonably necessary to authenticate Authorized Users, establish and maintain secure sessions, enforce access controls, manage authorization, and deliver the Service in accordance with the Customer's documented instructions.

Astute Verse is committed to the principle of data minimization and is designed to limit the collection of Personal Data to what is reasonably necessary to provide the Service. In most educational deployments, Authorized Users are not required to provide personal information beyond that necessary for institution-managed authentication and the delivery of the Service.

4.1 Consumer Account Registration

The Service is generally provided through Customer-managed educational environments. Accordingly, Authorized Users are not typically required to create separate consumer accounts or provide standalone registration credentials directly to Astute Verse.

4.2 Unnecessary Personal Information

Unless reasonably necessary for an authorized educational purpose, required to provide the Service, or otherwise instructed by the Customer, Astute Verse does not generally require Authorized Users to provide personal information such as:

• Personal phone numbers;

• Home addresses;

• Personal mailing addresses; or

• Other personal profile information unrelated to the operation of the Service.

4.3 Data Minimization

Consistent with the data minimization principle described in this Privacy Policy, Astute Verse requests and processes only the Personal Data and Customer Data reasonably necessary to authenticate Authorized Users, provide, operate, maintain, and improve the Service, support authorized educational activities, maintain the security and reliability of the Service, and comply with applicable legal and contractual obligations.

Astute Verse processes only the Personal Data and Customer Data reasonably necessary to provide, operate, maintain, and improve the Service, support authorized educational activities, maintain the security and integrity of the Service, comply with applicable legal and contractual obligations, and fulfill the Customer's documented instructions.

5.1 Authentication and Access Information

Astute Verse may process information necessary to authenticate Authorized Users, manage secure access to the Service, and administer user authorization, including institution-managed authentication credentials, authentication tokens, user account identifiers, role assignments, and other access-related information required to establish and maintain secure sessions.

5.2 Educational Information

Astute Verse may process educational information necessary to provide the Service, including school, district, class, course, grade level, curriculum, learning objectives, and other educational context provided by the Customer.

5.3 Learning Interactions

Astute Verse may process information generated through the authorized use of the Service, including prompts, responses, uploaded learning materials, learning activities, AI interactions, progress indicators, topic activity, assessment results, and other educational content submitted or generated through the Service.

5.4 Operational and Security Information

Astute Verse may process limited operational, technical, and security information necessary to operate, maintain, secure, monitor, troubleshoot, and improve the Service. Such information may include security logs, audit logs, diagnostic information, service performance metrics, fraud prevention information, abuse detection information, and other operational data required to support the reliability, availability, and security of the Service.

5.5 Purpose Limitation

Astute Verse processes Personal Data and Customer Data only for educational service delivery, authentication, security, operational support, service reliability, legal compliance, and the other purposes described in this Privacy Policy. Astute Verse does not process Customer Data for purposes unrelated to the operation of the Service or otherwise inconsistent with the Customer's documented instructions.

Astute Verse is committed to minimizing the collection and processing of student Personal Data. Where student Personal Data is provided by the Customer or through institution-managed identity systems, Astute Verse processes such information only to the extent reasonably necessary to provide the Service, authenticate Authorized Users, support authorized educational activities, comply with applicable legal and contractual obligations, and fulfill the Customer's documented instructions.

6.1 Institution-Provided Student Information

Student Personal Data provided by a Customer, educational institution, or authorized identity provider is processed only for purposes related to the operation of the Service, including authenticating Authorized Users, assigning appropriate user roles, delivering educational functionality, maintaining Educational Records where applicable, supporting authorized educational activities, and complying with applicable legal and contractual obligations.

Astute Verse does not use student Personal Data for purposes inconsistent with this Privacy Policy, including behavioral advertising, cross-context behavioral advertising, commercial profiling, or other unrelated commercial activities.

6.2 Student-Submitted Information

The Service is designed to minimize the collection of unnecessary Personal Data. Authorized Users should avoid submitting personal, sensitive, or confidential information that is not relevant to the educational purpose or authorized use of the Service.

