Privacy Policy

1. Overview & Commitment

This Privacy Policy explains how Methum Jithnuka Science Learning Platform ("Redox", "we", "us", or "our") collects, protects, uses, and discloses information from students and visitors using our website (redox.lk) and educational management systems. We are committed to transparency and student data security.

2. Information We Collect

We limit our data collection to the minimum required to authenticate students, verify course enrollments, and deliver academic services:

• Google OAuth Profile: Full name, verified Google email address, and profile photo avatar obtained during authentication. We do not solicit, generate, or store student passwords.
• Student Profile Information: Contact telephone or WhatsApp number, academic school, and geographic district provided to enable academic support and delivery of printed materials.
• Payment & Transaction Data: Payment gateway reference ID, paid amount, transaction date, and enrolled class identifier. Credit card numbers, expiration dates, and CVVs are handled exclusively by certified payment gateways (e.g., PayHere) and never pass through or reside on our servers.
• LMS Activity & Video Diagnostics: IP address, browser user-agent, watch progress, and session timestamps used solely for watermarked stream protection, fraud prevention, and session maintenance.

3. Purpose of Processing

Student information is processed strictly for legitimate educational and administrative purposes:

• Authenticating access to enrolled live sessions, study packs, and recordings.
• Dispatching class links, schedule updates, and urgent academic announcements via SMS and WhatsApp.
• Generating immutable payment receipts and maintaining lawful academic transaction records.
• Preventing unauthorized credential sharing, bulk recording, and copyrighted lecture redistribution.

4. Third-Party Integrations & Data Sharing

We strictly prohibit selling, leasing, or trading student personal information. Data is shared only with vetted infrastructure partners necessary for operational delivery:

• Google Cloud Identity: Secure student authentication via Google OAuth 2.0 protocols.
• Payment Gateways: Central Bank of Sri Lanka compliant payment processors for debit/credit card and bank settlements.
• Cloudflare & Edge Infrastructure: DNS protection, SSL/TLS encryption, and DDoS mitigation.
• Delivery Couriers: Physical recipient names, addresses, and telephone numbers provided to registered courier services for dispatching hard-copy study packs (tutes).

5. Data Retention & Archival

Student profile and enrollment records are retained throughout the active academic cycle to preserve continuous course access and grade tracking. Inactive student profiles that have completed their Ordinary Level examinations are securely archived or expunged in accordance with our routine maintenance cycles.

6. Security Architecture

We deploy defense-in-depth security measures to protect student records. All communications are enforced over HTTPS with TLS 1.3 encryption, secure HTTP response headers, parameterized SQL queries to eliminate injection vulnerabilities, and role-based administrative access controls.

7. Student Rights & Control

Students and guardians maintain the right to review their stored profile details, request corrections to contact numbers or delivery addresses, or request the closure of their learning account by contacting our administrative desk.

8. Policy Revisions

We reserve the right to revise this Privacy Policy to reflect platform upgrades or statutory requirements. Continued use of Redox after updates constitutes agreement with the revised terms.