Privacy Policy

BongGo is operated by Mr. Saptarshi Mondal, an individual developer, rather than a registered company. Under the DPDP Act, an individual who determines the purpose and means of processing personal data qualifies as a "Data Fiduciary," and under GDPR as a "Controller" — the same obligations described in this Policy apply regardless of corporate structure.

We disclose this openly so you know exactly who is accountable for your data. Contact details for privacy questions, rights requests, and complaints are in Section 13 (Grievance Redressal) and Section 18 (Contact Us).

2.1 Account Information (via Google Sign-In)

BongGo uses Google Sign-In as its only authentication method. When you sign in, we receive:

• Your name, email address, and Google account profile photo (if available)
• A unique Google account identifier

We do not receive or store your Google password.

2.2 Age and Parental Consent Information

• Self-declared age or date of birth at the age-gate
• For learners under 18: the verified parent/guardian's Google account email, a child profile identifier, consent timestamp, and the version of this Policy consented to

2.3 Learning and Usage Data

• Lesson progress, XP, streaks, scores, and comic/reading interactions
• Speaking practice records and completion history

2.4 Pronunciation Audio

• Audio you record for pronunciation practice is processed to generate feedback and is not retained after that feedback is produced. See Section 5.

2.5 Automatically Collected Information

• IP address, browser type, device information
• Pages visited, interaction data, date/time of access
• Cookie identifiers (see Section 6)

BongGo treats anyone under 18 years old as a minor requiring parental consent, consistent with the DPDP Act's definition of "child." This applies to all learners regardless of country.

• At sign-up, every user passes through an age gate.
• Learners who declare an age under 18 are routed into a Parent/Learner flow: a parent or guardian must complete Google Sign-In themselves and then explicitly accept a separate parental consent screen before the child profile becomes active.
• We log each parental consent as a record containing: the parent's verified email, the child's profile ID, a timestamp, the Policy version accepted, and the method of capture.
• A parent may withdraw consent at any time by contacting us (Section 18) or via account settings, which will deactivate and allow deletion of the child's profile.
• We do not knowingly allow a self-declared minor to bypass this flow or use the platform independently.

We use collected information to:

• Provide and personalize lessons, comics, and listening/speaking practice
• Operate account creation, login, and progress tracking
• Generate AI-based audio feedback
• Maintain the age-gate and parental consent records
• Operate the cookie consent system described in Section 6
• Improve platform performance and reliability
• Respond to support requests and legal/grievance obligations

We do not sell or rent personal data, and do not use learner data to train third-party or public AI models.

5.1 AI Audio Features

• AI-generated voice is used for pronunciation, lessons, and listening practice.
• Audio you submit for pronunciation scoring is processed transiently to generate feedback and is deleted immediately afterward — it is not stored, replayed for training, or retained in your account history.
• We do not use your inputs to train public or open AI models.

5.2 Future AI Video Features

AI video content (avatars, animations, explanations) may be introduced in the future and will follow the same transience and non-training principles described above, with this Policy updated before launch.

We use a single, global, strict opt-in cookie consent banner for all visitors, regardless of location, so that everyone — not just users in specific regions — gets the same baseline of control.

Cookie categories:

• Strictly Necessary — required for login sessions and core site function; cannot be disabled.
• Analytics — helps us understand usage patterns. Not set until you opt in.
• Advertising — reserved for potential future use (see Section 15). Not currently active; no advertising cookies are set regardless of consent choice at this time.

For accounts flagged as belonging to a minor under our Parent/Learner flow, we do not set Analytics or Advertising cookies at all. Cookie consent for a minor's account is captured as part of the parental consent screen in Section 3, not a separate banner.

We detect and honor Global Privacy Control (GPC) browser signals as an opt-out instruction where applicable.

Each consent decision is logged as a record containing a unique ID, user identifier, the categories accepted, the Policy version in effect, a timestamp, whether a GPC signal was detected, and the capture method. You can change your cookie choices at any time through the consent settings on the site.

