Privacy Policy

1. Who We Are

Skolvio is operated by 17984677 Canada Inc., a corporation registered in Ontario, Canada. In this policy, "Skolvio," "we," "us," and "our" refer to 17984677 Canada Inc.

Skolvio is an AI-powered tutoring platform for students in Grades 4–8, offering Mathematics, English Language Arts, and Science aligned to the Ontario curriculum. We take the privacy of our users — especially children — very seriously.

2. Our Commitment to Children's Privacy

Skolvio complies with the Children's Online Privacy Protection Act (COPPA) in the United States and the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.

• We do not collect personal information from children without verified parental consent.
• A parent or legal guardian must create an account, provide payment information, and affirmatively consent before any child profile is created.
• We do not display advertising to children.
• We do not sell, rent, or share children's personal information with third parties for marketing purposes.
• Child accounts are identified by a first name and username only — no email address, phone number, or date of birth is collected from children.
• We collect only the data needed to provide the tutoring service and to let parents review their child's work and progress. This includes your child's lesson, practice, and exam questions and answers, their written work, and their conversations with the AI tutor. We do not store raw voice-audio recordings. See Section 4 for full detail.

3. Verifiable Parental Consent

We obtain verifiable parental consent by requiring a valid credit card at sign-up. Under COPPA, a monetary transaction to a verified payment processor (Stripe) constitutes a permissible method of verifiable parental consent. By creating a Skolvio account and subscribing to our service, the parent or guardian confirms that:

• They are at least 18 years of age.
• They are the parent or legal guardian of the child(ren) for whom they are creating profiles.
• They consent to the collection and use of their child's data as described in this policy.

A child profile becomes usable once the parent's payment method is on file and the subscription (including any free trial) is active. By providing payment details and completing sign-up, the parent authorizes the collection of their child's data described in this policy, whether or not a charge has yet been applied.

4. Information We Collect

4a. From Parents / Guardians

• Account information: full name, email address, and password (encrypted).
• Billing address: country and postal/ZIP code, collected at payment setup for tax calculation purposes.
• Payment information: processed and stored by Stripe. We do not store credit card numbers on our servers.
• Child profile data provided by the parent: child's first name, username, grade level, curriculum, and selected subjects.
• Referral information: if you join through a referral link or refer another parent, we store your referral code and a link between the referring and referred accounts in order to apply the related credits and discounts.

4b. From Students

We collect only the data needed to deliver lessons, grade work, track progress, keep your child safe, and let you review their learning. The categories below describe what we store.

• Progress data: lesson completion status, star ratings, exam scores, and practice session results.
• Questions and answers: for each lesson, practice, exam, and review question, we store the question, the correct answer, your child's answer, and whether it was correct. This powers progress reports, the "recent mistakes" and review tools in your parent dashboard, and our Concept Mastery feature.
• Written work: when your child completes a Writing Studio or Reading Studio activity, we store their full written response (and, for reading, the passage and their comprehension answers) so we can provide feedback and so you can review their work.
• Tutor conversations: messages between your child and the AI tutor — both your child's messages and the tutor's replies — are logged so they are available for parental review and so we can monitor and improve safety.
• Drawing inputs: when your child answers by drawing, the drawing is sent to our AI (Anthropic Claude) for grading in real-time. We do not store the drawing image itself; we store the question and whether the answer was correct.
• Voice inputs: when students use the microphone, audio is sent to our speech-to-text service (Deepgram) for transcription in real-time. Audio recordings are not stored by Skolvio or Deepgram. The transcribed text is treated like any other typed answer.
• Text-to-speech audio: when students click "Listen," lesson text is sent to OpenAI's text-to-speech service. No student personal information is included — only educational content.
• Session data: login timestamps and authentication tokens (stored securely as server-side sessions).