Where an Authorized User voluntarily submits Personal Data through the Service, Astute Verse may, where technically and operationally feasible, limit, redact, restrict, delete, or otherwise minimize the continued processing of such information when it is not reasonably necessary for the operation of the Service, authorized educational purposes, or applicable legal or contractual obligations.

6.3 Safety-Related Disclosures

If information voluntarily submitted through the Service reasonably indicates a potential risk of harm, exploitation, self-harm, abuse, or another significant safety concern, Astute Verse may disclose relevant information to the applicable Customer, authorized school personnel, parents or legal guardians (where appropriate), law enforcement, or other appropriate authorities, as permitted or required by applicable law, contractual obligations, or school policies, for the purpose of protecting the safety, well-being, or legal rights of the affected individual or others.

Astute Verse may process limited technical information necessary to provide, operate, maintain, secure, monitor, and protect the Service. Such information is processed solely for legitimate operational, security, diagnostic, and administrative purposes in accordance with this Privacy Policy and is not used for advertising, commercial profiling, or unrelated marketing activities.

7.1 IP Addresses and Network Information

Astute Verse may process IP addresses and related network information as part of the operation of the Service. Such information may be used for authentication, access management, security monitoring, fraud prevention, abuse detection, troubleshooting, service administration, audit logging, and maintaining the security, integrity, and availability of the Service.

IP addresses and related network information are processed solely for operational and security purposes and are not used for behavioral advertising, cross-context behavioral advertising, commercial profiling, or unrelated commercial activities.

7.2 Technical Information

Astute Verse may process limited technical information necessary to support the operation of the Service, including device identifiers, browser information, operating system information, network information, diagnostic data, security logs, audit logs, service performance metrics, and other operational metadata.

Such information is processed only for operational, security, diagnostic, administrative, and service reliability purposes and is not incorporated into Educational Records except where reasonably necessary for authorized educational, operational, or legal purposes.

7.3 Purpose Limitation

Technical information processed by Astute Verse is used exclusively to support the operation, maintenance, monitoring, security, reliability, and protection of the Service. Astute Verse does not process such information for purposes that are inconsistent with this Privacy Policy or the Customer's documented instructions.

Astute Verse processes Personal Data and Customer Data only for legitimate educational, operational, security, contractual, and legal purposes necessary to provide, operate, maintain, and improve the Service. Astute Verse processes Personal Data only in accordance with this Privacy Policy, the Customer's documented instructions, applicable contractual commitments, and applicable law.

8.1 Service Delivery

Astute Verse processes Personal Data and Customer Data to authenticate Authorized Users, provide access to the Service, deliver educational functionality and AI Features, support personalized learning experiences, and enable authorized educational activities.

8.2 Educational Administration

Astute Verse processes information to support Customer-authorized instructional activities, educator oversight, reporting, learning progress monitoring, classroom administration, and other educational purposes authorized by the Customer.

8.3 Security and Service Operations

Astute Verse processes information to maintain the security, integrity, availability, and reliability of the Service, including detecting, preventing, investigating, and responding to fraud, abuse, misuse, unauthorized access, Security Incidents, and other activities that may affect the operation of the Service.

8.4 Support and Service Improvement

Astute Verse processes information to troubleshoot technical issues, provide customer support, maintain system performance, improve the functionality, reliability, accessibility, and security of the Service, and fulfill contractual and operational obligations.

Service improvements are based on operational information, aggregated information, de-identified information, and other information that does not reasonably identify an individual or disclose Customer Data.

8.5 Legal and Regulatory Compliance

Astute Verse processes Personal Data and Customer Data as reasonably necessary to comply with applicable laws, regulations, contractual commitments, legal processes, regulatory requirements, and other legitimate legal obligations.

8.6 Prohibited Uses

Astute Verse does not process Personal Data, Customer Data, or Educational Records for purposes that are inconsistent with this Privacy Policy, the Customer's documented instructions, or applicable law. This includes, without limitation, the sale of Personal Data, behavioral advertising, cross-context behavioral advertising, commercial profiling, or other unrelated commercial or marketing activities.

Astute Verse uses carefully selected third-party service providers to support the hosting, operation, security, and AI functionality of the Service. These providers process Personal Data and Customer Data only to the extent necessary to provide services on behalf of Astute Verse and in accordance with applicable contractual, security, privacy, and confidentiality obligations.

