KindKart LMS — Privacy Policy

Last updated: 23 June 2026

1. Who we are

KindKart LMS ("the App") is a workforce application operated by KindKart (KINDKART INDIA LLP, 1444b, 33rd Street, 1 Block, Anna Nagar, Chennai, Tamil Nadu — 600040, India) for use by authorized staff of KindKart and its Partners who run education programs in schools.

The App is provided to invited trainers, project managers, and administrators only. It is not available for public self-registration, and it is not intended for use by children or the general public.

For any privacy question or request, contact support@thekindkart.org.

2. Scope of this policy

This policy explains what personal data the App processes, why, and the choices and rights available to you. It covers two distinct groups of data:

1. App users (trainers, project managers, admins) — the adults who sign in and use the App.
2. Program records (students, schools, sessions, attendance, assessments) — data that App users enter and manage as part of running education programs.

For program records, the Partner is the data controller and KindKart acts as a data processor on its behalf. Students do not use the App and do not have accounts.

3. Information we process

3.1 Account and identity (App users)

• Phone number — used to sign in via a one-time passcode (OTP) delivered over WhatsApp.
• Email address and Google account identifier — if you choose "Sign in with Google".
• User ID and organization (tenant) membership — to authorize what you can see and do.

3.2 Profile (App users)

• Your name, role, assigned project manager, competency level, and the schools assigned to you — provided by your administrator, shown to you in the App.

3.3 Program records (entered by App users)

• Sessions you plan or deliver, attendance you mark, and the students, schools, and classes those records relate to — including student names and enrollment details.

3.4 Technical data

• Standard request metadata (IP address, device/OS type, timestamps) processed by our hosting and security infrastructure to operate the service and prevent abuse.

3.5 Location (only when you submit attendance)

• Precise GPS location, captured only at the moment you submit attendance, to record where and when the attendance was marked. It is optional: if you decline the permission, location services are off, or no fix is available, attendance still submits without a location. We collect location only at that single moment — never continuously and never in the background.

We do not collect contacts, photos, calendar, health, or financial data, and the App contains no advertising and no third-party analytics or tracking SDKs.

4. How we use information

• Authenticate you and keep your account secure.
• Authorize access so you only see data for your organization and assignments (enforced by per-tenant row-level security).
• Deliver core functionality — show your schedule, let you mark attendance, create and reschedule sessions, and view your profile and assigned schools.
• Operate the service offline-first — recent data is cached on your device so the App works without connectivity and syncs when you reconnect.
• Record where and when attendance was marked — the optional GPS fix captured at submit is stored alongside that attendance record, and is used for no other purpose.
• Maintain, secure, and audit the platform (e.g. detect misuse, keep an audit trail of changes).

We do not use your data for advertising, profiling, or automated decisions that produce legal effects, and we do not sell personal data.

5. Service providers (sub-processors)

We share data only with infrastructure providers that process it on our behalf, under contract, to deliver the service:

| Provider | Purpose | |---|---| | Supabase | Authentication, database (with row-level security), and file storage | | Amazon Web Services (AWS), Mumbai region (ap-south-1) | Backend application hosting | | Twilio | Delivery of the WhatsApp one-time passcode | | Google | "Sign in with Google" identity verification (only if you use it) |

These providers are not permitted to use your data for their own purposes. We do not otherwise share, rent, or sell personal data to third parties.

6. Data security

• All data is encrypted in transit (HTTPS/TLS) between the App and our servers.
• Access is isolated per organization using row-level security; each user sees only permitted records.
• Records are soft-deleted and retained for audit integrity, then purged per our retention schedule.
• On-device cached data is stored in the App's private storage and cleared on sign-out.

7. Data retention

We retain account and program data for as long as your organization uses the service and as required for legitimate business, audit, and legal purposes. On account deactivation, personal data is removed or anonymized in line with our retention schedule, subject to any legal hold.

Location captured at attendance submit is stored as part of that attendance record and is retained for as long as the attendance record itself is retained. Because attendance is program data controlled by the Partner (see §2), it is not automatically deleted when an individual app user's account is deactivated; erasure requests for such records are handled through §8.

8. Your rights and choices

Depending on your jurisdiction (including under India's Digital Personal Data Protection Act, 2023, and the GDPR where applicable), you may have the right to access, correct, update, or delete your personal data, and to withdraw consent.

• App users: contact your administrator or email support@thekindkart.org to exercise these rights or to request deletion of your account and associated personal data.
• Program records (students): requests should be directed to the Partner that controls those records; KindKart will assist that Partner as its processor.

We respond to verified requests within the timeframes required by applicable law.

Account and data deletion

To request deletion of your account and personal data, email support@thekindkart.org with the phone number or email used to sign in. We will verify the request and delete or anonymize your personal data, except where retention is required by law. (This address also serves as the data deletion request mechanism declared in Google Play.)

9. Children's data

The App is for adult staff only and is not directed to children. Where the App processes student records (which may relate to minors), it does so solely as a processor on behalf of the Partner, which is responsible for obtaining any required consents. Students do not access the App.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, communicated through the App or your administrator.

11. Contact

KindKart — KINDKART INDIA LLP 1444b, 33rd Street, 1 Block, Anna Nagar Chennai, Tamil Nadu — 600040, India Email: support@thekindkart.org