Kheelona Robotics Privacy Policy (Beta)

Account Deletion: If you request to delete your (and your child’s) account, we will initiate deletion of personal data associated with you. We try to complete such deletions within 30 days of verifying your request. Deletion includes audio recordings, transcripts, profiles, and account info. Exceptions: as noted, we will keep any information that we are legally obligated to retain (e.g., purchase records for financial compliance) or that is necessary to resolve disputes or enforce our agreements. If we retain data for these reasons, we will stop using it for any other purpose and keep it only for the required period. After that, it will be erased or anonymized.

​​

Backup and Archives: Our systems may have backup databases or encrypted archives that are retained for reliability and disaster recovery. For instance, we keep periodic backups that cycle every ~30 days. If you delete data, it will be removed from active systems and won’t be used, but it might persist in backups until those backups expire and are overwritten. Our backup retention is typically 30 days, after which deleted data is fully purged. We do not restore backups for routine requests, only in emergency situations (e.g., data loss events). If a backup is restored, we will re-delete any data that was previously requested to be deleted as soon as practically possible.

​

We continuously evaluate our retention needs. We aim not to keep personal data longer than needed. If, for example, we find we can achieve the same business goals with shorter retention, we will adjust and update our policy. We will also securely dispose of any hardware or storage that is no longer used, to prevent any unintended data leaks. If you have specific questions about our retention practices (for example, “Has my child’s 3-year-old recording actually been deleted?”), feel free to reach out and we can provide confirmation.

​

​

Security Measures

We take the security of your and your child’s personal data very seriously. We have implemented a range of technical and organizational measures to protect against unauthorized access, alteration, disclosure, or destruction of data. Here are key security practices we follow:

​

• Encryption in Transit: All communication between your device (toy, app, or browser) and our servers is encrypted using HTTPS/TLS (Transport Layer Security) – we support TLS 1.2+ protocols. This means that data like voice recordings or login credentials are scrambled during upload/download so that eavesdroppers on the network cannot read it. For example, when the toy sends an audio recording to our server, it’s sent over an encrypted channel.

​

• Encryption at Rest: Personal data stored on our cloud servers is encrypted at rest. Our databases (e.g., Supabase PostgreSQL) and file storage (DigitalOcean Spaces) use encryption so that the underlying files on disk are not readable even if someone were to access the storage without authorization. In practice, this means even in the unlikely event that someone got hold of a hard drive from our cloud provider, they couldn’t extract meaningful data without the encryption keys.

​

• Access Controls: We limit access to personal data strictly to authorized personnel who need to know it to perform their job (principle of least privilege). For example, our development team might have access to aggregated analytics but not to raw audio files; our support team might access your account info when you have an open ticket, but they would not have access to unrelated data. All employee and contractor accounts with access to systems are protected with strong authentication (such as complex passwords and two-factor authentication).

​

• Admin and Developer Access Logging: We maintain logs of administrative access to sensitive systems. This means any time an engineer or administrator accesses production data, that action is recorded. We periodically review these logs to ensure there is no unauthorized or inappropriate access. During beta, our team is small, but as we grow, we’ll formalize these reviews and restrictions even more.

​

• Employee Training and Policies: Our team members are trained on data privacy and security practices, especially regarding children’s data. We have internal policies to prevent any misuse of data – for instance, employees are not allowed to download or share raw personal data outside our secure systems. Any violation of these policies can result in disciplinary action.

​

• Secure Development Practices: We build our software with security in mind. This includes regular code reviews, using updated frameworks, and avoiding known vulnerabilities. We sanitize and encrypt data as appropriate in the application workflow (for example, sensitive fields may be additionally encrypted at the application level).

​

• Testing and Scanning: We plan regular vulnerability scans of our systems and will conduct penetration testing at least annually (or before major releases). In a beta phase, we run automated security testing tools on our code and infrastructure. Any issues found are prioritized for fixing. We also keep our software dependencies up to date to patch security issues.

​

• Firewalls and Network Security: Our servers are protected by firewalls and network monitoring. We restrict access to our databases to a minimal set of IP addresses and services. Unusual network activity (like repeated failed login attempts or suspicious payloads) is flagged by our systems.

​

• Backups and Recovery: As mentioned in Data Retention, we maintain encrypted backups. We also have a disaster recovery plan – meaning if there’s a major issue (like data center outage or data corruption), we have procedures to restore functionality quickly, with minimal data loss. Backups are stored securely (encrypted and with access control). We periodically test restoring from backups to ensure data integrity

​

• Vendor Security: We choose reputable vendors (like Google, DigitalOcean, etc.) that have robust security programs. We review their security documentation. For example, DigitalOcean holds industry-standard certifications (like ISO 27001) and Razorpay is PCI DSS compliant for payment security. Our Data Processing Agreements with vendors require them to implement appropriate security measures and notify us if they experience any breach affecting our data.

​

• Incident Response: Despite all precautions, no system is 100% immune to incidents. We have an incident response plan. If we suspect or detect a data breach or security incident, we will: 1) Immediately work to contain and mitigate it (e.g., by shutting down affected systems, revoking compromised credentials, etc.), 2) Investigate to determine the scope and root cause, and 3) Notify affected users and authorities as required by law. Under the DPDP Act and other regulations, we aim to notify the relevant authorities and users of a breach within 72 hours of becoming aware of it (if it meets the threshold of harm, etc.). We will provide information on what happened, what data is affected, what we are doing about it, and what you may need to do. We will also take steps to prevent a recurrence.

​

• Continuous Improvement: Security is an ongoing effort. We will continuously update our safeguards as new threats emerge and as our company grows. We may also obtain third-party security audits or certifications in the future to validate our practices. Remember, you also play a role in security. Keep your account credentials (like OTPs or any future passwords) confidential. Monitor your account and let us know if you see anything suspicious (like unknown devices accessing the app, etc.). We will work with you to keep the platform safe.

​

International Data Transfers

We are based in India, and we endeavor to store data in India where feasible (for example, our primary database is in India). However, some of our processing involves international data transfers:

​

• Cloud Storage and Servers: Your data (including audio recordings) is stored in DigitalOcean’s Singapore data center. Singapore is an international location; however, it is generally considered to have strong data protection standards. We transfer data there to ensure reliable service and backups.

​

• AI Processing (Google): When our AI model (Google Gemini) processes conversation text, that data is sent to Google’s servers which may be located in the United States or other countries outside India. Similarly, Google Analytics and other Google services typically involve transferring data to the U.S.

​

• Communications & Others: If we send an SMS via Twilio or use a service like Freshdesk for support, those interactions may route data to servers outside India (e.g., US or EU) as described in the Third-Party section.

​

• Cross-Border Safeguards: The Digital Personal Data Protection Act, 2023 allows transfers of personal data outside India except to certain restricted countries (the government may notify such restrictions). We comply with this by mainly using services in jurisdictions with robust data protection, or by ensuring contracts that uphold Indian law standards. For every cross-border transfer, we take steps such as:

​

Contractual Protections: We have agreements with our processors that include data protection clauses. These require the processor to protect the data to the same level as required under Indian law (and, often, they also comply with international standards like GDPR). If India provides standard contract terms or other mechanisms, we will adopt those.

​

• Encryption & Security: As noted under Security, data is encrypted in transit. So, when it flows to or from another country, it’s protected from interception. Some data (like the content of conversations) is also end-to-end encrypted within our system until it reaches the AI processor.

​

• Selective Routing: We try to keep data regional when possible. For instance, our choice of Supabase’s India region means the bulk of data storage stays in India. We only send data out of country when necessary for the function (like using a specialized AI service or sending an email via an international service).

​

• Processor Vetting: We choose established companies (Google, DigitalOcean, etc.) that have a track record of data protection. Many of these companies participate in international frameworks for data transfer (for example, though not directly applicable to India, Google complies with EU SCCs and similar frameworks, indicating a high standard of care).

​

• By using our Service, you understand that your and your child’s data may be transferred to and processed in countries other than India. These countries may have data protection laws different from India’s, but we will ensure that your data is given adequate protection wherever it is processed. We monitor any updates in law: if India’s government specifies certain whitelisted countries or barred destinations for personal data, we will adjust our practices to comply (for example, not storing data in any prohibited locations).

​

If you have questions about cross-border data specifics (e.g., “Is my data going to country X?”), we can provide detailed answers. Our goal is transparency and compliance in all data transfers.

​

Children’s Privacy & Safety Commitments

Protecting children’s privacy is at the core of what we do. Our policies and practices reflect the special care required when handling data of young users:

​

• Parental Management: As stressed, a child cannot create an account or use the online services without a parent or guardian. We require verifiable parental consent for any collection of personal data from children, in line with India’s DPDP Act (and similar principles to international child privacy laws). This means you are always in control of what data we have about your child.

​

• No Direct Contact with Children: We do not communicate with children outside of the toy’s interactions. For example, we don’t send emails to children, we don’t allow children to enter free-form personal info in apps, and any notifications about the service go to the parent. The child’s experience is limited to the toy’s voice conversations and perhaps on-screen content in the parent-controlled app (if the child uses the app under your supervision)

​

• No Targeted Ads to Kids: We do not show any advertising to children through our toy or app. There are no banner ads, no commercial breaks, nothing of that sort. Our marketing efforts (like retargeting ads or emails) are strictly directed to parents/guardians, not to children. We also do not profile your child for advertising or any other commercial purpose. For example, we’re not going to take the fact that your child likes dinosaurs and try to sell that info or target dinotoy ads at them.

​

• No Sale or Unauthorized Sharing of Kids’ Data: We do not sell, rent, or lease personal information of children to anyone. We share the child’s data only as needed to operate the service (with the processors listed, under tight controls). We do not provide children’s data to third-party advertisers or data brokers.

​

• Content Moderation and Safety: We program our AI and toy content to be child-friendly. There are filters in place to prevent the AI from using profanity or discussing inappropriate topics. If a child tries to ask something that the AI is not meant to handle (like a question of an adult nature or something dangerous), the AI will respond with a gentle refusal or deflection. We also ensure the toy’s character itself is designed to encourage positive behavior (for instance, it might remind children to ask a parent before doing something potentially unsafe).

​

• No Manual Surveillance: As mentioned, we do not have staff or random people listening in on your child’s conversations with the toy. We consider those interactions private between your child, the toy (AI), and you (who can review logs). Our improvement processes use automated analysis. In exceptional cases, if a serious safety concern is flagged by our system (for example, if it appears a child might be in immediate danger or is being abused), we may manually review that specific situation and involve appropriate authorities to protect the child. However, such intervention would be rare and done with utmost caution and legal guidance.

​

• Parental Access: You have the right to see what your child has been telling the toy and what the toy has been saying. We provide that access to ensure you can always audit our AI’s behavior and ensure it aligns with your values and expectations. If you ever see something in the content that concerns you, please notify us – we can adjust the AI to avoid such responses in the future.

​

• Age-Appropriate Experience: We ask for age because we tailor the vocabulary, topics, and complexity of interactions. For example, a 3-year-old might get more playful, simple language, whereas an 8-year-old could have more educational and challenging content. This also means if an older child’s account is being used by a younger sibling, the content might not perfectly match their understanding – so ideally set the correct age for each child. We do not allow a child to lie about their age to get more mature content; since the parent sets the age, we trust you to provide the correct info.

