Privacy Policy

1. Introduction

Welcome to Kalki Academy ("we", "our", "us"). We operate the website kalkiacademy.top and the student learning management system at lms.kalkiacademy.top.

This Privacy Policy explains what personal information we collect, how we use it, how we protect it, and your rights regarding that information. By using our platforms, you agree to the practices described in this policy.

Kalki Academy is based in Punduloya, Sri Lanka and serves students across the island.

2. Information We Collect

2.1 Information you provide to us

When you or your parent/guardian registers for our classes or creates a student account, we collect:

• Full name of the student
• Username and password (password is encrypted and never stored in plain text)
• Grade / school year
• School name
• Home address and district
• Parent or guardian contact details
• Payment slip images uploaded for monthly fee verification
• Profile photograph (optional, uploaded by the student)

2.2 Information collected automatically

When you use our website or student portal, we may automatically collect:

• Login session information (to keep you signed in securely)
• Attendance records (dates on which you accessed your classes)
• Device type and browser information (for technical support purposes)

2.3 Information we do NOT collect

• We do not collect credit card or bank account numbers directly
• We do not collect government identification numbers
• We do not track your browsing activity outside of our platforms

3. How We Use Your Information

We use the information we collect only for the following purposes:

• Account management — to create and manage your student account
• Class access — to provide you with the correct Zoom class links for your enrolled subjects
• Payment verification — to verify monthly payment slips and activate or renew your account
• Attendance tracking — to maintain your monthly attendance record
• Announcements — to send you relevant academic announcements from your teacher
• Communication — to contact you or your parent/guardian regarding your account or classes
• System security — to protect accounts and prevent unauthorised access

We do not use your personal information for marketing to third parties, and we do not sell your data to anyone.

4. How We Share Your Information

We do not sell, rent or trade your personal information to any third party.

We may share limited information only in the following situations:

• With our hosting provider — our website and database are hosted on a secure shared hosting server. The hosting provider has no access to your personal data beyond server storage.
• With Zoom — when you join a live class, you connect to Zoom's platform. Please refer to Zoom's Privacy Policy for how they handle data.
• When required by law — if required by Sri Lankan law or a valid court order.

5. Data Security

We take the security of your personal information seriously. The following measures are in place to protect your data:

• All passwords are hashed using the bcrypt algorithm — we never store plain-text passwords
• All connections to our website use HTTPS (SSL/TLS encryption)
• Database credentials are stored in a secure environment file outside the web root
• Login attempts are rate-limited — accounts are temporarily locked after 5 failed attempts
• Sessions expire automatically after 30 minutes of inactivity
• Uploaded payment slips are stored in a protected folder that blocks direct web access
• Security headers are applied to all pages to prevent common web attacks

While we implement strong security measures, no system can guarantee 100% security. We encourage you to use a strong, unique password for your account.

6. Data Retention

We retain your personal data for as long as your student account is active or as long as it is needed to provide our services.

• Student account data is kept while the student is enrolled with Kalki Academy
• Payment slip images are retained for record-keeping purposes
• When an account is deleted by the admin, personal data associated with that account is removed from our system

7. Children's Privacy

Kalki Academy is an educational platform that serves school-age students, including minors under the age of 18. We take special care to protect children's privacy.

• Student accounts for minors are created by the admin based on information provided by the parent or guardian
• Parents or guardians may contact us at any time to review, update or request deletion of their child's data
• We do not display student information publicly
• We do not use student data for advertising purposes

8. Your Rights

You (or your parent/guardian on your behalf) have the following rights regarding your personal data:

• Access — you may request a copy of the personal data we hold about you
• Correction — you may ask us to correct inaccurate information
• Deletion — you may request deletion of your account and associated data
• Objection — you may object to how we use your data in certain circumstances

To exercise any of these rights, please contact us using the details below.

9. Cookies

Our student portal uses a single session cookie to keep you logged in securely. This cookie:

• Is essential for the portal to function — you cannot log in without it
• Is marked as secure (HTTPS only) and HttpOnly (cannot be accessed by JavaScript)
• Expires when you log out or after 30 minutes of inactivity

We do not use advertising cookies, tracking cookies, or third-party analytics cookies.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. When we make significant changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Continued use of our platform after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or your personal data, please contact us: