Effective Date: [DATE]
[COMPANY NAME] (“we,” “us,” or “our”) operates [APP NAME], an educational spelling application for children and families. This Privacy Policy explains how we collect, use, and protect information when you use our website at [WWW.EXAMPLE.COM] and our application (collectively, the “Service”).
We are committed to protecting the privacy of all our users, particularly children. We comply with the Children’s Online Privacy Protection Act (COPPA), the General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA).
We collect only the minimum information necessary to provide our Service:
When students use the Service, we collect information about their learning activity, including:
This data is used to personalize the learning experience, track progress, and improve our educational algorithms.
We do not collect:
We use collected information to:
We do not sell personal information. We do not use personal information for behavioral advertising.
We take children’s privacy seriously and comply with COPPA and GDPR requirements for processing children’s data.
Users who indicate they are under 16 years old cannot create their own accounts. A parent or guardian must create a parent account and add child profiles. We verify age by collecting date of birth during signup; this date of birth is used only to determine the appropriate signup path and is not stored.
For children under 16, a parent must create the account. By creating a child profile, the parent consents to our collection and use of their child’s learning data as described in this policy. Parents can review, modify, or delete their child’s information at any time by logging into their parent account or contacting us.
For child profiles created under a parent account, we collect only learning activity data. We do not collect email addresses or other contact information directly from children.
Parents have the right to:
To exercise these rights, log into your parent account or contact us at [PRIVACY@EXAMPLE.COM].
Our Service uses only strictly necessary cookies required for authentication and session management. These cookies:
We do not use cookies for analytics, advertising, or tracking. We do not use any third-party tracking pixels or similar technologies.
Because we use only strictly necessary cookies, we do not display a cookie consent banner.
We share personal information only with service providers who help us operate the Service:
These providers are contractually obligated to protect your information and use it only as directed by us.
We may also disclose information if required by law, such as in response to a valid legal request from law enforcement.
We do not sell personal information to third parties.
We are based in the United States, and our servers are located in the United States. If you access the Service from outside the United States, including from the European Economic Area (EEA) or United Kingdom, your information will be transferred to and processed in the United States.
For users in the EEA and UK, we rely on Standard Contractual Clauses approved by the European Commission to ensure adequate protection for personal data transferred internationally.
We retain account information and learning data for as long as your account remains active.
You may delete your account at any time through your account settings or by contacting us. When you delete your account:
We retain anonymized, aggregated learning data (with all personal identifiers permanently removed) to improve our educational algorithms. This data cannot be used to identify any individual.
You have the right to:
Under GDPR and UK GDPR, you also have the right to:
Our legal basis for processing your data is: (a) contract performance (to provide the Service you requested), and (b) consent (for marketing communications and, for children under 16, parental consent for data collection).
Under the CCPA, California residents have the right to:
To submit a request, contact us at the email address below. We will verify your identity before processing your request.
We implement appropriate technical and organizational measures to protect personal information, including:
No system is perfectly secure. If we become aware of a security breach affecting your personal information, we will notify you and relevant authorities as required by law.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (for account holders) and by posting a notice on our website. We encourage you to review this policy periodically.
For material changes affecting children’s data, we will obtain new parental consent where required.
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us:
Email: [PRIVACY@EXAMPLE.COM]
[COMPANY NAME] San Francisco, California, USA
For users in the European Economic Area, you may also contact your local data protection supervisory authority.
Last updated: [DATE]