​

• Guardian Data Fiduciary Compliance: Under the DPDP Act, organizations dealing with children’s data have heightened responsibilities. We adhere to those by obtaining parental consent, not causing harm to children’s well-being, and not tracking or behaviorally monitoring children beyond what’s needed for the service. We also will refrain from any detrimental processing – meaning we won’t, for example, serve content that is harmful or exploitative to children, and we won’t allow the data to be misused in ways that could negatively affect a child.

​

• If a Child Contacts Us Directly: Occasionally, a child might attempt to reach out (say, they find our support email and write to us). If we can identify that the sender is a child, we will not collect personal info from them. We will respond by asking them to have their parent or guardian contact us. We’ll then delete the child’s communication. Our channels (like support and social media) are intended for adults, and we moderate them accordingly.

​

• External Safety Measures: The toy is designed to be COPPA-inspired (Children’s Online Privacy Protection Act, a U.S. law) compliant for a global standard, even though our primary compliance is with Indian law which covers children up to 18. This means we treat all minors’ data with high protection. If we expand services beyond India, we will also comply with those local children’s privacy laws.

​

• Reporting Mechanism: If you believe we have unknowingly collected information from a child without parental consent or violated a child’s privacy rights, please notify our Grievance Officer immediately. We will take prompt action to investigate and delete any non-compliant data.

​

In essence, our business is built around children, which means earning and keeping parents’ trust is paramount. We strive to create a safe digital environment for kids to play and learn, while giving parents full visibility and control.

​

Your Rights and Choices

As a user (and data principal, under the DPDP Act), you have several rights regarding your personal data and your child’s personal data. We are committed to honoring these rights. Here’s a summary of your key data protection rights and how you can exercise them:

• Right to Access: You can ask us to confirm whether we are processing your personal data, and if so, request a copy of that data. For example, you can request, “Send me all the information you have about me and my child.” We will provide this, usually in a digital format (like a PDF or CSV file). This is sometimes called the right to portability as well – you have the right to get your data and even transfer it to another service.

• Right to Correction: If any personal data we have is incorrect or outdated, you have the right to have it corrected or updated. For instance, if your phone number has changed or we recorded the wrong birth year for your child, let us know and we will fix it. In many cases, you can directly edit basic profile info in the app, but if not, we’ll handle it upon request.

• Right to Deletion (Right to Erasure): You can request deletion of personal data that we hold, in certain circumstances. You may ask us to delete specific information (like a particular conversation recording) or delete your entire account and all associated data. We will carry out deletion requests unless we have a lawful reason to keep the data (as explained in Data Retention, e.g., some records for legal compliance). We will inform you of what has been deleted and if anything had to be retained. Once deleted, your data will typically be unrecoverable, so ensure you have any copies you want before requesting account deletion.

• Right to Withdraw Consent: Where we rely on your consent to process data (for example, for using your child’s voice recordings, or sending marketing emails), you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing done before you withdrew, but it means we will stop the specific activities going forward. For example, if you withdraw consent for us to keep voice recordings, we will stop recording new audio (though that means the toy’s functionality will be limited, or we might need to deactivate the service if voice processing is core). We’ll also delete the previously collected audio unless another legal basis applies for keeping it. Similarly, if you had consented to marketing, withdrawing means we stop sending you marketing emails/SMS.

• Right to Grievance Redressal: If you have any grievance or concern about how we are handling your or your child’s data, you have the right to complain to our Grievance Officer (contact details provided in the Contact section). For example, if you feel a request wasn’t handled properly or you have an issue with our practices, let the Grievance Officer know. We will acknowledge your complaint and address it in a timely manner (typically within 15 days). If you are not satisfied with the outcome, or if we don’t respond in the set time, you can escalate the complaint to the Data Protection Board of India (once it is operational under the DPDP Act) or the appropriate authority under other applicable laws. We really encourage you to come to us first, so we can resolve it directly.

