Privacy Policy

Avora Learn ( "Avora," "we," "us") is operated by Orvexa AI Technologies Private Limited. We provide interactive visual programming courses and related educational tools at avoraai.app and in the Avora Learn mobile apps for Android and iOS. This policy covers the website and the apps.

Registered office: 209, Kohinoor Enclave, Ladhewali, Jalandhar - 144004, Punjab, India. For privacy questions, email support@avoralearn.app or use our Contact page.

We collect information in the following categories:

• Account & identity data — name, email address, phone number (when you provide it), password hash (not your plain password), sign-in identifiers from Google or Apple (with Sign in with Apple you may choose to share a private relay email address instead of your own), account role, and preferences such as your daily study goal.
• Learning & product data — course and lesson progress, quiz and prediction answers, playground code submissions and run results, notebook notes where you use them, AI tutoring prompts/responses needed to deliver the feature, certificates or completion records, and related classroom metrics.
• Billing & subscription data — plan selected, subscription status, invoice/transaction identifiers, coupon or promo codes applied, billing country/region, and limited payment status from our payment processors. Full card numbers and sensitive payment credentials are collected and stored by the payment processor, not on our application servers. For purchases made in the mobile apps through Google Play or the App Store, we receive the product, a purchase token or transaction identifier, and the subscription's status, renewal and expiry dates; Google or Apple handles the payment itself and does not share your card details with us.
• Mobile app data — device type and model, operating system version, app version and update identifiers (used to deliver app updates), a random guest identifier created when the app is installed (so guest progress can be kept and moved to your account when you sign in), and sign-in tokens, which are stored in your device's secure storage. The apps do not access your contacts, photos, location or microphone, do not show ads, and do not use an advertising identifier.
• Technical & usage data — IP address (and approximate location derived from it), device/browser type and version, operating system, referrer, pages or lessons visited, feature usage events, error and performance logs, and session or analytics identifiers.
• Communications — support emails, contact form messages, feedback, and records of legal consent (terms/privacy acceptance version and timestamp).
• Cookies & similar technologies — session authentication cookies, preference/settings storage, and product analytics or security cookies as needed to run and protect the service.

We collect this information when you create an account, sign in, use courses and playgrounds, checkout or manage a subscription, contact support, or browse our site. We may also receive limited data from identity providers (OAuth) and payment processors about success/failure of authentication or payment.

We use the information described above to:

• Create, authenticate, and secure your account
• Deliver lessons, sync progress, run playgrounds, quizzes, certificates, and AI tutoring features
• Process subscriptions, payments, refunds, and send transactional emails
• Operate customer support and respond to your requests
• Prevent fraud, abuse, spam, and security incidents; debug and monitor reliability
• Analyze product usage to improve content, features, and performance
• Comply with law, enforce our Terms, and protect our rights and users

We do not sell your personal information. Where local law requires a legal basis (for example legitimate interests, contract performance, consent, or legal obligation), we process data only on an appropriate basis for the activity.

We share personal information only as needed to operate the service, as required by law, or with your direction. Categories of recipients include:

• Hosting & infrastructure providers — cloud databases, application hosting, storage, and content delivery networks that store or serve our application and data under contract.
• Payment processors — for example Razorpay and other payment partners we use on the website for checkout, card processing, subscriptions, payouts, and fraud prevention. They receive billing details required to complete payment; card data is handled under their PCI-compliant systems.
• App stores — purchases in the mobile apps are processed by Google Play or Apple's App Store under their own terms and privacy policies. We send them our product identifiers and an internal account identifier (not your name or email address) so a purchase can be matched to your account, and we receive confirmation of the purchase and its renewals, cancellations and refunds.
• Email & communications providers — to send verification, password reset, receipts, and support-related messages.
• Analytics & monitoring providers — to measure product usage, diagnose errors, and improve reliability (typically pseudonymous or aggregated technical events where practicable).
• Identity / OAuth providers — when you choose social sign-in (Google or Apple), that provider authenticates you and shares limited profile identifiers we use to open or link your account.
• AI service providers — currently OpenAI, with Google (Gemini) as a backup. When you ask the AI tutor a question, your question and the related lesson context are sent to produce the answer, and lesson narration text is sent to generate spoken audio. They process this under their API terms to provide the response; we do not send your password or payment details.
• Professional advisors & authorities — lawyers, auditors, or government agencies when required by law, legal process, or to protect rights, safety, and security.
• Business transfers — if we reorganize, merge, or transfer assets related to the service, information may transfer to a successor under appropriate confidentiality commitments.

