Privacy Policy

1. Who We Are

Skolvio is operated by Lime Learning Inc., a corporation registered in Ontario, Canada. In this policy, "Skolvio," "we," "us," and "our" refer to Lime Learning Inc.

Skolvio is an AI-powered tutoring platform for students in Grades 4–12. We take the privacy of our users — especially children — very seriously.

2. Our Commitment to Children's Privacy

Skolvio complies with the Children's Online Privacy Protection Act (COPPA) in the United States and the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.

• We do not collect personal information from children without verified parental consent.
• A parent or legal guardian must create an account, provide payment information, and affirmatively consent before any child profile is created.
• We do not display advertising to children.
• We do not sell, rent, or share children's personal information with third parties for marketing purposes.
• Child accounts are identified by a first name and username only — no email address, phone number, or date of birth is collected from children.

3. Verifiable Parental Consent

We obtain verifiable parental consent by requiring a valid credit card at sign-up. Under COPPA, a monetary transaction to a verified payment processor (Stripe) constitutes a permissible method of verifiable parental consent. By creating a Skolvio account and subscribing to our service, the parent or guardian confirms that:

• They are at least 18 years of age.
• They are the parent or legal guardian of the child(ren) for whom they are creating profiles.
• They consent to the collection and use of their child's data as described in this policy.

4. Information We Collect

4a. From Parents / Guardians

• Account information: full name, email address, and password (encrypted).
• Payment information: processed and stored by Stripe. We do not store credit card numbers on our servers.
• Child profile data provided by the parent: child's first name, username, grade level, curriculum, selected subjects, and special interest topics.

4b. From Students

• Lesson interactions: answers to lesson questions, practice problems, and exam responses.
• Drawing/handwriting inputs: when students use the drawing canvas, the image is sent to our AI for grading and is not permanently stored.
• Voice inputs: when students use the microphone to speak their answers, audio is recorded in the browser and sent to our speech-to-text service (Deepgram) for transcription. Audio recordings are processed in real-time and are not permanently stored by Skolvio or Deepgram.
• Text-to-speech audio: when students click "Listen" to hear lesson content read aloud, the text is sent to OpenAI's text-to-speech service to generate audio. No student personal information is included in these requests — only educational lesson content.
• Progress data: lesson completion status, star ratings, exam scores, and practice session results.
• Session data: login timestamps, authentication tokens (stored securely as server-side sessions).

4c. Automatically Collected

• Essential cookies: we use strictly essential cookies for authentication sessions. We do not use tracking, analytics, or advertising cookies.

5. How We Use Information

• To provide the Skolvio tutoring service — delivering lessons, grading answers, tracking progress, and generating reports.
• To personalize the learning experience based on grade level, curriculum, and selected subjects.
• To send parents progress reports, notifications, and account-related communications.
• To process payments and manage subscriptions.
• To maintain security and prevent unauthorized access to accounts.
• To improve our service, fix bugs, and develop new features.

We do not use children's data for advertising, profiling, or any purpose unrelated to the educational service.

6. Third-Party Service Providers

We use the following third-party services to operate Skolvio. Each provider processes data solely on our behalf and in accordance with their respective privacy policies:

AI data usage: Anthropic, OpenAI, and Deepgram have committed in their API terms of service that data sent via their APIs is not used to train their models. Student interactions with the AI tutor, text-to-speech requests, and voice transcriptions are processed in real-time and are not retained by these providers for model training.

7. Cross-Border Data Transfers

Lime Learning Inc. is incorporated in Ontario, Canada. However, our infrastructure providers (Supabase, Anthropic, OpenAI, Deepgram, Stripe, and Resend) are based in the United States. By using Skolvio, you consent to your data — including your child's educational data — being transferred to and processed in the United States.

All data is encrypted in transit (TLS/HTTPS) and at rest. Our service providers maintain industry-standard security practices and comply with applicable data protection regulations.

8. Data Retention

• Account data: retained for as long as the parent account is active. Deleted upon account closure, subject to any legal retention requirements.
• Child profiles and progress data: retained for as long as the child profile exists. Parents can delete a child profile at any time from their dashboard, which permanently removes all associated lesson progress, exam results, and practice data.
• Payment records: retained by Stripe in accordance with financial record-keeping requirements (typically 7 years).
• AI interaction data: lesson conversations are processed in real-time. We may store lesson interaction logs for quality assurance and parental review purposes. These are deleted when the child profile is deleted.
• Authentication sessions: automatically expire after 24 hours.
• Login attempt logs: rate-limiting records are purged after 15 minutes.
• Cancelled accounts: if you cancel your subscription but do not delete your account, your data is retained for up to 12 months so you can resubscribe without losing progress. After 12 months of inactivity, we may delete the account and all associated data. You can request immediate deletion at any time by contacting privacy@skolvio.com.

9. Data Security

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Child PINs are hashed using bcrypt — we never store PINs in plain text.
• Parent passwords are managed by Supabase Auth using industry-standard hashing.
• Authentication sessions use secure, httpOnly cookies that cannot be accessed by client-side scripts.
• Rate limiting is enforced on login attempts to prevent brute force attacks.
• Row-level security policies ensure parents can only access their own children's data.

10. Parental Rights

As a parent or legal guardian, you have the right to:

• Review your child's personal information and educational data at any time via your parent dashboard.
• Delete your child's profile and all associated data at any time from the parent dashboard.
• Refuse further collection of your child's data by deleting their profile or cancelling your subscription.
• Request a copy of all data we hold about your child by contacting us at privacy@skolvio.com.
• Withdraw consent at any time by deleting your account or contacting us directly.

We will respond to all parental requests within 30 days.

11. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Right to know: you may request details about the categories and specific pieces of personal information we have collected about you.
• Right to delete: you may request deletion of your personal information, subject to certain exceptions.
• Right to non-discrimination: we will not discriminate against you for exercising your CCPA rights.
• No sale of data: we do not sell personal information of any user, including children.

To exercise your California privacy rights, contact us at privacy@skolvio.com. We will respond within 45 days as required by the CCPA.

Note: personal information collected from children under 13 is governed by COPPA, which provides equivalent or greater protections.

12. Cookies

Skolvio uses only essential cookies required for the service to function:

• Authentication session cookies: used to keep parents and students logged in securely. These are httpOnly, secure cookies that expire after 24 hours.
• Supabase auth cookies: used to manage parent authentication sessions.

We do not use any tracking, analytics, advertising, or third-party cookies. Because we only use strictly necessary cookies, a cookie consent banner is not required under current regulations.

13. Breach Notification

In the unlikely event of a data breach that affects personal information, we will:

• Notify affected parents by email within 72 hours of becoming aware of the breach.
• Report the breach to the relevant authorities as required by PIPEDA (Office of the Privacy Commissioner of Canada) and/or applicable US state laws.
• Provide a clear description of the breach, the data affected, and the steps we are taking to address it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes — particularly changes affecting children's data — we will notify parents by email and update the "Last Updated" date at the top of this page. Continued use of Skolvio after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy, your child's data, or wish to exercise any of your parental rights, please contact us: