How Guroo AI collects, uses, discloses, and safeguards information across the Guroo Applied Learning platform. GUROO APPLIED LEARNING PRIVACY POLICY — Last Updated: January 2026 Guroo AI, Inc. ("Guroo," "we," "us," or "our") respects your privacy and is committed to protecting personal data and learner information entrusted to us. This Privacy Policy describes how we collect, use, disclose, and safeguard information when learners and Course Providers use the Guroo Applied Learning platform, including our AI-driven course delivery, adaptive learning tools, progress tracking, and certificate programs (the "Platform"). This Privacy Policy is designed for use in online learning environments, including self-paced courses, learner communities, and educational partnerships. 1. Scope and Applicability This Privacy Policy applies to: Learners who enroll in and use courses on the Platform; Course Providers, instructors, and partners who create or provide course content; Visitors to our websites and portals that link to this Privacy Policy. This Privacy Policy does not apply to third-party websites, services, or applications that may integrate with or be linked from the Platform. Where Guroo processes learner data on behalf of an educational institution or Course Provider, we may act as a data processor or service provider, and our handling of such data is governed by applicable data processing agreements and educational privacy laws, including but not limited to FERPA (Family Educational Rights and Privacy Act), GDPR, CCPA, and other relevant regulations. 2. Information We Collect 2.1 Information Provided by Learners We may collect information that Learners provide directly, including: Account Information: Name, email address, date of birth (for age verification), username, password, and profile information; Educational History: Learning preferences, course enrollment, progress tracking, quiz and assignment submissions; Course Activity: Discussion forum participation, peer interactions, and engagement metrics; Payment Information: Billing address, payment method details (processed securely through third-party payment processors); Communications: Messages, support requests, feedback, testimonials, and other communications with Guroo. 2.2 Information Provided by Course Providers We may collect information that Course Providers provide, including: Account Information: Name, email, organization, role, authentication credentials; Course Content: Lecture materials, videos, course descriptions, assignments, syllabi, and assessment rubrics; Communications: Support requests, feedback, and course-related inquiries. 2.3 Audio and Voice Data When enabled by a Learner or Course Provider, the Platform may collect: Voice Inputs submitted for course discussions, peer feedback, or accessibility purposes; Audio Recordings and transcriptions generated from such inputs; Metadata associated with audio submissions. Audio features are optional and may be disabled by users at any time. 2.4 Learner Progress and Performance Data Depending on Course Provider configuration, the Platform may process: Quiz and assignment scores; Time spent on course modules; Learning activity and engagement metrics; Assessment submissions and grading feedback; Completion status and certificate eligibility. 2.5 Automatically Collected Information We may automatically collect certain technical information, including: IP address, device type, browser type, operating system; Log data, usage metrics, feature interaction data; Performance and diagnostic data; Cookies and similar tracking technologies. This information is used to operate, secure, and improve the Platform. 3. How We Use Information We use collected information to: Provide, operate, and maintain the Platform; Enable course delivery, progress tracking, and personalized learning recommendations; Generate and issue certificates of completion; Improve Platform performance, reliability, and user experience; Monitor security, prevent fraud, and detect academic dishonesty; Provide customer support, training, and communications; Send promotional, educational, or administrative messages (with opt-out options); Comply with legal, regulatory, and contractual obligations; Conduct learning analytics and educational research (on anonymized/de-identified data). 3.1 AI and Machine Learning Use AI models used within the Platform: Operate primarily on Learner-provided data and Course Provider content to deliver requested functionality; Generate outputs such as personalized course recommendations, progress summaries, and adaptive learning paths; Assist with assessment grading and feedback generation; Are designed to support—not replace—educator judgment or human instruction; May analyze learner data to suggest relevant courses or learning resources. We do not use Learner data to train generalized or cross-platform AI models without explicit consent. Any use of learner data for model improvement or research requires: Prior notice to the Learner or Course Provider; Anonymization or de-identification where possible; Contractual authorization. 4. How We Share Information We may share information only as follows: 4.1 With Learners and Course Providers Course Providers have access to Learner submissions, quiz scores, and progress within their respective courses (as appropriate); Learners have access to their own progress, grades, and certificates; Discussion forum posts may be visible to other enrolled learners (depending on privacy settings). 4.2 Service Providers and Subprocessors We may share information with trusted third-party service providers who perform services on our behalf, such as: Cloud hosting and infrastructure providers; Payment processors and billing services; Analytics and learning analytics providers; Customer support and communication platforms; Security and fraud detection services. These providers are contractually obligated to protect data and use it only as instructed. 4.3 Legal and Regulatory Disclosures We may disclose information if required to do so by law, regulation, court order, governmental request, or to: Comply with FERPA, COPPA, GDPR, CCPA, or other privacy regulations; Protect the rights, safety, or security of Guroo, Learners, Course Providers, or the public; Enforce our Terms of Use or other agreements. 4.4 Aggregated and De-identified Data We may share aggregated or de-identified data (that cannot reasonably be used to identify individuals) for: Educational research and analytics; Product improvement and optimization; Industry benchmarking and reporting; Marketing and promotional purposes. 4.5 Business Transfers In the event of a merger, acquisition, restructuring, or sale of assets, information may be transferred as part of the transaction, subject to appropriate confidentiality protections and compliance with applicable privacy laws. 5. Data Security Guroo Applied Learning implements administrative, technical, and physical safeguards designed to protect information, including: Encryption in transit (TLS/SSL) and at rest; Role-based access controls and authentication mechanisms; Audit logging and security monitoring; Secure development and operational practices; Regular security reviews and vulnerability assessments; Employee training and confidentiality agreements. No system can be guaranteed to be 100% secure; however, we take reasonable and appropriate measures consistent with industry standards for online educational platforms. 6. Data Retention We retain information only for as long as necessary to: Provide the Platform and services; Maintain Learner accounts and course history; Issue and maintain certificates of completion; Meet contractual and legal obligations; Comply with educational record retention requirements (e.g., FERPA); Fulfill tax, accounting, or audit requirements. Retention periods vary by data type: Account information is retained during active use and for a reasonable period afterward; Course submissions and grades may be retained per institutional policy; Payment information is retained only as long as necessary for billing purposes; Deleted accounts may leave de-identified residual data for analytics purposes. Upon request (where legally permitted), we will delete or anonymize personal data, subject to legal and contractual retention requirements. 7. User Rights and Choices Depending on applicable law (FERPA, GDPR, CCPA, etc.), Users may have rights to: Access, view, or download their personal data; Correct or update inaccurate information; Request deletion or anonymization of personal data; Object to certain processing activities; Opt out of non-essential communications or analytics; Receive data portability (export personal data in a usable format). To exercise these rights, please: Log into your account and adjust privacy settings; Contact us at privacy@guroolearning.com; For FERPA requests by parents/guardians, contact your institution's FERPA administrator.

We will respond to verified requests in accordance with applicable law, typically within 30 days. 8. International Data Transfers Guroo Applied Learning is headquartered in the United States. Our engineering, operations, and customer success teams, as well as certain service providers, may be located in other countries, including the Philippines and other jurisdictions. When personal data is accessed or processed outside the country where it was collected, such processing: Complies with applicable data protection laws (GDPR, CCPA, FERPA, etc.); Is subject to contractual safeguards, including confidentiality obligations and access controls; Involves appropriate technical and organizational measures to ensure data security and integrity. For learners in the European Union or other jurisdictions with strict data transfer requirements, we rely on: Standard Contractual Clauses (SCCs); Adequacy decisions; Explicit consent where required. 9. Children's Privacy 9.1 General Policy The Platform is not intended for use by children under the age of 13, and we do not knowingly collect personal information from children under 13 (subject to COPPA exceptions where applicable). 9.2 COPPA Compliance (U.S.) For learners ages 13-18 in the United States: Parental consent is not required for general Platform access; We do not collect more information than necessary for educational purposes; We do not knowingly share learner data with third parties for marketing purposes; We maintain reasonable security measures appropriate for the age group. 9.3 Institutional Use When educational institutions use the Platform with students under 18, those institutions are responsible for: Obtaining necessary parental/guardian consent per applicable law; Communicating privacy practices to parents and students; Managing student data access and permissions. Guroo acts as a service provider and follows institutional instructions regarding student data. 10. Learner Privacy Settings Learners may control their privacy through: Profile visibility settings (public, private, or restricted); Discussion forum and peer interaction preferences; Email notification and communication preferences; Cookie and tracking preferences. Course Providers may view Learner submissions, quiz results, and progress as needed for educational purposes, subject to course-specific privacy settings. 11. Third-Party Integrations The Platform may integrate with third-party services (e.g., video hosting, payment processors, identity verification). These third parties have their own privacy policies, and we are not responsible for their privacy practices. We encourage you to review their policies. 12. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated through: Email notification to registered users; A prominent notice on the Platform; Updates to the "Last Updated" date at the top of this policy. Continued use of the Platform after updates constitutes acceptance of the revised Privacy Policy. Guroo AI, Inc. Email: hello@gurooai.org Address: 600 Park Offices Drive, Suite 300, #4128 Durham, NC 27713 For privacy-related complaints or concerns, you may also contact: Your institution's privacy officer or FERPA administrator (if using the Platform through an institution); Your local data protection authority (if applicable). FERPA and Educational Privacy Compliance A.1 Role Under FERPA When Learner educational records are involved, Guroo Applied Learning acts as a "school official" with a legitimate educational interest or as a data processor/service provider under FERPA (Family Educational Rights and Privacy Act). A.2 Educational Records Guroo may maintain and process educational records including: Course enrollment and completion status; Quiz and assignment scores; Progress reports and learning analytics; Certificate issuance records. A.3 Learner Rights Under FERPA Learners (or parents/guardians for learners under 18) have the right to: Inspect and review educational records; Request correction of inaccurate information; Request restriction on disclosure of records; File complaints regarding FERPA violations. A.4 Permitted Disclosures of Educational Records Guroo may disclose learner educational records to: The Learner (or parent/guardian if applicable); Course Providers and instructors within the scope of courses; School officials with legitimate educational interest (through institutional arrangements); Third parties if authorized by the Learner or parent/guardian; As required by law or legal process. A.5 Institutional Responsibility When used by educational institutions, those institutions retain responsibility for: Obtaining and maintaining parental consent (for students under 18, where required); Communicating FERPA rights to students and families; Managing directory information and disclosure restrictions; Responding to student FERPA requests. AI & Learning Analytics Transparency B.1 Purpose of AI and Adaptive Learning Features Guroo Applied Learning's AI-driven features are designed to: Provide personalized learning recommendations based on Learner progress and interests; Generate automated feedback and assessments to support learning; Adapt course content and pacing to individual learning styles; Identify Learners who may need additional support; Improve course design and content effectiveness. These features are intended to support and enhance human instruction, not replace educators or learning outcomes. B.2 Data Inputs for AI Processing Depending on Learner and Course Provider settings, AI features may process: Quiz and assignment submissions; Course interaction and engagement metrics; Learner profile and preference data; Course content and materials provided by Course Providers. B.3 Model Behavior and Training AI models operate within defined scopes based on course configuration; Learner data is not used to train generalized or cross-platform AI models without explicit consent; Any model improvement or research involving Learner data requires: Prior notice and consent; De-identification or anonymization where possible; Contractual authorization; Prior notice and consent; De-identification or anonymization where possible; Contractual authorization; Model outputs are probabilistic and should be reviewed by educators before acting on recommendations. B.4 Human Oversight and Educator Control Course Providers retain full control over: Whether AI features are enabled in their courses; Which learners may access personalized recommendations; Content made available to AI systems; Whether AI features are enabled in their courses; Which learners may access personalized recommendations; Content made available to AI systems; Educators should review AI-generated assessments and feedback before relying on them; Final educational decisions (grading, advancement, intervention) must involve human educator judgment. B.5 Data Retention and Deletion Learner data used for AI processing is retained only as long as necessary to provide functionality and as per contractual retention terms; Learners may request deletion of their data (subject to legal and academic record retention requirements); Deleted learner data is removed from active AI systems. B.6 Bias and Fairness We are committed to: Regularly testing AI models for bias and fairness; Ensuring that personalized recommendations do not discriminate based on protected characteristics; Transparently communicating how AI affects learning pathways and outcomes; Providing mechanisms for Learners and Educators to report concerns about AI bias. Learner Data Protection Summary (Short Form) What Guroo Applied Learning Does Guroo Applied Learning is an online learning platform that hosts courses from multiple Course Providers and enables self-paced learning for Learners worldwide. Learners seeking skill development and personal growth; Course Providers and educational institutions offering online courses. We act as a platform provider and data processor, handling learner data in accordance with FERPA, GDPR, CCPA, and other applicable privacy regulations. What Data We Collect Account information (name, email, profile); course enrollment and progress; quiz and assignment submissions; engagement and learning analytics; payment information (for purchases). AI & Personalization AI features provide course recommendations and personalized feedback. Learner data is not used to train generalized AI models without consent. Educators retain control over AI settings. We apply industry-standard security controls including encryption, access controls, and regular security reviews. Depending on your location, you may access, correct, or request deletion of your data. Contact privacy@guroolearning.com to exercise privacy rights. Learner Data Sharing Your course submissions are visible to Course Providers and instructors; discussion posts may be visible to fellow learners; data is not sold to third parties; aggregated, de-identified data may be used for research and product improvement. Contact us at privacy@guroolearning.com or submit a request through your account settings. This Privacy Policy is provided for informational purposes and does not constitute legal advice. For specific privacy concerns or FERPA-related questions, please contact your institution's privacy officer or legal counsel.