Privacy Policy

Avora Learn ( "Avora," "we," "us") is operated by Orvexa AI Technologies Private Limited. We provide interactive visual programming courses and related educational tools at avoraai.app.

Registered office: 209, Kohinoor Enclave, Ladhewali, Jalandhar - 144004, Punjab, India. For privacy questions, email support@avoralearn.app or use our Contact page.

We collect information in the following categories:

• Account & identity data — name, email address, phone number (when you provide it), password hash (not your plain password), OAuth identifiers (for example Google sign-in), account role, and preferences.
• Learning & product data — course and lesson progress, quiz and prediction answers, playground code submissions and run results, notebook notes where you use them, AI tutoring prompts/responses needed to deliver the feature, certificates or completion records, and related classroom metrics.
• Billing & subscription data — plan selected, subscription status, invoice/transaction identifiers, coupon or promo codes applied, billing country/region, and limited payment status from our payment processors. Full card numbers and sensitive payment credentials are collected and stored by the payment processor, not on our application servers.
• Technical & usage data — IP address (and approximate location derived from it), device/browser type and version, operating system, referrer, pages or lessons visited, feature usage events, error and performance logs, and session or analytics identifiers.
• Communications — support emails, contact form messages, feedback, and records of legal consent (terms/privacy acceptance version and timestamp).
• Cookies & similar technologies — session authentication cookies, preference/settings storage, and product analytics or security cookies as needed to run and protect the service.

We collect this information when you create an account, sign in, use courses and playgrounds, checkout or manage a subscription, contact support, or browse our site. We may also receive limited data from identity providers (OAuth) and payment processors about success/failure of authentication or payment.

We use the information described above to:

• Create, authenticate, and secure your account
• Deliver lessons, sync progress, run playgrounds, quizzes, certificates, and AI tutoring features
• Process subscriptions, payments, refunds, and send transactional emails
• Operate customer support and respond to your requests
• Prevent fraud, abuse, spam, and security incidents; debug and monitor reliability
• Analyze product usage to improve content, features, and performance
• Comply with law, enforce our Terms, and protect our rights and users

We do not sell your personal information. Where local law requires a legal basis (for example legitimate interests, contract performance, consent, or legal obligation), we process data only on an appropriate basis for the activity.

We share personal information only as needed to operate the service, as required by law, or with your direction. Categories of recipients include:

• Hosting & infrastructure providers — cloud databases, application hosting, storage, and content delivery networks that store or serve our application and data under contract.
• Payment processors — for example Stripe and other payment partners we use for checkout, card processing, subscriptions, payouts, and fraud prevention. They receive billing details required to complete payment; card data is handled under their PCI-compliant systems.
• Email & communications providers — to send verification, password reset, receipts, and support-related messages.
• Analytics & monitoring providers — to measure product usage, diagnose errors, and improve reliability (typically pseudonymous or aggregated technical events where practicable).
• Identity / OAuth providers — when you choose social sign-in (for example Google), that provider authenticates you and shares limited profile identifiers we use to open or link your account.
• AI service providers — where AI tutoring or generation features are enabled, prompts and related context needed to produce a response may be processed by third-party model providers under our agreements and usage policies.
• Professional advisors & authorities — lawyers, auditors, or government agencies when required by law, legal process, or to protect rights, safety, and security.
• Business transfers — if we reorganize, merge, or transfer assets related to the service, information may transfer to a successor under appropriate confidentiality commitments.

Service providers are authorized to process personal data only to perform services for us and must protect it according to their contracts and applicable law. We do not sell personal information to third parties for their independent marketing.

When we disclose information, we do so through controlled technical and contractual means:

• Secure connections — data in transit between your browser, our servers, and processors is transmitted over encrypted channels (HTTPS / TLS) where supported.
• Application programming interfaces (APIs) — payment, email, OAuth, analytics, and AI partners receive only the fields required for that request via authenticated API calls or their hosted checkout/sign-in widgets.
• Redirects & hosted widgets — checkout or OAuth flows may send you to a trusted processor page; that processor collects payment or login credentials directly under its own privacy terms for those fields.
• Contractual safeguards — processors act under data processing or service agreements that restrict use of your data to our instructions and require confidentiality and security measures.
• Legal process — if we receive a valid request from a court or regulator, we may disclose specific records needed to comply, limited to what is required.

We implement administrative, technical, and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. Practices include, where appropriate for our systems:

• Encryption of data in transit using TLS for website and API traffic
• Passwords stored using modern one-way hashing; we never store plain-text passwords
• Access controls for production systems and databases (least privilege, authenticated staff access)
• Separation of roles and credentials for infrastructure and payment environments; card data remains with PCI-compliant payment processors
• Application authentication (sessions/tokens) and abuse rate limiting
• Logging and monitoring to detect unusual activity, plus vendor security updates on a reasonable schedule
• Backups and retention controls intended to support recovery and minimize unnecessary long-term storage of sensitive fields

No method of electronic transmission or storage is completely secure. You are responsible for keeping your password confidential and for activity under your account. If you believe your account has been compromised, contact us promptly at support@avoralearn.app.

We retain account and learning records while your account is active and for a period afterward as needed for billing disputes, security investigations, backups, legal claims, and legal or tax obligations. Support messages and logs are kept for a reasonable operational period. When data is no longer needed, we delete or anonymize it where practicable.

When you create an account, we record that you accepted our Terms of Service and Privacy Policy, including the policy version and the time of acceptance. This record helps us demonstrate what terms applied when you joined.

Depending on your location, you may have rights to access, correct, delete, or restrict certain personal data, or to object to some processing. You may update many profile details in-app, request account deletion, or exercise privacy rights by contacting support@avoralearn.app. We may need to verify your identity before fulfilling a request. You can also review our Terms of Service and Contact page.

We and our providers may process and store information in India and other countries where our infrastructure or processors operate. Those locations may have different data protection laws than your home country. Where required, we use appropriate contractual or other safeguards for cross-border transfers.

The service is not directed at children under the age where parental consent is required in your jurisdiction. If you believe we have collected personal data from a child without appropriate consent, contact us and we will take steps to delete it where required.

We may update this policy. Material changes will be reflected by a new version date on this page. Continued use after an update means you accept the revised policy where permitted by law. If we change how we use personal information in a material way that requires fresh consent, we will seek it where required.

Privacy requests and questions: support@avoralearn.app. Business contact details are also on our Contact page.