4c. Automatically Collected

• Essential cookies: used to keep parents and students securely logged in.
• Marketing cookies (Meta Pixel): on our public pages (homepage, pricing, blog, our-approach, tools, and the sign-up page), we use the Meta Pixel, which sets a _fbp cookie to help us measure the effectiveness of our advertising on Facebook and Instagram. This cookie is not set on any logged-in parent dashboard, lesson, or other student-facing page. No child data is ever shared with Meta.
• Analytics (Google Analytics 4): we use Google Analytics to understand how our site is used. On our public pages and the parent dashboard, analytics cookies are set only if you accept them via our cookie banner. On student lesson pages we collect only aggregate, cookieless usage events, with advertising features and Google Signals disabled. No child personal information is ever sent to Google.

5. How We Use Information

• To provide the Skolvio tutoring service — delivering lessons, grading answers, tracking progress, and generating reports.
• To personalize the learning experience based on grade level, curriculum, and selected subjects.
• To send parents progress reports, notifications, and account-related communications.
• To process payments and manage subscriptions.
• To maintain security and prevent unauthorized access to accounts.
• To keep your child safe — reviewing flagged interactions and maintaining tutor conversation logs available for parental review.
• To improve our service, fix bugs, and develop new features.

We do not use children's data for advertising, profiling, or any purpose unrelated to the educational service.

Marketing emails: with your consent, we may send occasional emails about new features or offers. Every marketing email identifies us and includes an unsubscribe link, and you can opt out at any time without affecting your service or transactional emails (billing, security, and progress reports). This is consistent with Canada's Anti-Spam Legislation (CASL).

6. Third-Party Service Providers

We use the following third-party services to operate Skolvio. Each provider processes data solely on our behalf and in accordance with their respective privacy policies:

AI data usage: Anthropic, OpenAI, and Deepgram have committed in their API terms of service that data sent via their APIs is not used to train their models. Student interactions with the AI tutor, text-to-speech requests, and voice transcriptions are processed in real-time and are not retained by these providers for model training. These providers act as our service providers (processors) and are contractually permitted to use your child's data only to provide the service to us — not for their own purposes, advertising, or profiling.

7. Cross-Border Data Transfers

17984677 Canada Inc. is incorporated in Ontario, Canada. However, our infrastructure and service providers (Supabase, Anthropic, OpenAI, Deepgram, Stripe, Resend, Vercel, and Google) are based in the United States. By using Skolvio, you consent to your data — including your child's educational data — being transferred to and processed in the United States.

Because this infrastructure is located in the United States, your data may be subject to access by US courts, law enforcement, or government authorities under US law (such as the CLOUD Act), under legal standards that may differ from those in Canada. We remain accountable for your data under PIPEDA and use data processing agreements with our providers that require them to protect your data to a comparable standard.

All data is encrypted in transit (TLS/HTTPS) and at rest. Our service providers maintain industry-standard security practices and comply with applicable data protection regulations.

Quebec residents: if you are located in Quebec, please contact us at privacy@skolvio.com before creating an account so we can address the requirements of Quebec's Law 25 regarding personal information processed outside the province.

8. Data Retention

• Account data: retained for as long as the parent account is active. Deleted upon account closure, subject to any legal retention requirements.
• Child profiles and progress data: retained for as long as the child profile exists. Parents can delete a child profile at any time from their dashboard, which permanently removes all associated lesson progress, exam results, and practice data.
• Payment records: retained by Stripe in accordance with financial record-keeping requirements (typically 7 years).
• Learning data: questions and answers, written submissions, and tutor conversation logs are retained for as long as the child profile exists, so that parents can review progress and work. Deleting the child profile permanently removes all of it. We do not retain raw voice audio (transcribed in real-time) or the drawing-canvas image itself.
• Authentication sessions: automatically expire after 24 hours.
• Login attempt logs: rate-limiting records are purged after 15 minutes.
• Cancelled accounts: if you cancel your subscription but do not delete your account, your data is retained for up to 12 months so you can resubscribe without losing progress. After 12 months of inactivity, we may delete the account and all associated data. You can request immediate deletion at any time by contacting privacy@skolvio.com.

9. Data Security

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Child PINs are hashed using bcrypt — we never store PINs in plain text.
• Parent passwords are managed by Supabase Auth using industry-standard hashing.
• Authentication sessions use secure, httpOnly cookies that cannot be accessed by client-side scripts.
• Rate limiting is enforced on login attempts to prevent brute force attacks.
• Row-level security policies ensure parents can only access their own children's data.

