This Privacy Policy explains how LiteracyLab AI ("we," "us") collects, uses, and protects information when a parent or legal guardian ("Account Holder", "you") creates an account and sets up a profile for their child or student ("Child User") on our website and workspace (the "Service").
The Service is built around parental control by design. A parent or legal guardian creates the account, provides billing information, and creates and manages every Child User profile linked to that account. Child Users do not register independently, do not provide their own contact information, and cannot change account-level settings such as billing, subscription plan, or profile deletion — only the Account Holder can do this.
Because many Child Users are under 13, we are designed around the US Children's Online Privacy Protection Act ("COPPA"): a Child User cannot register, provide their own contact details, or create a profile independently — only an adult Account Holder, using their own confirmed email address, can do so, on the Child User's behalf. We do not solicit any personal information directly from a Child User at any point. If we become aware that a Child User has obtained access other than through an Account Holder-created profile, we will promptly disable that access and delete any associated data.
We have not implemented a heightened identity- or age-verification step (such as a government ID check or a knowledge-based verification question) beyond confirmed-email account creation. Before this Service is offered commercially at scale, we intend to review whether COPPA's "verifiable parental consent" standard requires a stronger method for our specific data uses, with qualified counsel.
| Category | What we collect | From whom |
|---|---|---|
| Account information | Parent/guardian email address, password (hashed), subscription/billing status | Account Holder |
| Child profile | Student display name (a nickname or first name only is sufficient — a full legal name is never required), grade or year level, country curriculum, selected interest tags | Account Holder, on behalf of the Child User |
| Learning content | Story and essay submissions, reading-comprehension responses, associated word/character counts, generated feedback, and mastery/progress history | Child User, via the workspace |
| Usage records | Which pages of the app a signed-in account opens and which features it uses (for example making a writing prompt or starting the vocabulary quiz), with the time. We use it to fix problems and improve the product. It never contains what a learner wrote. | Automatically, while signed in |
| Analytics data | Pages visited, approximate location (country or region), device and browser type, and whether key actions happen (such as creating an account, completing a piece of work, or viewing the plans). Never the content of a submission, a name, or an email address. | Automatically, only after you accept analytics cookies |
| Email and feedback | Which of our emails we have sent you and whether you have unsubscribed, plus anything you choose to send us through the feedback page (a rating, a message, and whether we may contact you) | Account Holder |
| Invites and shared cards | A personal invite code on your account, and a record of which new account signed up through whose invite link (never names or writing). If you share a result card: the first name or nickname you type for it, the year group, one skill name and, for reading, the score. | Account Holder |
| Technical data | Basic device and usage logs (e.g. timestamps, error logs) used only to operate and secure the Service | Automatically, from the browser/device |
We do not knowingly collect a Child User's precise geolocation, contact information (email, phone), government identifiers, or biometric data, and we do not require any of this to use the Service.
When a Child User submits a story, essay, or a set of reading-comprehension answers, that content is sent securely to a third-party large language model provider (for example, OpenAI's API) solely to generate real-time educational feedback — a Glow, a Grow, vocabulary suggestions, and a micro-mission. This processing happens through the provider's business/API terms, under which:
We do not use Child User writing submissions for behavioral advertising, and we do not build advertising profiles of Child Users.
We do not sell personal information, and we do not use Child User data for cross-context behavioral advertising, as those terms are used under applicable US state privacy laws.
At any time, an Account Holder may:
These dashboard controls are the primary way to exercise these rights and take effect immediately, without needing to wait on a support request. You can also email privacy@literacylabai.com for help, or for anything the dashboard controls don't cover; we will act on such requests without unreasonable delay, and in any case within the timeframe required by applicable law.
The parent dashboard shows how a Child User's mastery compares with other students in the exact same country curriculum and grade/year — an average score, a percentile, and a ranked "league ladder." This comparison is computed on our servers from aggregated data across accounts, but no Account Holder or Child User ever sees another family's raw data: every other entrant on the ladder is shown only as an anonymous rank and score (e.g. "Student 4 — 62%"), never a name or any other identifying detail. If fewer than five students share the exact same country and grade/year, the comparison is withheld entirely rather than shown against a small enough group that a specific other family's result could be inferred.
If you invite a friend, we record that they signed up through your invite link so we can add extra pieces to both accounts once they have confirmed their email and finished a piece. We never show you the friend's name or email address, only how far along they are.
If you share a result card, we create a public web page that can only be reached by its link. It shows the first name or nickname you typed, the year group, one skill and, for reading, the score. It never shows any writing, feedback or answers, and it is hidden from search engines. You can switch a card off at any time and it stops working straight away. Deleting your account deletes your cards.
For users in the UK and EU, our lawful basis for processing a Child User's personal data is parental consent together with the performance of our contract with the Account Holder. In addition to the rights in Section 5, UK/EU Account Holders have the right to restrict or object to certain processing, and to lodge a complaint with their local data protection authority (in the UK, the Information Commissioner's Office).
In line with the UK Age Appropriate Design Code, the Service applies privacy-protective defaults for Child Users: profile visibility is private by default, no geolocation is collected, no "nudge" techniques are used to encourage additional data disclosure or extended usage beyond what a parent has configured, and no options that weaken a child's privacy are enabled by default.
For Australian users, we handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth) — collecting only what is reasonably necessary to provide the Service, not using or disclosing it for an unrelated secondary purpose, and giving an Account Holder access to and control over their Child User's information as set out in Section 5. Concerns can also be raised with the Office of the Australian Information Commissioner if they cannot be resolved with us directly.
For Canadian users, we handle personal information in line with the Personal Information Protection and Electronic Documents Act ("PIPEDA") — collecting it only with the Account Holder's knowledge and consent, for the purposes described in this Policy, and safeguarding it as described in Section 13. An Account Holder who is not satisfied with our response to a privacy concern may complain to the Office of the Privacy Commissioner of Canada.
For Singapore users, we handle personal data in line with the Personal Data Protection Act 2012 ("PDPA") — relying on the Account Holder's consent, collecting only what is reasonably required to provide the Service, and giving an Account Holder the access, correction, export, and deletion rights set out in Section 5. Concerns can also be raised with the Personal Data Protection Commission of Singapore.
For users in the UAE and other GCC markets we offer the Service to, we intend to handle personal data consistent with the UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") and equivalent regional frameworks — including a lawful basis for processing (parental consent), data-minimization, and the access/correction/export/deletion rights set out in Section 5. Given the number of distinct legal frameworks across GCC markets, this section is the least developed part of this Policy and should be prioritized for local counsel review before the Service accepts real users based in this region.
For New Zealand users, we handle personal information in line with the Information Privacy Principles in the Privacy Act 2020 — collecting only what is necessary to provide the Service, collecting it for the purposes described in this Policy, being open with you about what we hold, keeping it secure as described in Section 13, and giving an Account Holder access to and correction of their Child User's information as set out in Section 5. Because our infrastructure and AI-processing providers may be outside New Zealand, we take reasonable steps to make sure personal information that is sent overseas is protected by comparable safeguards, as described in Section 14. Concerns can also be raised with the Office of the Privacy Commissioner of New Zealand if they cannot be resolved with us directly.
For users in India, we handle personal data in line with the Digital Personal Data Protection Act 2023 — processing it only with consent, for the purposes described in this Policy, and keeping it secure as described in Section 13. Because a Child User is under 18, we rely on the verifiable consent of the Account Holder (a parent or guardian), who manages the account, and we do not track, monitor the behaviour of, or show targeted advertising to Child Users. The Account Holder can access, correct, export and delete their Child User's information as set out in Section 5, and can raise a grievance with us directly using the contact details in Section 16, or with the Data Protection Board of India where that route is available.
For users in South Africa, we handle personal information in line with the Protection of Personal Information Act 2013 ("POPIA") — processing it lawfully, for the specific purposes described in this Policy, collecting only what is needed, and keeping it secure as described in Section 13. Because a Child User is under 18, we process their information with the consent of the Account Holder (a parent or guardian), acting as the competent person. The Account Holder has the access, correction and deletion rights set out in Section 5, and can complain to the Information Regulator (South Africa) if a concern cannot be resolved with us directly.
For users in Hong Kong, we handle personal data in line with the Personal Data (Privacy) Ordinance (Cap. 486) — collecting it only for the purposes described in this Policy, by lawful and fair means, not keeping it longer than needed (Section 12), keeping it secure as described in Section 13, and giving an Account Holder access to and correction of their Child User's information as set out in Section 5. Concerns can also be raised with the Office of the Privacy Commissioner for Personal Data, Hong Kong.
We retain account and Child User data for as long as the account remains active, plus a limited period afterward to allow for account recovery and to meet legal, accounting, or dispute-resolution obligations. A self-service account deletion (Section 5) deletes the underlying data immediately, other than any residual copy kept only as long as necessary in backups or as required by law. A shared result card is kept until you switch it off or delete your account.
We use industry-standard technical and organizational measures — including encryption in transit, access controls, and restricted internal access to Child User data — to protect information from unauthorized access, alteration, or disclosure. No system can be guaranteed 100% secure, and we will notify affected Account Holders in the event of a data breach as required by applicable law.
Error monitoring. When something in the Service breaks, technical details about the fault (what failed, where in our code it happened, and the type of browser or device) are sent to our error-monitoring provider, Sentry, so we can find and fix it quickly. These reports are set up to exclude the content of a Child User's writing and answers: quoted text is removed before a report leaves our systems, and reports are sent without names, email addresses, or IP addresses. Sentry acts only as a data processor for this purpose.
Analytics and cookies. We use Google Analytics on our website and in the app to understand how the Service is used overall, for example which pages are visited and whether people complete sign-up. A banner asks you to accept or decline analytics cookies. Until you accept, analytics cookies are not set. If you decline, Google may still receive limited signals that don't use cookies, such as the page visited and the type of browser. We have turned off Google's advertising features and do not use analytics data to show advertising, to build profiles of Child Users, or to sell information. Google acts as a data processor for this purpose. The events we record contain no submission content, names or email addresses. Your choice is remembered in your browser; to change it, clear this site's data in your browser settings and the banner will appear again.
Emails and feedback. We send emails about the Service to the Account Holder only, never to a Child User. These include welcome and getting-started messages, reminders, weekly summaries and notices about the free plan. Every one of them has an unsubscribe link, and unsubscribing stops them straight away. Emails about your account itself, such as sign-in and billing, are sent when needed. We record which emails we have sent so that nobody receives the same one twice. Emails are sent through Resend, which acts as a data processor. When you send feedback through our feedback page we store it, together with the email it came from, so we can improve the Service; a copy is emailed to us. If you tick the box saying we may contact you, we may reply to your email address. Feedback tied to your account is deleted when you delete your account. Please do not put a child's name or other private details in feedback.
Because our infrastructure and AI-processing providers may operate in countries other than your own, personal data may be transferred internationally. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses for UK/EU transfers) to ensure data receives an equivalent level of protection wherever it is processed.
We may update this Privacy Policy from time to time. Material changes affecting how we handle Child User data will be communicated to Account Holders via the email on file before they take effect.
Questions, deletion requests, or export requests can be sent to privacy@literacylabai.com.