9.1 Cloud Infrastructure

Astute Verse uses Microsoft Azure as its primary cloud infrastructure platform to support hosting, storage, networking, backup, monitoring, and security services. Personal Data and Customer Data are processed within this infrastructure only to the extent reasonably necessary to provide, operate, maintain, secure, and support the Service.

Astute Verse configures and manages its cloud environment using security and administrative controls appropriate to the Service. Compliance with applicable laws, regulations, and contractual obligations depends on the implementation of the Service, Customer configuration, applicable agreements, and institutional governance.

9.2 AI Service Providers

Astute Verse uses approved enterprise AI service providers, including OpenAI enterprise offerings, to enable AI Features within the Service.

Astute Verse configures AI service providers in accordance with applicable contractual commitments and enterprise service terms. Where supported by the applicable service offering, Customer prompts, responses, and other Customer Data are not used to train or improve foundation models unless expressly authorized by Astute Verse or the applicable Customer.

9.3 Provider Safeguards

Astute Verse supplements the security and privacy controls provided by its third-party infrastructure and AI service providers with its own administrative, technical, and organizational safeguards. These safeguards include access controls, encryption, data minimization practices, contractual protections, security monitoring, and other measures designed to protect Personal Data and Customer Data throughout the operation of the Service.

Astute Verse operates the Service using a cloud-based architecture designed to protect the confidentiality, integrity, and availability of Personal Data and Customer Data. Production Personal Data and Customer Data are processed and stored within managed cloud infrastructure in accordance with Astute Verse's security, operational, contractual, and legal requirements.

10.1 Production Data Storage

Production Personal Data, Customer Data, and Educational Records are processed and stored within authorized production environments hosted on managed cloud infrastructure used to provide and operate the Service.

10.2 Local Storage Restrictions

As part of its standard operational practices, Astute Verse does not intentionally store production Personal Data, Customer Data, or Educational Records on employee laptops, desktop computers, local workstations, local servers, removable media, or local development environments, except where temporarily required for authorized operational activities and protected by appropriate administrative, technical, and organizational safeguards.

10.3 Development and Testing Environments

Astute Verse does not use production Personal Data, Customer Data, or Educational Records within development or non-production testing environments as part of its standard software development and operational practices, except where strictly necessary for authorized maintenance, incident response, troubleshooting, or other legitimate operational purposes and subject to appropriate administrative, technical, and organizational safeguards.

10.4 Data Residency

Astute Verse's standard production deployment is configured so that Customer Data is primarily processed and stored within the United States using Microsoft Azure data centers and associated managed cloud infrastructure.

Astute Verse does not intentionally process or store Customer Data in non-U.S. production regions unless required by the applicable Customer agreement, Customer deployment requirements, applicable law, or the Customer's documented instructions.

10.5 AI Service Data Processing

Where AI Features utilize approved enterprise AI service providers, Astute Verse configures those services in accordance with applicable contractual commitments, enterprise service terms, and available regional deployment options. Where supported by the applicable service offering, Astute Verse utilizes United States regional processing and data residency controls for Customer Data.

Astute Verse shares or discloses Personal Data and Customer Data only where reasonably necessary to provide, operate, maintain, and support the Service, facilitate authorized educational activities, comply with applicable legal or contractual obligations, or protect the rights, safety, security, or lawful interests of individuals, Customers, and Astute Verse. Astute Verse does not disclose Personal Data or Customer Data for purposes that are inconsistent with this Privacy Policy, the Customer's documented instructions, or applicable law.

11.1 Educational Disclosures

Astute Verse may make Personal Data, Customer Data, Educational Records, learning progress, assessment results, and other information available to the applicable Customer and its Authorized Users, including teachers, school administrators, parents, and legal guardians, in accordance with the Customer's configuration, applicable law, contractual obligations, and authorized educational purposes.

11.2 Service Providers

Astute Verse may disclose Personal Data and Customer Data to carefully selected third-party service providers that support the operation of the Service, including providers of cloud infrastructure, artificial intelligence, security, monitoring, customer support, content moderation, analytics, and other operational services.