10. Parental Rights

As a parent or legal guardian, you have the right to:

• Review your child's personal information and educational data at any time via your parent dashboard.
• Correct inaccurate child profile information (such as name or grade) from your dashboard, or by contacting us.
• Delete your child's profile and all associated data at any time from the parent dashboard.
• Refuse further collection of your child's data by deleting their profile or cancelling your subscription.
• Request a copy of all data we hold about your child by contacting us at privacy@skolvio.com.
• Receive a portable copy of your child's data in a commonly used, machine-readable format, where technically feasible.
• Withdraw consent at any time by deleting your account or contacting us directly.

We will respond to all parental requests within 30 days.

We have designated a Privacy Officer who is accountable for our compliance with this policy and applicable privacy laws, reachable at privacy@skolvio.com. If you have a privacy concern we have not resolved to your satisfaction, you have the right to challenge our compliance and to file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca). Residents of other regions may also contact their applicable data-protection regulator.

11. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights regarding your personal information:

• Right to know: you may request details about the categories and specific pieces of personal information we have collected about you.
• Right to delete: you may request deletion of your personal information, subject to certain exceptions.
• Right to non-discrimination: we will not discriminate against you for exercising your CCPA rights.
• No sale of data: we do not sell personal information of any user, including children.
• Right to correct: you may request that we correct inaccurate personal information we hold about you.
• No sharing for advertising: we do not "share" personal information for cross-context behavioral advertising.
• Sensitive personal information: we do not use or disclose sensitive personal information beyond the purposes permitted under the CCPA for providing the service.
• Categories collected: identifiers (such as name, email, username), commercial information (subscription and billing records), internet activity (usage and analytics), and education information (lessons, answers, and progress). We collect these from parents and from students' use of the service and use them only for the purposes described in this policy.
• Authorized agent: you may use an authorized agent to submit a request on your behalf; we may require verification of your identity and the agent's authority.

To exercise your California privacy rights, contact us at privacy@skolvio.com. We will respond within 45 days as required by the CCPA.

Note: personal information collected from children under 13 is governed by COPPA, which provides equivalent or greater protections.

12. Cookies

Skolvio uses the following cookies:

On our public marketing pages, analytics and advertising cookies (Google and Meta) are set only if you accept them through our cookie consent banner; you can decline at any time. Essential cookies are always active because they are required to keep you logged in.

The Meta Pixel cookie is not set on any page where users are logged in or where children interact with the platform. To opt out of Meta's advertising tracking, visit Facebook Ad Preferences or use a browser extension such as uBlock Origin.

Server-side conversion measurement: separately from cookies, when a paid subscription begins we send Meta a hashed (irreversible) version of the parent's email address and account ID to measure which ads led to a subscription. This is a direct server-to-server transfer that does not use cookies, so it is not controlled by the cookie banner. It never includes any child data. See the third-party list above for details.

Do Not Track & browser signals: there is no industry-standard response to browser "Do Not Track" signals, so we do not respond to them separately. Instead, on our public pages you can decline non-essential analytics and advertising cookies (including the Meta Pixel and Google Analytics) at any time through our cookie consent banner. No advertising cookies are set on signed-in or student-facing pages. Analytics cookies may be set on the parent dashboard with your consent; on student-facing pages any usage analytics is aggregate and cookieless.

13. Breach Notification

In the unlikely event of a data breach that affects personal information, we will:

• Notify affected parents by email as soon as reasonably possible after we become aware of a breach that creates a real risk of significant harm.
• Report the breach to the Office of the Privacy Commissioner of Canada (and any applicable US state authorities) where it creates a real risk of significant harm, and keep records of breaches as required by PIPEDA.
• Provide a clear description of the breach, the data affected, and the steps we are taking to address it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes — particularly changes affecting children's data — we will notify parents by email and update the "Last Updated" date at the top of this page. Continued use of Skolvio after changes constitutes acceptance of the updated policy.

15. Contact Us

If you have questions about this Privacy Policy, your child's data, or wish to exercise any of your parental rights, please contact us: