Privacy Policy
Summary for students
- PM EDU Math only collects what it needs to give you maths practice, marking and a mistakes notebook.
- We do not show ads, sell your data, or hand it to other companies.
- If you are under 18, your parent or guardian must agree before you can use the site.
- You can ask to see, correct or delete your data at any time using the contact below.
1. Who we are
Jun Academy Private Limited ("we", "the Company") operates PM EDU Math ("the Service"), an online mathematics learning service. This policy follows Indian law (the Information Technology Act 2000 and its rules, and the Digital Personal Data Protection Act 2023) and, for users in Korea, the Korean Personal Information Protection Act.
- Registered address: Office No. SPO-217, Second Floor, DLF South Point Mall, Golf Course Road, Sector 53, Gurugram, Haryana 122002, India
- CIN: U74140HR2012PTC136823
- Service address: math.pmeducation.net
2. Personal data we process
| Category | Data | How we get it |
|---|---|---|
| Account | Display name, user ID or email, password (stored only as a one-way hash), role (student, teacher, admin), approval and active status, whether a temporary password was issued, account closure time | Sign-up, or account created by an administrator |
| Learning settings | Course being studied, school grade, assigned units and unit requests (including reasons), class, assigned teacher, auto-assignment settings, display language, time zone (changed by the user under My info, or set by an administrator) | Entered by the user or set by an administrator |
| Learning records | Worksheets received and why each question was chosen, answers (including auto-saved drafts), time spent on each question, submission times, marks, mistakes notebook and notes, submission streak, statistics by unit and difficulty, an automatically calculated learning risk score | Created while using the Service |
| Test records | Test start, deadline and submission times, records of leaving the test screen, automatic submission when time runs out | Created during a test |
| Parent/guardian | Name, contact (email or phone), relationship to the student, student's date of birth (to check age), how and when consent was given | Parent/guardian consent form at enrolment |
| Collected automatically | IP address and browser information when you visit the site (server access logs), security access log (the time, account, IP address and browser of each sign-in, failed sign-in, sign-out, sign-up, password reset request or change, closure request, its cancellation or closure, and administrators' account and permission actions with their kind), last sign-in time, sign-in session records, sign-in cookie, account change log | Created while using the Service |
We do not collect national ID numbers, home addresses, health data, location data, photos or video, or payment card details, and we do not use visitor analytics or advertising tools. If we add fee payment to the Service, we will update this policy first.
3. Purposes
- Account management: approving sign-ups, identifying users, sign-in, password resets, preventing misuse
- Learning service: sending worksheets and auto-assigned practice, automatic marking, mistakes notebook, online tests, learning statistics and weak-unit analysis
- Teaching: assigned teachers and administrators review a student's learning records (including mistakes-notebook notes) and an automatically calculated learning risk score to find students who need help and to plan lessons
- Service messages: sign-up confirmation, password reset and service change emails
- Safe operation: fixing errors, responding to security incidents, meeting legal obligations
We do not use personal data for any other purpose, and we do not carry out targeted advertising or behavioural tracking for advertising aimed at students.
4. Legal basis
We process personal data on the basis of consent (given by a parent or guardian for users under 18) and to perform our lesson and learning-service agreement. Automatically collected data is processed to run the Service securely and to meet legal obligations.
5. Children
- Users under 18 may use the Service only with the consent of a parent or guardian. For users in Korea under 14, we obtain the consent of the legal representative.
- We collect a parent's or guardian's consent at enrolment on paper, by KakaoTalk, WhatsApp or email, and an administrator records it on the site. We approve an account once a parent's or legal guardian's consent has been confirmed. Consent collected when the student enrols at the academy may be recorded on the site later.
- A parent or guardian may exercise the rights in section 9 for their child and may withdraw consent.
- We do not use children's data for advertising or track their behaviour for advertising.