Such service providers process Personal Data and Customer Data solely on behalf of Astute Verse and only for the purposes of providing contracted services, subject to contractual obligations requiring appropriate confidentiality, security, privacy, and data protection safeguards.

11.3 Legal, Safety, and Security Disclosures

Astute Verse may disclose Personal Data or Customer Data where reasonably necessary to:

• Comply with applicable laws, regulations, court orders, governmental requests, or other valid legal processes;

• Protect the rights, safety, security, or legal interests of Authorized Users, Customers, Astute Verse, or other individuals;

• Detect, investigate, prevent, or respond to fraud, abuse, misuse, unauthorized access, Security Incidents, or other unlawful activities;

• Protect the integrity, availability, security, or lawful operation of the Service; or

• Establish, exercise, or defend legal rights, or comply with contractual obligations.

11.4 Prohibited Disclosures

Astute Verse does not sell Personal Data, Customer Data, or Educational Records. Astute Verse does not disclose such information for behavioral advertising, cross-context behavioral advertising, commercial profiling, or other commercial purposes that are unrelated to the operation of the Service.

11.5 Additional Information

Additional information regarding Astute Verse's data sharing practices, categories of recipients, disclosure safeguards, and contractual protections is available in the Astute Verse Data Sharing Policy, which forms part of Astute Verse's overall privacy and data governance framework.

Astute Verse incorporates administrative, technical, and operational safeguards designed to promote the safe, responsible, and appropriate use of AI Features within the Service. AI Features are intended to support educational activities while operating within established safety, security, privacy, and governance controls.

12.1 AI Safety Measures

Astute Verse implements AI safety measures that may include automated content filtering, content moderation, abuse detection, misuse prevention, and other safeguards designed to reduce harmful, inappropriate, unlawful, or unauthorized use of the Service. These measures may be supplemented by human review where reasonably necessary to investigate Security Incidents, respond to safety concerns, comply with applicable legal obligations, or maintain the security, integrity, and reliability of the Service.

12.2 Human Oversight

The Service is designed to assist educators, students, and educational institutions and is not intended to replace professional educational judgment, school policies, parental guidance, or human decision-making. Customers remain responsible for determining how AI-generated content is reviewed, interpreted, and used within their educational environment.

12.3 AI-Generated Content

AI-generated responses may occasionally contain inaccuracies, omissions, outdated information, or content that is incomplete or unsuitable for a particular educational context. Authorized Users should exercise appropriate judgment and independently review AI-generated content before relying on it for instructional, educational, administrative, or other significant decisions.

12.4 Continuous Improvement

Astute Verse regularly evaluates and enhances its AI safety, security, moderation, and governance practices to improve the reliability, quality, and responsible operation of AI Features. Such improvements are implemented in accordance with applicable contractual commitments, privacy obligations, and legal requirements.

Astute Verse provides the Service for authorized educational use and implements privacy, security, and operational practices designed to support educational institutions in meeting applicable student privacy and data protection requirements. The Service is intended for institution-managed educational environments, and Customers remain responsible for ensuring that their use of the Service complies with applicable laws, regulations, contractual obligations, and institutional policies.

13.1 FERPA Support

Astute Verse supports educational institutions in meeting their obligations under the Family Educational Rights and Privacy Act ("FERPA") by processing Educational Records only on behalf of and under the documented instructions of the Customer, in accordance with applicable contractual commitments and applicable law.

Astute Verse processes Educational Records solely for authorized educational purposes and does not use such information for purposes inconsistent with this Privacy Policy or the Customer's documented instructions.

13.2 COPPA Support

Where the Service is provided to children under the age of 13 through a Customer's educational environment, Astute Verse supports educational institutions in meeting their obligations under the Children's Online Privacy Protection Act ("COPPA") by limiting the collection of Personal Data, operating within institution-managed educational deployments, and processing information only for authorized educational purposes.

Where permitted under applicable law, the Customer is responsible for providing any required parental notices and obtaining any required parental consents or other authorizations necessary for the use of the Service within its educational environment.

13.3 Privacy by Design

Astute Verse supports educational privacy requirements through administrative, technical, and organizational safeguards, including:

• Institution-managed authentication and access controls;

• Data minimization practices;

• Controlled relationships with authorized service providers;

• Managed cloud infrastructure;

• Security monitoring and access controls; and

• Restrictions on the use of Customer Data for advertising and unrelated commercial purposes.

13.4 Customer Responsibilities

Compliance with applicable privacy, education, and other legal requirements depends on the Customer's implementation, configuration, governance, contractual arrangements, and authorized use of the Service. Customers remain responsible for determining that their deployment and use of the Service comply with applicable laws, regulations, contractual obligations, and institutional policies.

Astute Verse retains Personal Data and Customer Data only for as long as reasonably necessary to provide, operate, maintain, and support the Service, fulfill authorized educational purposes, maintain security, comply with applicable contractual and legal obligations, resolve operational or support matters, and protect the integrity of the Service. Retention periods may vary depending on the nature of the information, the Customer's documented instructions, applicable contractual commitments, legal requirements, and legitimate operational needs.

14.1 Retention Principles

Astute Verse retains Personal Data, Customer Data, and Educational Records only for the period reasonably necessary to support the operation of the Service and the purposes described in this Privacy Policy. As part of its standard operational practices, Astute Verse does not intentionally maintain offline archives or local copies of production Customer Data or Educational Records outside its authorized managed cloud infrastructure, except where reasonably necessary for authorized operational, legal, or security purposes and subject to appropriate administrative, technical, and organizational safeguards.

14.2 Customer Offboarding

Upon termination or expiration of the Customer's use of the Service, Astute Verse will provide a reasonable transition period to support data export, account closure, and orderly offboarding.

Unless otherwise required by the applicable Customer agreement, the Customer's documented instructions, applicable law, or a valid legal hold, Customer Data will generally remain available for export for up to thirty (30) days following termination of the Service.

14.3 Data Deletion

Following the applicable export period, Astute Verse will delete or de-identify Customer Data from active production systems within approximately sixty (60) days, unless a longer retention period is required by applicable law, regulatory requirements, contractual obligations, a legal hold, or the Customer's documented instructions.

14.4 Backup Retention

Encrypted backup copies containing Customer Data are retained only as reasonably necessary to support disaster recovery, business continuity, operational resilience, and backup integrity. Backup data is securely overwritten or permitted to expire in accordance with Astute Verse's backup lifecycle, which generally occurs within approximately ninety (90) days after deletion from active production systems, unless a longer retention period is required by applicable law or legitimate operational requirements.

14.5 Retention Exceptions

Astute Verse may retain limited Personal Data or Customer Data beyond the standard retention periods where reasonably necessary to:

• Comply with applicable laws, regulations, court orders, legal holds, or other legal obligations;

• Protect the security, integrity, availability, or lawful operation of the Service;

• Detect, investigate, prevent, or respond to fraud, abuse, misuse, unauthorized access, or Security Incidents;

• Establish, exercise, or defend legal rights, resolve disputes, enforce contractual obligations, or support billing, accounting, and audit requirements;

• Retain de-identified or aggregated information that cannot reasonably identify an individual for analytics, service reliability, security, research, or Service improvement purposes.

Astute Verse implements administrative, technical, and organizational safeguards designed to protect the confidentiality, integrity, and availability of Personal Data, Customer Data, and Educational Records processed through the Service. These safeguards are intended to reduce the risk of unauthorized access, disclosure, alteration, loss, destruction, or other unauthorized processing of information while supporting the secure operation of the Service.

15.1 Technical Safeguards

Astute Verse implements appropriate technical safeguards that may include encryption of data in transit, encryption of data at rest where applicable, secure managed cloud infrastructure, network security controls, system monitoring, audit logging, vulnerability management, backup protection, and other security technologies designed to protect the Service.

15.2 Access Controls

Access to Personal Data and Customer Data is restricted to authorized personnel who have a legitimate business need to perform their responsibilities. Astute Verse applies role-based access controls, authentication mechanisms, least-privilege principles, periodic access reviews, and other administrative safeguards to limit access to authorized individuals.

15.3 Operational Security

Astute Verse maintains operational security practices that may include continuous security monitoring, incident detection, vulnerability assessments, software maintenance, change management, access reviews, security testing, and other administrative and technical procedures designed to support the ongoing security, availability, and reliability of the Service.