• Right to Nominate (Succession of Rights): The DPDP Act provides that you can nominate another individual to exercise your data rights on your behalf in case of your death or incapacity. This is like assigning a trusted person who could, for example, request deletion of your data if something happens to you. While this scenario is hopefully unlikely to be needed, we want you to know the law provides for it. If you wish to designate a nominee, you can do so by emailing us with the nominee’s details and relationship to you. We may require some verification and documentation for such arrangements to ensure they are legally valid.

• Additional Choices – Cookies and Communications: As discussed in earlier sections, you have choices about cookies (you can opt out of non-essential ones) and communications (opt out of marketing, etc.). These choices are also your right. We comply with any Do-Not-Track or similar signals to the extent feasible (though standard is still evolving). If our app collects any data beyond what’s necessary, we will provide in-app settings to control that too.

​

How to Exercise Your Rights: The primary way to make any request is to contact us at legals@kheelona.com. For certain requests (like accessing or deleting data), we might provide forms or in-app options in the future, but during beta, email is the reliable channel. Please include in your request: the specific right you want to exercise, details about what you need (e.g., which data to correct or delete), and enough information for us to verify your identity.

​

Verification Process: We need to verify that any request is coming from the rightful person (you or an authorized representative like your nominee or legal guardian). For example, if you email from your registered email or initiate from the app while logged in, that helps verify. We might ask you to confirm a code sent to your phone or answer a security question (like last four digits of a saved payment method or date of last order) to ensure it’s you. This is to protect your privacy – we wouldn’t want someone else to impersonate you and get your data.

​

Timeline: We aim to respond to and fulfill requests promptly. Under Indian law, we intend to acknowledge complaints within 24 hours and resolve them within 15 days. For data access/correction/deletion requests, we’ll try to complete them within 15-30 days, depending on complexity. If we need more time (up to an additional 30 days, for example), we will let you know the reason (perhaps your data set is large, or we need clarification).

​

Limitations: In some cases, we might decline or delay a request if it falls under an exemption. For example, if deleting certain data would impede an ongoing legal obligation or if we cannot verify the requester’s identity. If so, we’ll explain why (unless legally barred from explaining). We will not discriminate against you for exercising your rights – meaning we won’t deny you the service or provide inferior service just because you made a data request. However, note that deletion or consent withdrawal might affect your ability to continue using the service (since the toy relies on data processing to function). We hope this empowers you to feel in control of your and your child’s personal information. If anything is unclear or you need help with exercising your rights, just ask – we’re here to help.

​

Cookies & Tracking Technologies

This section provides more detail on how we use cookies and similar technologies on our website and (to a lesser extent) in our app:

What are Cookies? Cookies are small text files placed on your browser or device when you visit a website. They serve a variety of functions, like remembering your preferences or tracking your visits. We also use analogous technologies such as web beacons (tiny graphics that send info) or local storage in apps.

Categories of Cookies We Use:

• Essential Cookies: These are necessary for our website to function. For example, if our site has a login for the parent dashboard or a shopping cart, an essential cookie keeps you logged in as you navigate pages or remembers the items in your cart. These cookies do not gather information for marketing or analytics. They are generally first-party cookies (set by kheelona.com). Without them, basic services you expect might not work. Because they are necessary, they’re typically exempt from consent requirements – though you can still block them via browser settings if you wish (but features may break).

• Analytics Cookies: These cookies collect information about how visitors use our site. We use Google Analytics 4, which sets cookies to understand page popularity, site entry/exit points, etc. The information collected (like page URL, time spent, device type) helps us improve the website’s design and content. Google Analytics in our setup does not collect personally identifying information – we utilize IP masking and do not send Google any names or emails. The data is aggregated. However, since analytics are not strictly necessary for the site to work, we treat these cookies as non-essential, meaning we ask for your consent before using them.

• Advertising Cookies (Marketing Cookies): If you consent, we use cookies/ pixels from advertising platforms (like Google Ads and Facebook/Meta). These track that your browser visited our site or took certain actions (like visited the pricing page). This allows us to later show you targeted advertisements on those platforms. For instance, Google’s cookie might enable us to show you a Kheelona ad when you search for kids’ toys, because you visited our site. These cookies might also measure ad campaign effectiveness (telling us if an ad resulted in you visiting or signing up). We do not use advertising cookies in any way that targets children – they are only present on pages intended for adults (like the marketing pages of our website). We obtain your opt-in consent for these cookies. If you do not accept, you’ll simply see generic ads or no Kheelona ads, and it won’t affect your use of our site.

• Functionality Cookies: These remember choices you make to personalize our site (like language preference if we support multiple languages, or a toggle for dark mode). Currently, our site is primarily in English and we may not have many of these yet, but if we do implement preferences, a cookie might store that. These cookies might be considered essential or semi-essential because they improve your experience. We may bundle them under essential for consent purposes if they don’t track you outside our site.

​

Cookie Consent Banner: On your first visit to kheelona.com (and periodically as required or if you clear cookies), you’ll see a banner or pop-up asking you to consent to cookies. You will have options such as: • “Accept All” – which enables analytics and marketing cookies in addition to essential ones. • “Reject Non-Essential” – which will refuse analytics/marketing cookies, allowing only essential ones. • “Manage Preferences” – where you can choose category by category (for example, allow analytics but not marketing, or vice versa).

​

We strive to make this compliant with Indian guidelines and global standards (while India doesn’t have a specific cookie law, the IT Act and DPDP emphasize consent for non-essential data collection, so we follow that approach).

​

How to Change Preferences: If at any time you want to change your cookie settings, you can do so by clicking the “Cookie Settings” link (typically in the footer of our site). That will bring back the preferences dialog. Or, you can clear cookies from your browser and revisit the site to get the banner again. Additionally, most browsers have settings to block or delete cookies. You can use those to control cookies on all sites. (For example, you can typically find cookie settings under Privacy in your browser settings, and you might even set it to block third-party cookies by default.)

​

Impact of Disabling Cookies: If you disable all cookies, our site may not remember your session or certain preferences, which could degrade functionality (e.g., you might have to login each time, or the cart might not work). But if you only disable analytics/ marketing, you shouldn’t notice much difference in functionality – just that your visit isn’t being counted in analytics and you won’t get targeted ads from us.

​

In-App Tracking: Our mobile app doesn’t use “cookies” per se, but it may use similar concepts (like an advertising ID on your device or an analytics SDK). If we implement analytics in the app, we will present an in-app privacy setting or mention during onboarding to ask for your consent, especially for any tracking beyond core functionality. You might have seen some apps ask “Allow tracking” on iOS, for instance – we currently do not track users across third-party apps, and have no third-party ad SDKs in the app. If that changes, we will be upfront and follow required consent flows.

​

Do Not Track: “Do Not Track” (DNT) is a browser setting that indicates a preference not to be tracked across websites. The industry hasn’t adopted a universal standard for DNT. However, our practice is to respect your privacy choices: if DNT is enabled, we treat it as an opt-out of third-party tracking to the extent we can. In practical terms, if we detect DNT, we would not load marketing pixels for that session. Analytics might still run since it’s first-party and anonymized, but since you can opt-out of analytics via our banner anyway, DNT is effectively covered by that mechanism too.

For more details or any questions on our use of cookies, feel free to contact us. We can provide a list of specific cookies in use if needed (name, purpose, duration, etc.). Also, our separate Cookie Policy/Notice (if linked on the site) provides a concise breakdown.

​

Beta Status and Changes to this Policy

Because Kheelona’s service is in beta, things are changing relatively quickly – and that means this Privacy Policy might need updates more frequently than a typical established service. Here’s what you should know:

​

• “Beta” Means Evolving: During this beta phase, we may introduce new features, change how certain data flows work, or onboard new service providers. For any material change in data handling, we will update this Privacy Policy accordingly. We indicate the effective date at the top so you know when it was last revised. We encourage beta users to check the Privacy Policy periodically to stay informed.