Service providers are authorized to process personal data only to perform services for us and must protect it according to their contracts and applicable law. We do not sell personal information to third parties for their independent marketing.

When we disclose information, we do so through controlled technical and contractual means:

• Secure connections — data in transit between your browser, our servers, and processors is transmitted over encrypted channels (HTTPS / TLS) where supported.
• Application programming interfaces (APIs) — payment, email, OAuth, analytics, and AI partners receive only the fields required for that request via authenticated API calls or their hosted checkout/sign-in widgets.
• Redirects & hosted widgets — checkout or OAuth flows may send you to a trusted processor page; that processor collects payment or login credentials directly under its own privacy terms for those fields.
• Contractual safeguards — processors act under data processing or service agreements that restrict use of your data to our instructions and require confidentiality and security measures.
• Legal process — if we receive a valid request from a court or regulator, we may disclose specific records needed to comply, limited to what is required.

We implement administrative, technical, and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. Practices include, where appropriate for our systems:

• Encryption of data in transit using TLS for website and API traffic
• Passwords stored using modern one-way hashing; we never store plain-text passwords
• Access controls for production systems and databases (least privilege, authenticated staff access)
• Separation of roles and credentials for infrastructure and payment environments; card data remains with PCI-compliant payment processors
• Application authentication (sessions/tokens) and abuse rate limiting
• Logging and monitoring to detect unusual activity, plus vendor security updates on a reasonable schedule
• Backups and retention controls intended to support recovery and minimize unnecessary long-term storage of sensitive fields

No method of electronic transmission or storage is completely secure. You are responsible for keeping your password confidential and for activity under your account. If you believe your account has been compromised, contact us promptly at support@avoralearn.app.

We retain account and learning records while your account is active and for a period afterward as needed for billing disputes, security investigations, backups, legal claims, and legal or tax obligations. Support messages and logs are kept for a reasonable operational period. When data is no longer needed, we delete or anonymize it where practicable.

When you create an account, we record that you accepted our Terms of Service and Privacy Policy, including the policy version and the time of acceptance. This record helps us demonstrate what terms applied when you joined.

Depending on your location, you may have rights to access, correct, delete, or restrict certain personal data, or to object to some processing. You may update many profile details in-app, request account deletion, or exercise privacy rights by contacting support@avoralearn.app. We may need to verify your identity before fulfilling a request. You can also review our Terms of Service and Contact page.

Deleting your account. You can delete your account in the app (Profile → Delete account), on the website (Settings → Delete account), or by following the steps at avoraai.app/delete-account. You are signed out on all devices straight away, and the account is permanently deleted after 14 days; signing in again within those 14 days cancels the deletion. Deletion removes your profile, learning progress, AI tutor history and other personal data. We keep an anonymised record of past payments, without your name or email address, where tax and accounting law requires it. A recurring website subscription must be cancelled before you delete the account. Deleting your account does not cancel a subscription bought through Google Play or the App Store: cancel it in the Play Store or in your Apple account settings.

We and our providers may process and store information in India and other countries where our infrastructure or processors operate. Those locations may have different data protection laws than your home country. Where required, we use appropriate contractual or other safeguards for cross-border transfers.

The service is not directed at children under the age where parental consent is required in your jurisdiction. If you believe we have collected personal data from a child without appropriate consent, contact us and we will take steps to delete it where required.

We may update this policy. Material changes will be reflected by a new version date on this page. Continued use after an update means you accept the revised policy where permitted by law. If we change how we use personal information in a material way that requires fresh consent, we will seek it where required.

Privacy requests and questions: support@avoralearn.app. Business contact details are also on our Contact page.