Privacy Policy

BrightMap AI (“BrightMap,” “we,” “us,” or “our”) builds an educational intelligence platform that helps schools, teachers, students, and parents track and improve understanding of what's being taught, concept by concept. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have, across this website (brightmapai.pk, the “Site”) and the BrightMap AI platform (the “Platform”) used by partner institutes.

If you have questions about this policy or how your information is handled, use our contact page.

This policy covers two related but distinct products:

• This website — informational pages, public interactive demonstrations, a contact email address, and links to our public social channels.
• The BrightMap AI Platform — the product used inside partner institutes by Admins, Moderators, Teachers, Students, and Parents to manage curriculum, deliver micro-assessments, and track mastery of concepts.

Where a practice applies only to one of the two, this policy says so explicitly.

On this website

The website has no forms and no accounts. If you email us at info@brightmapai.pk, for example to request a demo, we receive your email address and whatever you choose to include, such as your institution, name, role and phone number. We use these details only to respond to you. Please do not include student information. If you open a linked social platform, that platform handles information you provide there under its own privacy terms.

On the Platform

The Platform is provisioned to schools (“Institutes”), whose administrators create accounts for staff, teachers, students, and parents. The information collected depends on the account's role:

• Institute Admins & Moderators — name, email address, and password (used to authenticate and to send account-verification emails).
• Teachers, Students & Parents — name, phone number (used to verify the account and to sign in, via a one-time passwordless link — we do not store passwords for these roles), class or section, and the Institute(s) and, for Parents, the linked student(s) they are associated with.
• Educational activity data — the assessments assigned to a student, the answers a student submits (including free-text answers), per-concept mastery and progress scores, and lecture/roadmap scheduling data entered by teachers.
• Files you upload — any documents or images uploaded to the Platform (for example, by an Institute for branding, or as part of curriculum content).
• Technical data — IP address, device/browser type, and basic request logs, collected automatically for security and reliability (e.g., detecting abuse, debugging errors).

We do not collect financial or payment information directly — Institutes are invoiced outside the Platform.

• To create and secure accounts, and to verify identity at sign-in.
• To operate the core product: assigning micro-assessments, grading responses, calculating per-concept mastery, and generating lecture roadmaps.
• To let teachers and Institute staff see the progress of the students in their own classes, and let parents see the progress of their own children.
• To send account-related communications, such as verification codes and links.
• To maintain the security, integrity, and reliability of the Site and Platform, including backups and abuse prevention.
• To comply with legal obligations.

We do not use student data to serve advertising, and we do not sell personal information, ever.

The Platform uses AI to grade free-text assessment answers and to assist with roadmap pacing. Specifically:

• OpenAI— a student's free-text answer, together with the relevant question and grading rubric, is sent to OpenAI's API to generate a partial-credit evaluation. This is the only third party that processes the content of student answers.
• Meta (WhatsApp Business Platform) — used to deliver phone-number verification codes and assessment notifications to Teachers, Students, and Parents who opt to use WhatsApp for sign-in.
• Brevo — our transactional email provider, used to deliver account verification emails to Admins and Moderators.
• Cloudflare (R2) — used to store uploaded files and encrypted database backups.
• DigitalOcean— our infrastructure host, where the Platform's database and application run.

Each of these providers processes information only as needed to provide their service to us, under their own data-processing terms. We do not permit any of them to use BrightMap data for their own independent purposes, such as training their models on it.

We share information only in the following circumstances:

• Within an Institute— a student's data is visible to their own teachers and to their Institute's Admins/Moderators; a parent can see the data of the student(s) linked to them; students and teachers only see data scoped to their own Institute and classes.
• Service providers — the vendors listed in Section 5, strictly to operate the Platform on our behalf.
• Legal requirements — if required to comply with a valid legal process, or to protect the rights, safety, or property of BrightMap, our users, or the public.
• Business transfers— if BrightMap is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to this policy's commitments continuing to apply.

We never sell personal information or share it for third-party advertising.

BrightMap AI is built for use inside schools, and many Student accounts belong to children. We rely on the Institute (the school) as the party that enrolls students and obtains any parental/guardian consent required under applicable law, consistent with how schools already handle other education technology used in the classroom. Every Student account can also be linked to a Parent account (our Guardianship model), giving a parent direct visibility into their own child's data.

We collect only what is needed to operate the Platform for a student: a name, a contact method for verification, class/section, and academic activity data. We do not use student data for advertising, and we do not knowingly allow students to be contacted for marketing purposes.

An Institute Admin, Moderator, or a parent with a linked Student account can request correction or deletion of a student's data through the Institute Admin or our contact page.

We retain account and educational activity data for as long as the associated Institute is an active BrightMap customer, plus a reasonable period afterward to support account recovery, dispute resolution, and legal or accounting requirements. Encrypted database backups are retained on a rolling basis and are not kept indefinitely. Demo requests are sent to the BrightMap team by email and kept for the time needed to respond and manage the relationship. You can request deletion through our contact page.

An Institute may request deletion of its data, or of a specific account's data, at any time by contacting us through the contact page.

We apply industry-standard safeguards to protect information, including encrypted transport (HTTPS/TLS) for all traffic, hashed/salted password storage for Admin/Moderator accounts, role-scoped access controls so accounts can only see data within their own Institute or family, nightly encrypted backups, and infrastructure-level firewalling. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security, but we work to continually improve these protections.

Depending on your role and location, you may have the right to:

• Request access to the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your information, subject to legal or contractual retention needs.
• Withdraw consent where our processing is based on consent.
• Ask how your information has been used or shared.

For Platform accounts, the fastest path for most requests is through your Institute's Admin, since they administer accounts within their school. You can also reach us through the contact page and we will route the request appropriately.

This website does not currently use third-party analytics, advertising, or tracking cookies. The Platform uses strictly necessary cookies/local storage to keep you signed in and to remember basic preferences (such as your session). These are functional, not used for advertising, and cannot be disabled without breaking sign-in. If this changes — for example, if we add product analytics — we will update this section first.

BrightMap AI's infrastructure is currently hosted in Bangalore, India, serving Institutes primarily in Pakistan. Where our service providers (such as those listed in Section 5) process information outside your country, we take steps to ensure it is handled consistently with this policy.

We may update this Privacy Policy from time to time as the Platform evolves. If we make material changes, we will update the effective date at the top of this page and, where appropriate, notify Institute Admins directly. We encourage you to review this page periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or your information, please reach out:

Email info@brightmapai.pk or use our contact page.