Powering adaptive learning with respect for privacy

Introduction

How the Nebular service works and who it serves

LLP "Nebular" ("Nebular," "we," "us," or "our") operates the Nebular learning platform, including our website and mobile applications (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

Nebular is an adaptive learning platform designed for K-12 students, teachers, and schools. Our Service provides personalized education through diagnostic assessments, practice exercises, homework assignments, and AI-powered learning assistance.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy.

Information We Collect

What data powers diagnostics, AI tutoring, and analytics

We collect information you provide, data captured automatically by the platform, learning signals generated during practice, and organizational context needed to manage classes and schools.

Information You Provide

Information Collected Automatically

Learning and Educational Data

Organizational Data

How We Use Your Information

Purpose-built data flows

Information powers the adaptive learning experience, AI features, teacher workflows, communications, and platform operations.

Provide Adaptive Learning

• Generate personalized learning paths based on diagnostic assessments
• Calculate and track skill mastery levels
• Identify knowledge gaps and misconceptions for targeted practice
• Recommend appropriate difficulty levels and problem types

Power AI-Assisted Features

• Provide real-time tutoring assistance through our AI assistant
• Extract mathematical expressions from uploaded images of handwritten work
• Generate practice problems tailored to student skill levels
• Translate educational content to support multilingual learners (English, Russian, Kazakh)

Support Teachers and Schools

• Provide class-level analytics and skill mastery heatmaps
• Identify at-risk students who may need additional support
• Enable homework assignment and tracking
• Generate progress reports for parent-teacher communication

Send Communications

• Deliver push notifications about new homework assignments
• Send important account and service updates
• Provide educational reminders (with appropriate consent)

Maintain and Improve the Service

• Monitor platform performance and fix technical issues
• Analyze usage patterns to improve educational effectiveness
• Ensure security and prevent unauthorized access
• Comply with legal obligations

Data Sharing and Third Parties

Only what is necessary for learning

We share your information only as described here. We do not sell personal information, we do not use it for advertising, and we do not share data with advertising networks or data brokers.

Service Providers

Other Disclosures

To Schools and Teachers:

Student learning data is shared with authorized teachers and school administrators for educational purposes.

With Your Consent:

When you explicitly authorize sharing.

For Legal Compliance:

When required by law, regulation, or legal process.

For Safety:

To protect the rights, safety, or property of Nebular, our users, or the public.

Business Transfers:

In connection with a merger, acquisition, or sale of assets (with continued privacy protections).

Data Retention

How long information stays in the system

Data Security

Technical and organizational safeguards

We implement appropriate measures to protect your information and continually evaluate our defenses.

Technical Safeguards

• Authentication: Industry-standard OAuth 2.0 and OpenID Connect protocols with secure token validation.
• Encryption: TLS encryption for all data in transit; encryption at rest for stored data.
• Access Control: Role-based access control (RBAC) limiting data access to authorized personnel.
• Infrastructure: Isolated cloud environments, network security policies, and regular security audits.

Organizational Safeguards

• Employee training on data protection.
• Incident response procedures.
• Regular security assessments.
• Vendor security evaluations.

Children's Privacy

How we protect young learners

Age Requirements

Users under 14 years of age may only use our Service with verifiable parental consent or through a school that has obtained appropriate consent.

Schools using our Service are responsible for ensuring appropriate parental consent is in place.

School Consent

When a school uses Nebular, it is responsible for ensuring parental awareness and consent where required, and we rely on the school to comply with applicable consent requirements.

Data Collection for Children

Collect only information necessary for educational purposes.

Do not use personal information for behavioral advertising.

Do not require children to disclose more information than reasonably necessary.

Provide parents and schools with access to review and delete their child's information.

Parental Rights

Review their child's personal information by contacting us or the child's school.

Request deletion of their child's personal information.

Refuse further collection of their child's information (which may limit access to certain features).

Kazakhstan Personal Data Protection

Compliance with national law

Data Localization

• Primary data storage is located within the Republic of Kazakhstan.
• Personal data of Kazakhstan citizens is stored on servers located in Kazakhstan (Yandex Cloud Kazakhstan).

Your Rights Under Kazakhstan Law

• Access: Obtain information about the processing of your personal data.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of personal data collected in violation of the law.
• Withdrawal of Consent: Withdraw your consent to data processing at any time.
• Restriction: Request restriction of processing in certain circumstances.

Legal Basis for Processing

• Your consent (provided during registration).
• Performance of our contract with you or your school.
• Compliance with legal obligations under Kazakhstan law.
• Legitimate interests in providing educational services.

Cross-Border Transfers

• Adequate protection measures are in place.
• Appropriate contractual safeguards with receiving parties.
• Compliance with Kazakhstan cross-border transfer requirements.

Student Data Privacy (US Users)

US-specific obligations

FERPA

• We act as a "school official" with a legitimate educational interest when providing services to US schools.
• We use student education records only for the purposes for which the disclosure was made.
• We do not re-disclose personally identifiable information from education records without consent.

COPPA

• For US users under 13, verifiable parental consent or school consent is required.
• Schools may consent on behalf of parents under the COPPA school consent exception.
• We collect only information necessary for educational purposes.

Your Privacy Rights

How to stay in control

All users have core rights over their data, with additional protections in certain regions.

Additional Rights for EU/EEA Users (GDPR)

• Right to Object: Object to processing based on legitimate interests.
• Right to Restrict Processing: Request limitation of processing in certain circumstances.
• Right to Withdraw Consent: Withdraw consent at any time (without affecting prior processing).
• Right to Lodge a Complaint: File a complaint with your local data protection authority.
• Legal Basis: Performance of contract, legitimate interests, legal obligations, or consent.

Additional Rights for California Users (CCPA/CPRA)

• Right to Know: Request disclosure of personal information collected, used, and shared.
• Right to Delete: Request deletion of your personal information.
• Right to Opt-Out of Sale: We do not sell personal information, so this right does not apply.
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights.

International Data Transfers

Where processing occurs

• Appropriate contractual safeguards with service providers.
• Technical and organizational measures to ensure data protection.
• Compliance with applicable cross-border transfer requirements.

AI and Automated Decision-Making

Human-centered automation

Our AI Commitments

• Transparency: We clearly identify AI-powered features.
• Human Oversight: Teachers and administrators maintain control over educational decisions.
• Educational Purpose Only: AI is used solely to support learning, not for profiling or non-educational purposes.
• Bias Mitigation: We regularly evaluate AI systems for fairness and accuracy.
• Data Minimization: AI features receive only the data necessary for their function.

Teacher Data Access

What educators can view

What Teachers Can See

• Individual student progress and mastery levels.
• Class-wide skill heatmaps and analytics.
• Homework completion and submission details.
• At-risk indicators and engagement metrics.
• Misconception patterns and learning gaps.

What Teachers Cannot See

• Private account credentials.
• Data from students outside their classes.
• Raw AI assistant conversation logs (only aggregated insights).

Teacher Responsibilities

• Use student data only for educational purposes.
• Maintain confidentiality of student information.
• Comply with applicable privacy laws and school policies.
• Report any suspected data breaches immediately.

Changes to This Privacy Policy

How we communicate updates

We may update this Privacy Policy from time to time. When we make material changes you can expect:

• Posting the new Privacy Policy on this page.
• Updating the "Last Updated" date at the top.
• Sending an email notification to registered users (for material changes).
• Providing in-app notification (for material changes).

Reach the Nebular privacy team

If you have questions about this Privacy Policy or our privacy practices, please contact us:

Email: developer@nebular.academy

Mailing Address: LLP "Nebular", Al-Farabi street, 30/1, flat 136, Esil district, Astana, 010000, Kazakhstan