Where GDPR applies, we rely on: your consent (account creation, cookies, AI audio processing), performance of a contract (delivering the service you signed up for), and legitimate interests (basic security and service improvement), balanced against your rights.

Where DPDP applies, we rely on your consent as the primary ground for processing, and on the Act's limited "certain legitimate uses" exemptions only where applicable (e.g., responding to your own requests).

We share limited data only with service providers necessary to operate BongGo, including:

• Google (Sign-In authentication)
• Hosting and cloud infrastructure providers
• AI service providers used to generate audio feedback

These providers are contractually or contractually-equivalent bound to use data only for the purpose we specify. We do not share data with data brokers or advertisers, since no advertising is currently active.

BongGo may process and store data on servers located outside your home country. Where DPDP applies, we do not transfer personal data to any country restricted by the Indian government. Where GDPR applies, we take reasonable steps to ensure any transfer outside the EU/UK is subject to appropriate safeguards, such as standard contractual clauses used by our service providers.

We retain personal data only as long as necessary for the purpose it was collected:

• Pronunciation audio: deleted immediately after feedback is generated (not retained).
• Learning progress and account data: retained while your account is active, and deleted or anonymized after account deletion (see Terms of Use, Account Deletion).
• Parental and cookie consent records: retained as an audit trail of lawful processing, consistent with DPDP Rules' record-keeping requirements, even after account deletion, in de-identified or minimal form where feasible.
• Security and access logs: retained for a limited period for security, abuse-prevention, and legal-compliance purposes.

We implement reasonable technical and organizational safeguards, including encrypted connections, access controls, and data minimization. No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security, but we take reasonable steps proportionate to the sensitivity of the data involved, including the heightened sensitivity of children's data.

Subject to applicable law, you (or a parent/guardian on behalf of a minor) may have the right to:

• Access the personal data we hold about you
• Correct or update inaccurate data
• Request erasure of your data
• Withdraw consent at any time, including parental consent
• Nominate another individual to exercise your rights in the event of death or incapacity (a DPDP-specific right)
• Lodge a complaint with us or the relevant supervisory authority

California residents: CCPA-specific rights (e.g., right to know/delete/opt-out of sale) apply once BongGo meets the CCPA's applicability thresholds. As a free service with no data sales, BongGo does not currently meet these thresholds; we will update this Policy if that changes.

To exercise any right, contact us using the details in Section 18.

In accordance with the DPDP Rules, 2025, we have designated a Grievance Officer to handle privacy complaints and rights requests:

• Name: Mr. Saptarshi Mondal
• Email: [email protected]

We will acknowledge your grievance and aim to resolve it within a reasonable period, and in any case no later than 90 days. If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India or, where applicable, your local data protection authority.

BongGo is designed to be usable by learners of all ages, including children, through the Parent/Learner flow described in Section 3. We do not knowingly allow any user under 18 to create or use an active account without verified parental consent. No Analytics or Advertising cookies are set on minor accounts. Parents may review, correct, or request deletion of their child's data, or withdraw consent, at any time (Section 18).

BongGo does not currently display advertising and is not currently enrolled in Google AdSense or any other ad network. We have reserved an "Advertising" cookie category in our consent system (Section 6) in case this changes in the future.

If advertising is introduced, we commit to: updating this Policy in advance, disclosing the ad network(s) used, obtaining consent before setting advertising cookies for adult users, and excluding minor accounts from personalized/behavioral advertising entirely, consistent with applicable child-directed advertising rules.

If you access BongGo from outside India, your information may be processed and stored on servers located in India or other jurisdictions with appropriate data-protection safeguards, as described in Section 9.

We may update this Privacy Policy from time to time. Material changes — such as changes affecting the scope of data collected, the age threshold for parental consent, or your rights — will be flagged as such and may require you (or your parent/guardian) to re-consent before continued use. Non-material changes take effect upon posting with an updated "Last updated" date.

If you have questions, concerns, or requests regarding this Privacy Policy, please contact:

• Grievance Officer: Mr. Saptarshi Mondal — [email protected]
• General support: [email protected]
• Website: https://bonggo.app