15.4 Shared Responsibility

The security of the Service also depends on the Customer's implementation, configuration, user access management, and compliance with appropriate security practices. Customers remain responsible for protecting user credentials, managing Authorized User access, maintaining appropriate administrative and organizational controls within their educational environment, and promptly notifying Astute Verse of any known or suspected unauthorized access to the Service.

15.5 Continuous Security Improvement

Astute Verse regularly reviews, evaluates, and enhances its security practices to address evolving threats, operational requirements, applicable legal and contractual obligations, and recognized industry practices. Security measures may be updated from time to time to improve the protection of Personal Data, Customer Data, and Educational Records processed through the Service.

Depending on applicable law, the Customer's relationship with Astute Verse, and the manner in which the Service is deployed, Customers and Authorized Users may have certain rights regarding the Personal Data and Customer Data processed through the Service. Astute Verse will respond to applicable privacy requests in accordance with applicable law, contractual commitments, and the Customer's documented instructions.

16.1 Exercising Privacy Rights

Subject to applicable law, eligible individuals or Customers may request:

• Access to applicable Personal Data or Customer Data;

• Correction of inaccurate or incomplete Personal Data or Customer Data;

• Deletion of Personal Data or Customer Data where legally permitted;

• Restriction of, or objection to, certain processing activities where applicable;

• Information regarding Astute Verse's processing of Personal Data and Customer Data; and

• Other rights available under applicable privacy laws.

16.2 Institution-Managed Accounts

For accounts managed by a school, district, educational institution, or other Customer, requests relating to Personal Data or Educational Records may need to be submitted through the applicable Customer that administers the account.

Astute Verse will cooperate with the applicable Customer, as appropriate, to support the fulfillment of applicable privacy rights in accordance with applicable law, contractual obligations, and the Customer's documented instructions.

16.3 Verification of Requests

Before responding to a privacy request, Astute Verse may take reasonable steps to verify the identity, authority, and eligibility of the requesting individual or organization in order to protect Personal Data, Customer Data, and Educational Records from unauthorized access, disclosure, modification, or deletion.

16.4 Limitations

Astute Verse may decline, defer, or limit a privacy request where permitted or required by applicable law, contractual obligations, regulatory requirements, legal holds, the rights and freedoms of other individuals, the Customer's documented instructions, or where Astute Verse is otherwise legally prohibited from fulfilling the request.

Astute Verse maintains administrative, technical, and operational policies and procedures for identifying, responding to, investigating, mitigating, and recovering from Security Incidents involving Personal Data, Customer Data, or Educational Records processed through the Service. Astute Verse will respond to confirmed Security Incidents in accordance with applicable law, contractual obligations, and its established incident response procedures.

17.1 Incident Response

Upon becoming aware of a confirmed Security Incident involving the unauthorized access to, acquisition of, disclosure of, alteration of, or destruction or loss of Personal Data, Customer Data, or Educational Records, Astute Verse will promptly take reasonable steps to:

• Contain, mitigate, and remediate the Security Incident;

• Investigate the nature, scope, and potential impact of the Security Incident;

• Protect the continued security, integrity, and availability of the Service; and

• Implement appropriate corrective measures designed to reduce the likelihood of recurrence.

17.2 Customer Notification

Where required by applicable law or contractual obligations, Astute Verse will notify the Customer's designated contact without undue delay following confirmation of a Security Incident and within any applicable legal or contractual notification timeframes.

To the extent reasonably available at the time of notification, Astute Verse will provide information regarding:

• The nature of the Security Incident;

• The categories of Personal Data, Customer Data, or Educational Records involved;

• The known or reasonably anticipated impact of the Security Incident;

• The mitigation and remediation measures taken or planned; and

• Recommended actions the Customer may take, where appropriate.

17.3 Ongoing Cooperation

Astute Verse will provide additional information as material facts become available and will reasonably cooperate with the applicable Customer in connection with incident response, legal compliance, regulatory reporting, forensic investigation, and other obligations arising from the Security Incident, to the extent required by applicable law and contractual commitments.

17.4 Third-Party Service Providers

Where a Security Incident involves infrastructure or services provided by an authorized third-party service provider, Astute Verse will coordinate with the applicable service provider, as appropriate, to investigate, mitigate, and respond to the Security Incident in accordance with applicable contractual arrangements and incident response procedures.

Astute Verse implements administrative, technical, and operational safeguards designed to reduce the risk of inappropriate, unsafe, harmful, or unauthorized AI-generated content. Although Astute Verse continuously enhances the safety and reliability of AI Features, AI-generated content may occasionally be inaccurate, incomplete, outdated, or unsuitable for a particular educational context. Accordingly, AI-generated content should be reviewed and used in conjunction with appropriate human judgment.

18.1 AI Output Controls

Astute Verse may implement automated and human-assisted safeguards, including content filtering, moderation, safety guardrails, policy enforcement, abuse detection, and other protective measures designed to identify, limit, or prevent inappropriate, unsafe, unlawful, or unauthorized AI-generated content.

Where reasonably appropriate, Astute Verse may block, suppress, modify, truncate, replace, or otherwise restrict AI-generated content that is inconsistent with the intended educational purpose of the Service or that presents a safety, security, legal, or compliance concern.

18.2 Reporting and Investigation

Authorized Users, Customers, educators, school administrators, parents, and legal guardians may report AI-generated content that they believe is inaccurate, inappropriate, unsafe, or otherwise inconsistent with the intended educational use of the Service.

Astute Verse may investigate reported incidents and, where appropriate, implement corrective actions, including updating AI safety controls, improving moderation practices, refining prompts, strengthening safety guardrails, restricting abusive or unauthorized use, or implementing other measures designed to improve the safe, reliable, and responsible operation of AI Features.

18.3 Continuous Improvement

Astute Verse regularly evaluates and enhances its AI output controls, moderation practices, operational procedures, and technical safeguards to improve the quality, reliability, safety, and responsible operation of AI Features in support of authorized educational use of the Service.

Astute Verse does not use Customer Data, Personal Data, or Educational Records processed through the Service to train, retrain, fine-tune, or otherwise improve foundation AI models or general-purpose AI models. Information processed through the Service is used solely to provide, operate, maintain, secure, and support the Service in accordance with this Privacy Policy, the applicable Customer agreement, and the Customer's documented instructions.

19.1 Customer Data Usage

Customer Data, including prompts, responses, learning interactions, assessments, uploaded content, and Educational Records, is processed only to the extent reasonably necessary to deliver AI Features and other authorized functionality within the Service.

Astute Verse does not create independent AI training datasets from Customer Data for general-purpose AI model development, unrelated AI development, or commercial AI training purposes.

19.2 Third-Party AI Services

Where Astute Verse utilizes approved enterprise AI service providers, such services are configured and used in accordance with applicable contractual commitments and enterprise service terms. Where supported by the applicable service offering, Customer Data processed through such services is not used to train or improve foundation AI models or general-purpose AI models unless expressly authorized by Astute Verse or the applicable Customer under the relevant contractual arrangements.

19.3 Service Improvement

Astute Verse may improve the performance, reliability, safety, security, and functionality of the Service using operational information, aggregated information, de-identified information, system performance metrics, or other information that does not reasonably identify an individual or disclose Customer Data.

Such improvements are made solely to enhance the operation of the Service and are not used to train or improve foundation AI models or general-purpose AI models using Customer Data.

19.4 Customer Control

Astute Verse will not use Customer Data, Personal Data, or Educational Records for AI model training or unrelated AI development activities unless expressly authorized by the applicable Customer or otherwise required or permitted by applicable law and the governing contractual arrangements.

Astute Verse uses cookies and similar technologies to support the secure operation, availability, performance, and functionality of the Service. These technologies help authenticate Authorized Users, maintain secure sessions, remember user preferences, improve service reliability, and support the operation of the Service.

20.1 Essential Cookies and System Storage

Astute Verse uses cookies, browser storage technologies (including local storage and session storage), and similar technologies that are necessary for the operation of the Service. These technologies support functions such as:

• User authentication and session management;

• Secure access to the Service;

• User preferences and application settings;

• Load balancing, service performance, and operational resilience; and

• Protection against unauthorized access and other security threats.

