Privacy Policy IDALS A brand of Metamove Studio Private Limited Last updated: 31st August, 2026

This policy explains what personal data we collect when you use IDALS, why we collect it, and what rights you have over it. It is written to comply with India's Digital Personal Data Protection Act, 2023. We have tried to write it in plain language. If anything is unclear, email connect@theidals.com and we will explain.

1. Who is responsible for your data Metamove Studio Private Limited is the Data Fiduciary for the personal data described here. Registered office: Vasant Kunj, Krishna Township, Ambadi Road, Vasai West, Palghar 401202, Maharashtra, India.

2. What we collect, and why We collect only what we need to run the platform. When you create an account What Why Email address To identify your account, sign you in, and send you service messages Name To address you properly across the platform Password Stored only as a cryptographic hash — we never see it If you sign in with Google, we receive your name, email address and profile picture from Google. We do not receive your Google password.

When you use IDALS What Why Which tutorials you watch, and how far through To save your place, show your progress, and let you pick up where you left off Tutorials you complete To track streaks and milestones Tutorials you save or creators you follow To build your library and personalise what we show you Search terms you enter To improve search and find gaps in our catalogue When you subscribe or buy something What Why Payment records - amount, date, transaction reference To provide receipts, handle refunds, and meet our tax obligations Subscription status and history To give you the access you have paid for We never see or store your card number, UPI ID, or bank details. Payments are handled entirely by Razorpay. When you use mentor feedback What Why Your WhatsApp number To match your practice video to your account and send you feedback The video you send So a mentor can review it and respond Technical information When you visit, our infrastructure providers automatically log your IP address, browser type and device information. This is used for security, diagnosing faults, and preventing abuse. We do not use it to build a profile of you.

3. Cookies We use cookies for three purposes only: Signing you in. A session cookie keeps you logged in. Without it you would have to enter your password on every page. Your preferences. Remembering settings like playback speed. Understanding usage. Anonymous, aggregated information about which pages are visited, so we know what is working. We do not use advertising cookies, and we do not sell data to advertisers. You can block cookies in your browser, but sign-in will stop working.

4. What we do not do We think this is worth stating plainly. • We do not sell your personal data • We do not rent or trade it • We do not share it with advertisers • We do not use it to train AI models • We do not track you across other websites

5. Who we share data with We share data only with providers who help us run the platform, and only what each one needs. Provider What they handle Where Supabase Database and account storage Mumbai, India Vercel Hosting the website Global, routed via India Bunny.net Video delivery Singapore, Frankfurt, USA Razorpay Payments India Resend Transactional emails USA Meta (WhatsApp) Mentor feedback messages Global Each is bound by contract to protect your data and use it only for the service they provide to us. We may also disclose data where the law requires it — a court order, a lawful request from a government authority, or where necessary to protect someone's safety. 5a. How we use AI We use AI services to help us run the platform. It is worth being precise about what this does and does not involve. What we send to AI services We send our own tutorial videos and their audio to AI services for transcription and to help generate descriptions, chapter markers and tags. This is our content, not yours. What we do not send We do not send your personal data, your practice videos, your watch history, or anything you have written to us. Recommendations We may use your watch history to suggest tutorials and learning paths that suit you. This happens within our own systems using straightforward matching rules. Your data is not sent to an external AI service for this. Providers Where we use external AI services, they are contractually prohibited from using our content to train their models.

6. Where your data is stored Your account data, watch history and payment records are stored in Mumbai, India. Some providers process data outside India, as shown in the table above. Where that happens, we rely on contractual protections with those providers.

7. How long we keep it Data Kept for Account details While your account is open Watch history and progress While your account is open Payment records Eight years after the transaction, as Indian tax law requires Practice videos sent for feedback 90 days after feedback is delivered Technical logs 90 days When you close your account, we delete your personal data within 30 days, except payment records, which we must keep for tax purposes. Those are retained with your name and email only, disconnected from your activity.

8. Your rights Under the DPDP Act you have the following rights. To use any of them, email connect@theidals.com. We will respond within 30 days. See your data. Ask for a copy of the personal data we hold about you and who we have shared it with. Correct it. If something is wrong or out of date, tell us and we will fix it. You can update your name and email yourself in account settings. Have it erased. Ask us to delete your data. We will, except where law requires us to keep it — payment records, principally. Erasing your data means closing your account. Withdraw consent. Where we rely on your consent, you can withdraw it at any time. Withdrawing consent for something essential to the service means we can no longer provide it. Nominate someone. You may nominate another person to exercise these rights on your behalf if you die or become incapacitated. Email us to set this up. Complain. If you are unhappy with how we have handled your data, contact our Grievance Officer below. If we do not resolve it, you may complain to the Data Protection Board of India.

9. Grievance Officer As the DPDP Act requires, we have a designated Grievance Officer. Grievance Officer Metamove Studio Private Limited Vasant Kunj, Krishna Township, Ambadi Road Vasai West, Palghar 401202, Maharashtra, India Email: connect@theidals.com We acknowledge grievances within 7 days and aim to resolve them within 30.

10. Children IDALS accounts are for people aged 18 and over. We do not knowingly collect data from anyone under 18. We know parents buy access for younger learners. In that case the account belongs to the parent or guardian, the data we hold is theirs, and they are responsible for supervising the child's use. If you believe a child has created an account independently, tell us and we will remove it.

11. Security We protect your data with: • Encryption in transit (HTTPS) and at rest • Passwords stored only as cryptographic hashes • Row-level access controls so users can reach only their own data • Signed, expiring video URLs so content cannot be accessed without authorisation • Access to production systems limited to those who need it No system is perfectly secure. If a breach occurs that is likely to affect you, we will tell you and the Data Protection Board without undue delay.

12. Changes to this policy If we change this policy in a way that materially affects your rights, we will email you and post a notice at least seven days before it takes effect. The date at the top shows when it was last updated.

Metamove Studio Private Limited Vasant Kunj, Krishna Township, Ambadi Road Vasai West, Palghar 401202 Maharashtra, India connect@theidals.com