Android App Privacy Policy

Short version for families

Clever Pomelo is a guided homework support service. We use student homework, chat messages, uploaded files, and learning settings to provide tutoring support, parent controls, safety features, and account access.

We do not sell personal information. We do not use student content for targeted advertising. We share data only when needed to run the service, process payments, provide AI tutor responses, keep accounts secure, meet legal duties, or respond to privacy and safety requests.

Parents and eligible students can ask to access, correct, delete, or restrict personal information by contacting [email protected].

Privacy for students

We use your account and homework information to help you with schoolwork. This can include what you type, files you upload, your chat history, your grade level if it is added, and settings chosen by you or your parent.

Your parent or guardian may be able to see parts of your account, homework progress, practice tasks, and requests for full solutions. If your account was created by a parent, they can manage that child account.

Please do not type private things you do not need for homework, such as your home address, phone number, passwords, health information, or secrets about other people.

If you are under 13, a parent or guardian must create and manage your child account. If something in your account looks wrong or you want information deleted, ask your parent or contact [email protected].

Who we are

Clever Pomelo is operated through the website at cleverpomelo.com. For privacy requests, child-safety questions, or data protection concerns, contact [email protected].

For the native Android App, the service provider and controller for the processing for our own purposes described below is London AI Systems Ltd, 55 Peregrine Court, London, E5 9AN, UK.

Under the UK GDPR and EU GDPR, a controller decides why personal data is processed and the essential means of processing it. A processor handles personal data on behalf of a controller, following its documented instructions. These roles depend on the particular activity and who actually makes those decisions; the same business can have different roles for different activities.

When we act as a controller or processor

We act as a controller where we determine the purposes and essential means of processing. This includes managing accounts and providing learning features when you use our service directly, as well as processing for our own customer support, security, and legal obligations. The purposes, legal bases, and rights explained in this policy apply to that processing.

Where a school, employer, or other organisation determines the purposes and essential means of an activity, and we act solely on its behalf and under its documented instructions, that organisation is the controller and we are its processor for that activity. School or company access, paying for a subscription, or the title of an agreement does not by itself determine these roles. We remain a controller for separate processing we carry out for our own purposes.

Processing on behalf of a controller requires a binding written data processing agreement or other appropriate legal instrument meeting Article 28 of the applicable GDPR. It must cover, among other things, the subject matter, duration and purposes of processing, the types of data and people concerned, instructions, confidentiality, security, subprocessors, assistance with individuals' rights and personal data breaches, returning or deleting data, and audit rights. This Privacy Policy does not replace that agreement.

The organisation's own privacy notice explains the purposes and legal basis of processing for which it is the controller, and how to exercise your rights. For requests about that processing, you can contact the organisation or email us at [email protected]. If we receive a request concerning data we process on its behalf, we will forward it to the relevant controller and help it respond.

Information we collect

Account and profile data: email address, password credentials, login method, parent, student or teacher role, display name, profile details, language, timezone, theme, school or organisation details, grade level, accessibility preferences, and account status.

Student learning content: homework text, chat messages, conversation history, corrections, generated practice tasks, parent notes for tutoring, solution requests and decisions, reports about AI tutor responses and optional report explanations, uploaded images or PDFs, file names, file types, file sizes, and attachment metadata.

Parent and family controls: parent-child links, relationship labels, access permissions, quick-login codes, mobile login sessions, QR login challenges, approval decisions, progress visibility, and child-account management settings.

Billing and access data: plan, subscription status, Stripe and Apple identifiers, checkout status, invoices, payment amounts, billing market, tax or invoice details where required, company plan and invite-code records, extra usage purchases, and webhook audit records.

Technical and security data: IP address, device and browser information, cookies or similar session technology, authentication tokens, app install identifiers, logs, rate-limit signals, error reports, OpenAI request identifiers, model usage and cost records, and abuse-prevention signals.

How we use information

We use personal information to create and secure accounts, verify email addresses, provide guided tutor conversations, parse homework uploads, generate practice tasks, maintain parent controls, review reports about AI tutor responses, improve safety and address inappropriate or inaccurate output, manage subscriptions and usage limits, provide customer support, prevent fraud and abuse, troubleshoot the service, and comply with legal obligations.

We may use homework content, uploaded files, and conversation context with AI service providers, including OpenAI, to create tutor responses, parse homework, assess whether a student has tried enough before showing final answers, generate practice, and support safety controls. We limit this sharing to what is needed for the feature.

We may use de-identified, aggregated, or operational metrics to understand reliability, usage, model cost, safety, and product performance. We do not use student personal information to serve targeted advertising.

Legal bases for UK and EU users

Contract: to provide the account, tutoring features, uploads, subscriptions, support, and requested app functionality.

Legitimate interests: to keep the service secure, prevent abuse, improve reliability, understand usage, provide family safety features, manage internal records, and defend legal claims, balanced against the rights of students, parents, and other users.

Legal obligation: to keep billing, tax, accounting, fraud-prevention, consumer, and regulatory records where required.

Consent: where required for optional settings, communications, cookies that are not strictly necessary, or child consent rules for online services. Consent can be withdrawn where it is the legal basis for processing.

Children and students

The service is designed for homework support and may be used by children and teenagers with parent, guardian, school, or account-holder involvement. We aim to collect only what is needed for learning support, safety, account access, and billing.

For users in the United States, if COPPA applies because a child is under 13, we require parent or guardian involvement before collecting personal information from that child, including any direct parent notice and verifiable parental consent required by law. Direct student signup requires students to confirm they are at least 13; students under 13 must use a parent-managed child account created by a signed-in parent or guardian. Parents can review, correct, stop further collection or use of, or request deletion of their child's personal information by contacting us.

