Privacy Notice — Thrive Learning Management Platform

My Safe Spaces, Inc. and its India operating entity, MSS Services India LLP (together My Safe Spaces, we, us), operate the Thrive Learning Management Platform at learn.mysafespaces.org (the Platform). We are the Data Fiduciary for personal data processed on the Platform under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Registered address: 250 Udyog Vihar Phase 4 #48, Gurugram, Haryana 122015.

We collect and process the following categories of personal data:

• Account and profile — name, email, sign-in identifier, role, institution memberships, phone number (optional), billing address (only where required for payments).
• Learning activity — course enrolments, module and section progress, SCORM state, quiz and evaluation responses, certificates earned, live-session attendance.
• Communications — emails, WhatsApp messages we send you, and audit records of significant account actions (sign-in, admin invites, role changes).
• Payments — order records, amount and currency, gateway transaction ids. We do not store card details; those live with our payment processor.
• Learner preferences — role, work setting, age groups you support, and interest areas that you provide to personalise course suggestions.

We process personal data on the lawful basis of your consent under Section 6 of the DPDP Act. You give consent when you sign in to the Platform and accept this notice, when you opt in to non-essential cookies, and when you submit optional fields such as phone number or interests.

The purposes are limited to:

• Delivering the Platform and the courses you're enrolled in
• Recording progress, issuing certificates, and reporting to your institution where you're enrolled via one
• Processing payments where a course is paid
• Sending service communications (enrolment confirmations, reminders)
• Personalising course recommendations from the preferences you provide
• Detecting fraud and abuse, and keeping the Platform secure

The Platform uses essential cookies for authentication and session management — these are always on because the Platform can't function without them.

The Platform also uses a third-party translation service (Weglot) that loads only after you accept non-essential cookies via the banner shown on your first visit. You can withdraw consent at any time by clearing the mss_consent cookie in your browser, or by declining if the banner reappears after a notice update.

We do not run cross-site advertising trackers, and we do not target advertising to anyone under 18 (see section 9).

We share personal data with the following categories of processors strictly to operate the Platform. Some processing occurs outside India; none is on a government-restricted-country list at the time of this notice.

We keep personal data only as long as we need it for the purposes above. Concretely:

• Active accounts and their learning history — for as long as you keep the account. Certificates and course-completion records may be kept beyond that for verification purposes [final period pending counsel review].
• Payment records — retained as required by Indian tax and accounting rules [final period pending counsel review].
• Audit logs (sign-ins, admin actions) — 12 months.
• Deleted accounts — hard-deleted from our systems after the 24-hour cancellation window; backups may retain data for up to 30 additional days before rotation.

Under the DPDP Act you have the following rights:

• Right of access — download a copy of the personal data we hold about you, from Settings → Account.
• Right to correction — edit your profile from Settings → Profile.
• Right to erasure — request account deletion from Settings → Account. The deletion runs after a 24-hour cancellable window so you can reverse it if you change your mind. Note that if you use the same My Safe Spaces sign-in across other portals (e.g. Circle), erasure on this Platform removes only Platform data — contact the Grievance Officer to remove your identity fleet-wide.
• Withdraw consent — decline non-essential cookies in the banner; use the one-click unsubscribe in any email; opt out of WhatsApp by removing your phone number in Settings.
• Right to nominate — you may nominate a person to exercise your rights in the event of your death or incapacity. Contact the Grievance Officer to record a nomination.
• Right to grievance redressal — see section 10.

The Platform uses TLS in transit, secure HTTP-only session cookies, scoped IAM credentials, and least-privilege database access. Access to production data is limited to a small number of engineers on the principle of need-to-know.

We follow a breach-response process consistent with DPDP Section 8(6) — if a breach affecting your personal data occurs, we will notify the Data Protection Board of India and affected principals in the manner prescribed.

The Platform is designed for professional development (school counsellors, teachers, psychologists, parents, and staff). Where the Platform is used to deliver content to learners under 18 — for example school students enrolled by their institution — we treat those accounts under DPDP's children's-data provisions:

• Verifiable parental consent is required before processing
• No behavioural tracking or targeted advertising
• No processing that is likely to cause detrimental effect

If you believe a child has been enrolled without parental consent, contact the Grievance Officer immediately.

Concerns, questions, or complaints about how we handle your personal data may be sent to The Grievance Officer at grievance@mysafespaces.org. We aim to respond within 30 days as required by the DPDP Act. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We may update this notice as the Platform changes or the law evolves. Material changes prompt an in-app notification the next time you sign in. The Last updated date at the top of this page is always current.