• Notification of Changes: If a change is significant (for example, we start collecting a new category of personal data or start using data in a new way that you wouldn’t expect under the current policy), we will provide a more prominent notice. This could be an email to registered parents, an in-app alert, or a banner on our website. In some cases, we might ask for fresh consent if required by law (e.g., if we were to start doing something that legally requires opt-in consent). Minor changes (like clarifications or grammatical fixes) may not be individually communicated, but the updated policy will always be available on our site.

• Your Acceptance of Changes: By continuing to use the toy, app, or website after a new Privacy Policy has become effective, you will be deemed to have accepted the updated practices. We will always note the “Last Updated” date so you can tell if it changed since your last read. If you do not agree with a change, you have the right to stop using the Services and request deletion of your data. We hope to never put you in a position where a policy change is objectionable – our philosophy is to respect user privacy and any changes will remain consistent with that.

• Version History: For transparency, we can provide previous versions of the Privacy Policy upon request (and in the future, we may maintain an archive on our website). This allows you to see what changed. During beta, expect the policy to iterate as we refine both our product and how we describe our practices. We value any feedback on the policy too – if something is unclear or you have suggestions for improvement, let us know! Beta is a two-way street. • Future Launch: When we exit beta and go to a full public launch, we will remove the “Beta” labels and possibly have a more finalized Privacy Policy. We will let all existing users know when that transition happens and highlight any differences.

​

In short, we will not reduce your rights under this Privacy Policy without your consent. Any update will be to further clarify, improve protections, or accommodate new services (with appropriate safeguards). Your trust is our priority, and we will act accordingly.

​

Contact Us & Grievance Redressal

We are here to answer your questions and address your concerns about privacy and data security. If you need to contact us for any reason related to this Privacy Policy or your personal data, please use the following details:

​

• Email (General Privacy Inquiries): legals@kheelona.com You can reach out via email for any requests (access, deletion, etc.), questions about our practices, or feedback. We typically respond within a few business days.

• Grievance Officer (India Specific): As per the IT Rules 2021 and DPDP Act, we have appointed a Grievance Officer to address any grievances you have regarding our handling of personal data. Name: Apoorva Sahu Title: Director & Grievance Officer Address: Kheelona Robotics Private Limited, No. 18, Ground Floor, N S Palya, BTM Layout, Bannerghatta Road, Bangalore South, Karnataka, India, 560076. Contact Email: legals@kheelona.com (Attn: Grievance Officer) Contact Phone: [Not publicly listed – please email to arrange a call if needed] Response Time: We will acknowledge receipt of your grievance within 24 hours and aim to resolve it within 15 days, as mandated by Indian regulations. If a delay is expected, we will inform you of the reason and progress.

• Postal Mail: You may also send written letters to our registered address (provided above). Please mark the envelope with “Attn: Privacy Officer” or “Attn: Grievance Officer” so it reaches the right team. Do note that postal inquiries may take longer to reach us, so email is usually faster.

​

If you’re contacting us to exercise a specific right (like accessing data or deleting something), please provide enough info for us to locate your account (e.g., the email or phone number you used to sign up) and verify you (we might reply asking for a bit more verification if needed, as discussed).

​

We are committed to resolving any issues amicably and transparently. In the unlikely event that you feel your concerns were not addressed satisfactorily by us, and you are in India, you can escalate to the Data Protection Board of India (once operational) or under the grievance mechanism of the IT Rules to the relevant authority. We truly hope that won’t be needed, and we’ll do our best to make things right.

​

Thank you for reading our Privacy Policy. We know it’s long, but we believe you deserve a thorough explanation of how we protect your and your child’s data. Your child’s safety and your trust in Kheelona are absolutely essential to us. If anything is unclear, don’t hesitate to reach out. Happy playing and learning with Kheelona!​​​​​​​​​​​​​​​