These technologies are essential to the secure and reliable operation of the Service.

20.2 Operational and Diagnostic Technologies

Astute Verse may use cookies and similar technologies to collect limited operational, diagnostic, and technical information necessary to monitor system performance, detect errors, troubleshoot issues, maintain security, improve service reliability, and support the ongoing operation of the Service.

Where reasonably practicable, such information is aggregated or de-identified and is not intended to identify individual Authorized Users.

20.3 Prohibited Uses

Astute Verse does not use cookies or similar technologies for behavioral advertising, cross-context behavioral advertising, cross-site tracking, commercial profiling, or other unrelated advertising or marketing activities.

Astute Verse does not track Authorized Users across third-party websites or online services for advertising or other commercial purposes.

20.4 User Controls

Most web browsers and devices allow users to manage, restrict, or disable cookies and similar technologies through their browser or device settings. Because certain cookies and browser storage technologies are necessary for the operation of the Service, disabling them may affect the availability, security, performance, or functionality of all or portions of the Service.

Astute Verse may update this Privacy Policy from time to time to reflect changes to the Service, applicable laws or regulations, technology, security practices, third-party service providers, or other operational, business, or privacy-related developments.

21.1 Policy Updates

When this Privacy Policy is updated, Astute Verse will revise the "Last Updated" date displayed at the beginning of this Privacy Policy. Unless otherwise stated, the updated Privacy Policy will become effective on the revised "Last Updated" date and will supersede all previous versions.

21.2 Material Changes

If Astute Verse makes material changes to this Privacy Policy that significantly affect the processing of Personal Data or Customer Data, Astute Verse will provide additional notice where required by applicable law or contractual obligations. Depending on the nature of the changes, such notice may be provided through the Service, by email, through the applicable Customer, or by other reasonable means.

21.3 Continued Use of the Service

The continued use of the Service following the effective date of an updated Privacy Policy constitutes acknowledgment of the revised Privacy Policy to the extent permitted by applicable law. Nothing in this Section modifies or supersedes the terms of any applicable Customer agreement or other governing contractual arrangement.

Astute Verse may process Personal Data, Customer Data, and Educational Records in countries other than the country in which the applicable Customer or Authorized User is located, where reasonably necessary to provide, operate, maintain, secure, or support the Service. Such processing will be conducted in accordance with applicable law, contractual obligations, and appropriate administrative, technical, and organizational safeguards designed to protect the information being processed.

22.1 Primary Processing Location

Astute Verse's standard production environment is configured so that Customer Data is primarily processed and stored within the United States, as described in Section 10 (Cloud-Based Data Storage and Data Residency).

22.2 Cross-Border Processing

Where Personal Data, Customer Data, or Educational Records are transferred across national borders, Astute Verse will implement appropriate contractual, organizational, and technical safeguards consistent with applicable law and the nature of the transfer.

22.3 Third-Party Service Providers

Where approved third-party service providers process Personal Data, Customer Data, or Educational Records in connection with the Service, Astute Verse will seek to ensure that such processing is performed in accordance with applicable contractual commitments, applicable privacy obligations, and appropriate security safeguards.

If you have any questions, concerns, or requests regarding this Privacy Policy, the processing of Personal Data, Customer Data, or Educational Records, the exercise of applicable privacy rights, or Astute Verse's privacy and security practices, please contact Astute Verse using the information below.

23.1 Privacy Contact

Privacy Team / Data Protection Contact

Email: support@astuteverse.com

Website: https://astuteverity.astuteverse.com/

Address: ASTUTE VERSE PRIVATE LIMITED

25A/61A, 5th Phase, Maharani Avenue, Vadavalli,

Coimbatore – 641041, Tamil Nadu, India

Contact Number: +91 4223552883

23.2 Privacy Requests

Privacy-related requests, including requests concerning access, correction, deletion, restriction of processing, or other applicable privacy rights, should be submitted using the contact information above.

Where the Service is provided through a school, district, educational institution, or other applicable Customer, certain privacy requests may need to be submitted through the applicable Customer that administers the account, consistent with applicable law, contractual obligations, and the Customer's documented instructions.