For users in the United Kingdom, where we rely on consent for an online service offered directly to a child, a child generally must be at least 13 to provide that consent. For users in Hungary and the EU, where we rely on consent for an online service offered directly to a child, a child generally must be at least 16 unless a different local rule applies. Below those ages, consent must come from a holder of parental responsibility.

Parents may be able to see child account status, homework context, progress signals, approval queues, practice tasks, and account controls. Students should avoid sharing unnecessary sensitive information in homework chats or uploads.

Teacher classes

Teacher Classes, classroom membership approvals, and teacher-set classroom conversations are web-only and are intentionally unavailable in the native Android App.

AI features and automated support

AI features may produce tutor replies, extract homework text from uploaded files, create practice questions, summarise progress, or make support recommendations. AI output can be imperfect and should not replace a teacher, parent, professional adviser, or emergency support.

Before the first AI request, we separately ask permission to send prompts, homework text, uploaded files, conversation context, parent settings, and related learning signals to OpenAI so it can provide tutor replies, homework parsing, practice generation, and safety support. For a managed child account, that permission must be given by the parent or guardian. We record the permission version, who gave it, and the date and time.

Permission can be withdrawn in the app or by contacting us. Withdrawal immediately prevents new AI requests and new sharing with OpenAI until current permission is given again. It does not by itself delete account content or records already lawfully retained; use account deletion or contact us for an applicable deletion request.

Some product decisions, such as whether a final solution can be shown automatically, may use AI-assisted signals about effort and understanding. These are learning-support decisions, not legal or similarly significant decisions. Parents or users can contact us to ask for review or correction.

Who we share information with

Service providers: hosting, database, storage, email delivery, security, analytics if enabled, support tooling, and infrastructure providers.

AI providers: providers such as OpenAI that process homework, uploaded files, prompts, and conversation context to generate or support tutor responses.

Payment and app-store providers: Stripe, Apple, banks, card networks, tax and invoice systems, and related payment processors for checkout, subscription management, receipts, refunds, taxes, and fraud prevention.

Parents, guardians, schools, and organisations: where accounts are linked, managed, paid for, or invited through family, school, corporate, or organisation access features.

Legal and safety recipients: courts, regulators, law enforcement, professional advisers, or other parties where required by law or needed to protect users, the service, or the public.

Key service providers

We use trusted service providers to operate, secure, bill, support, and improve the service. These providers process personal information only where needed for the purposes described in this Privacy Policy.

Providers acting as our processors handle data on our behalf under documented instructions and data processing terms. Where we act as a processor for an organisation, providers engaged to help with that processing are subprocessors; appointing them requires the controller's prior specific or general written authorisation. Providers acting as independent controllers are responsible for their own processing purposes and explain those activities in their own privacy notices. The description "payment processor" does not by itself mean that a provider is a processor under the GDPR.

We never use student personal information or uploaded homework to train AI models. We do not permit our AI service providers, including OpenAI, to use this information or content for AI model training.

More information about these providers' privacy and security practices is available from their own privacy notices, security pages, and data processing terms. We do not publish detailed infrastructure, security, server, database, API, or system configuration information for safety reasons.

International transfers

We may process and store personal information in the United Kingdom, European Economic Area, United States, and other countries where our providers operate. Where UK or EU data protection law requires transfer safeguards, we use appropriate mechanisms such as adequacy decisions, the EU-U.S. Data Privacy Framework and UK Extension where available, Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, and provider data processing terms.

Retention and deletion

We keep account, homework, conversation, upload, and parent-control records while an account is active and for as long as needed to provide the service, maintain safety and security, resolve disputes, enforce terms, and meet legal duties. We do not keep child personal information indefinitely when there is no continuing business, safety, legal, or account need.

Uploaded files may be pruned or deleted to manage storage limits. Mobile sessions, quick-login codes, QR challenges, and tokens expire or can be revoked. Billing, invoice, tax, fraud-prevention, and audit records may be retained longer where law or legitimate operational needs require this.

Anyone can start from our public account and data deletion page, including users who no longer have the app. The Android-specific page provides a direct privacy-support route for verified deletion requests without linking to purchases.

Authenticated deletion erases or anonymises personal account content where appropriate, disables login, removes stored uploads where possible, and attempts to delete associated AI upload files. Parent Hub’s reversible child-removal action is not permanent account deletion. Some billing, tax, webhook, purchase, and audit records may be retained where legally or operationally required. Deleting an account does not automatically cancel a Stripe, Apple, app-store, bank, or other payment-provider subscription.

Cookies and security

We use only essential cookies and similar technologies needed to keep the service working. These support secure login, keeping you signed in as you move between pages, protecting forms from misuse, remembering necessary account settings, remembering public quiz attempts and any associated reward, and maintaining service reliability. We do not use analytics, advertising, or tracking cookies.

Your rights

Depending on where you live, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal information, withdraw consent, complain to a regulator, or appeal a decision about your request.

California and certain other US state residents may have rights to know, access, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, and not be discriminated against for exercising privacy rights. We do not sell personal information or share it for cross-context behavioural advertising.

UK users can complain to the Information Commissioner's Office. Hungarian users can complain to the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH). EU users may also contact their local data protection authority.

To exercise rights, contact [email protected]. We may need to verify your identity or your authority to act for a child before fulfilling a request.

Changes

We may update this policy when the service, providers, law, or data practices change. If a change is material, we will take reasonable steps to notify users, parents, schools, or account holders where appropriate.