Teeyo Privacy Policy

2.1 Account Information

When you create a Teeyo account, we collect:

• Parent/guardian email address (required to create and manage the account)
• Account password (hashed using industry-standard encryption and never stored in plain text)

We do not collect:

• Child's name or identifying information
• Parent's name or identifying information
• Address or phone number
• Date of birth (for child or parent)
• Payment information beyond what is processed by Stripe (see Section 2.3)

2.2 Writing Data

Writing submissions created by the child within the Teeyo Platform are collected because they are essential to:

• Generate personalized writing prompts
• Provide AI-powered feedback
• Track learning progression and adapt difficulty levels
• Improve the Platform's features and functionality

We do not store metadata such as the child's name, location, or device information alongside writing submissions.

2.3 Payment Information

Payments are processed securely by Stripe, a PCI-DSS compliant payment processor. We:

• Do not store full credit card details on our servers
• Do not store expiry dates or CVV codes
• Only receive confirmation of successful or failed transactions
• Store your subscription status and billing email address

For details on how Stripe handles your payment information, please review Stripe's Privacy Policy.

2.4 Cookies and Similar Technologies

We use only essential session cookies necessary to:

• Securely log you into your account
• Maintain an active session while you use the Platform
• Prevent unauthorized access

We do not use:

• Tracking cookies or pixels
• Advertising or retargeting cookies
• Analytics cookies (Google Analytics, Mixpanel, etc.)
• Cookies for profiling or behavioral analysis

You may disable cookies in your browser settings; however, this may limit your ability to use the Platform.

2.5 Information We Do Not Collect

We explicitly do not collect:

• Voice recordings or audio data
• Photos, images, or video
• Device information (operating system, browser type, device model)
• IP addresses or location data
• Behavioral usage data or activity logs
• Biometric information

3.1 Lawful Basis for Use

We use your information for the following purposes:

To operate and provide the Platform:

• Create and manage your account
• Deliver writing prompts and AI feedback
• Personalize learning progression and difficulty levels
• Respond to customer support requests
• Send transactional emails (account confirmations, password resets, subscription updates)

To improve the Platform:

• Analyze writing submissions to improve prompt generation
• Identify and fix technical issues
• Develop new features based on how the Platform is used
• Conduct research on writing pedagogy and learning outcomes (in anonymized form)

To manage payments:

• Process subscription payments through Stripe
• Send invoices and billing notifications
• Manage subscription status and renewals

To comply with law:

• Respond to lawful requests from government agencies or courts
• Protect against fraud or security threats
• Enforce our Terms of Service

3.2 What We Do NOT Do

We do not:

• Sell personal information to third parties
• Share personal information with marketers or advertisers
• Use information for marketing purposes or direct marketing (unless you explicitly opt-in)
• Profile children based on their writing or learning behavior for commercial purposes
• Combine your information with other datasets to create detailed profiles
• Share identifiable information with third parties except as disclosed in this policy

4.1 How AI Services Work

When your child submits writing to the Platform:

• The writing submission is sent to our AI service provider (currently OpenAI or Anthropic, as selected during account setup)
• The AI service processes the writing and returns feedback to be displayed in the Platform
• No identifiable personal information (such as names, email addresses, or account details) is sent with the writing

4.2 AI Model Training and Your Choice

Our AI service providers may use the data they receive to improve their AI models, unless you opt out.

Your options:

• Opt-in (Default): By creating an account, you consent to Teeyo allowing AI service providers to use writing submissions for model improvement, in accordance with their privacy policies.
• Opt-out: You may request that Teeyo not permit AI service providers to use your child's writing for model training by contacting [email protected]. We will honor this request, though we note that some AI service providers may have default policies regarding data usage. If you opt out, we will use their APIs in a way that prevents training use where their terms allow.

You may change your preference at any time by contacting [email protected].

4.3 Third-Party AI Provider Policies

Teeyo does not run AI models locally. We rely on third-party providers who have their own privacy policies:

• OpenAI (https://openai.com/privacy) – processes writing and may use data for model training
• Anthropic (https://www.anthropic.com/privacy) – processes writing and may use data for model training

We recommend reviewing their privacy policies to understand how they handle data. By using Teeyo, you acknowledge that writing submissions will be processed by these third-party providers in accordance with their privacy policies.

6.1 Age Requirements

Teeyo is designed for children aged 8 and above. We require a parent or legal guardian email address at account creation to ensure appropriate supervision and control over the child's use of the Platform.

6.2 Parental Rights

As the parent or legal guardian, you have the right to:

• Access your child's writing submissions and learning progress
• Request deletion of your child's account and all associated data
• Change account settings (e.g., AI training preferences)
• Update the parent/guardian email address
• Manage subscription and billing information
• Review how the Platform uses your child's information

6.3 Direct Collection from Children

We do not knowingly collect personal information directly from children. All account creation and management is conducted through the parent/guardian email address. If we become aware that a child has provided personal information directly (such as through a contact form), we will delete that information promptly.

6.4 Parental Consent

By creating an account, you confirm that:

• You are the parent or legal guardian of any child using this account
• You have authority to consent to the collection and use of personal information as described in this Privacy Policy
• You have read and understood this Privacy Policy

7.1 How We Store Data

• Encryption in Transit: All data transmitted between your device and Teeyo is encrypted using HTTPS/TLS 1.2 or higher.
• Encryption at Rest: Sensitive information (passwords, billing details) is encrypted when stored in our database.
• Access Controls: Only authorized Teeyo staff with a legitimate business need can access personal information. We use role-based access controls to restrict access.
• Secure Infrastructure: Teeyo is hosted on Vercel, a secure cloud platform, with database storage in MongoDB Atlas, which maintains industry-standard security practices.

7.2 Data Retention

• Writing Submissions: Writing submissions are retained indefinitely to support ongoing learning progression, unless you request deletion (see Section 9). Parents who wish to have data deleted sooner may request deletion at any time.
• Account Information: Account information (email, password hash) is retained for as long as your account is active.
• Inactive Accounts: Accounts with no login activity for 24 consecutive months are automatically deleted, including all associated writing submissions and account data.
• Payment Records: Payment and subscription records are retained for 7 years to comply with Australian tax and business record-keeping requirements.
• Support Correspondence: Records of support requests and correspondence are retained for 2 years.

7.3 Security Limitations

While we take reasonable steps to protect personal information, no online system is completely secure. We cannot guarantee absolute security against all potential threats, including unauthorized access, data breaches, or cyberattacks. We encourage you to:

• Use a strong, unique password for your account
• Not share your account credentials with others
• Monitor your account regularly for unusual activity
• Report any suspected security issues to [email protected] immediately

9.1 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

[email protected]

Please include:

• Your registered email address
• The nature of your request
• Any supporting information (we may ask for additional details to verify your identity)

We will respond to your request within 30 days. In some cases, we may need to verify your identity before actioning your request to ensure we are protecting the privacy of the account holder.