6. Retention and deletion
| Data | Retention |
|---|---|
| Account data | When an administrator processes a closure request, the name, email, password, notes, recorded user ID, course and school grade are removed or replaced at once (pseudonymised). This cannot be undone. |
| Learning and test records | After closure, kept in pseudonymised form and used only for per-question statistics, for up to 3 years, then deleted |
| Parent/guardian consent record | 3 years after account closure, as evidence of consent (method, date, document effective date and relationship — parent or legal guardian — only; the parent/guardian's name and contact and the student's date of birth are removed at closure) |
| Access logs | Website server access logs (Vercel, including the IP address and browser information of each visit) up to 1 day; database and sign-in server logs (Supabase) up to 7 days; sign-in session records until you sign out or close your account; the last sign-in time until you close your account; backups 7 days |
| Security access log | Kept for one year, then deleted automatically. Kept apart from the account for that period even after the account is closed. Used only to investigate security incidents and to answer requests made under law. Records without a known account that come in bursts are kept only up to 20 per IP address per 10 minutes and 200 in all per hour; the rest are replaced by a single burst record |
| Account change log | Who changed which account setting (approval, role, active status, password reset, closure requests and closures, time zone and similar) and when, without IP addresses. Kept while the Service operates, as a record of account management; the sign-in ID in it is removed when the account is closed |
Data past its retention period is deleted so that it cannot be recovered. Where a law requires longer retention, we keep that data separately for the required period.
7. Sharing with third parties
We do not sell or give personal data to other companies or people, except where required by law. Telling a student's parent or guardian about the student's learning results is part of the lesson service.
8. Service providers and international transfer
We use the providers below to run the Service. Through them, personal data is stored in or sent to the countries listed. Data is sent over encrypted connections each time the Service is used.
| Provider | What they do | Location | Data | Retention |
|---|---|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage, backups (7 days) | India (Mumbai) | All data in section 2 | As in section 6 |
| Vercel Inc. (US company) | Website hosting, server functions, scheduled jobs, access logs | Server functions in India (Mumbai); access logs may be stored in regions where Vercel operates (including the United States); page files from a region near the user | Access logs (including IP), data shown on screen | Access logs 1 day |
| Resend (once email is connected) | Sign-up confirmation and password reset emails | United States (sending records stored); sending planned from Japan (Tokyo) | Email address, name | Sending records 30 days |
Provider privacy contacts: Supabase privacy@supabase.com, Vercel privacy@vercel.com, Resend support@resend.com. These services are necessary to provide the Service; if you object to the transfer, tell us using the contact in section 13 and we will close the account.
9. Your rights and your parent/guardian's rights
- You (or your parent or guardian if you are under 18) may at any time ask to access, correct, erase or stop processing your data, or withdraw consent.
- Users in India may nominate another person to exercise these rights if they become unable to do so.
- Send requests to the email in section 13. We will confirm your identity (or the parent/guardian's) and respond within 10 days.
- Withdrawing consent is as easy as giving it. After withdrawal, use of the Service stops.
- Information you cannot change on screen can be corrected by asking an administrator.
10. Security
- Passwords are stored only as one-way hashes.
- All connections are encrypted (HTTPS).
- Database access rules limit each record to the user and the staff responsible for them.
- Administrator access is limited to those who need it, and account changes are logged.
- Test and production databases are kept separate.
11. Cookies
The Service uses only the cookies and browser storage below. We do not use advertising, marketing or visitor-analytics cookies. You can block cookies in your browser, but you will not stay signed in.
| Name | Purpose | Kept for |
|---|---|---|
| Sign-in cookie (sb-…-auth-token) | Keeps you signed in | Up to 400 days; removed when you sign out |
| Email-link cookie (sb-…-code-verifier) | Checks email sign-in links | Briefly, until the link is confirmed |
| Language cookie (locale) | Remembers your display language | 1 year |
| Browser storage (pmedu-draft) | Keeps answers you are working on | Removed once saved to the server or submitted |
12. Data breaches
If we become aware of a personal data breach, we will act without delay to limit the harm and tell affected users and parents/guardians what happened, its likely effects and what we are doing. We will also report it to the authorities required by law within the legal time limits.
12A. Security incidents
If we become aware of a security incident such as hacking or unauthorised access, we will act without delay to limit the harm, report it to the authorities required by law (such as CERT-In in India) within the legal time limits, and tell affected users and parents/guardians without delay what happened and what we are doing. The security access log in section 6 is used for the investigation. The person responsible for incident response is the officer named in section 13.
13. Contact and grievance officer
- Data protection, grievance and security incident officer: Kihun Choi, Director
- Email: director@pmeducation.net
- Languages: English, Korean
14. Further help
If you are not satisfied with our response, you may contact the following.
- India: Data Protection Board of India (once the DPDP Act is in force)
- Korea: Personal Information Dispute Mediation Committee (1833-6972), Personal Information Infringement Report Center (118), Supreme Prosecutors' Office (1301), Korean National Police Agency (182)
15. Changes to this policy
We will announce changes on the site at least 7 days before they take effect, and at least 30 days before for important changes that are less favourable to users, for which we will ask for consent again.
Effective date: 19 October 2026