1. Introduction, identity of the controller and scope
1.1 This Privacy Policy (the "Policy") describes how AIWIZLY LIMITED, a company incorporated in England and Wales under company number 16500442 with its registered office at 64 Southwark Bridge Road, London, England, SE1 0AS ("AIWizly", "we", "us", "our"), processes personal data in connection with our website at aiwizly.com (the "Website"), our learning platform at learn.aiwizly.com (the "Platform") and our mobile applications (the "App", and together with the Website and the Platform, the "Service").
1.2 We are the controller of the personal data described in this Policy, except where expressly stated otherwise. We process personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and, where applicable, the ICO's Age Appropriate Design Code.
1.3 This Policy is an information notice provided in accordance with Articles 13 and 14 of the UK GDPR. It does not form part of any contract and does not confer contractual rights, except to the extent required by applicable law.
1.4 Where we provide the Service to a school or other organisation under a separate written agreement, that agreement (including its data processing terms) governs our processing of personal data on that organisation's behalf and prevails over this Policy to the extent of any inconsistency.
2. Summary of key points
This summary is provided for convenience only; the full Policy governs.
- We collect the minimum personal data needed to operate the Service.
- Children are not asked to provide personal data. Child profiles are pseudonymous by design and are created and controlled by a parent or guardian.
- The Service does not serve advertising and does not incorporate third-party tracking technologies.
- We do not sell personal data and do not share personal data for third parties' marketing purposes.
- Parents can review, rename and delete child profiles, or delete the entire account, at any time.
3. Accounts and eligibility; your confirmations
3.1 Accounts may be created and administered only by individuals aged 18 or over who hold parental responsibility for, or are otherwise duly authorised to act on behalf of, each child added to the account (each an "Account Holder").
3.2 By creating an account, the Account Holder confirms that: (a) they satisfy the requirements in clause 3.1; (b) all information they provide is accurate and will be kept up to date; and (c) any consent they give in respect of a child is given with authority to do so. We are entitled to rely on these confirmations.
3.3 Children do not create accounts, are not requested to provide personal data, and cannot make purchases or communicate with other users or third parties through the Service.
4. Personal data we process — Account Holders
We process the following categories of personal data relating to Account Holders:
- Identity and contact data: your email address, used to authenticate you, secure the account and send service communications.
- Credentials: your password, which is stored in hashed form only.
- Compliance records: records of your acceptance of our Terms and of the consents you have given, including the time and means of acceptance, retained so that we can demonstrate compliance with our legal obligations.
- Correspondence: communications you send to us, including support requests.
- Account administration data: records of the child profiles created and devices linked under the account.
5. Personal data we process — child profiles
5.1 Child profiles are pseudonymous by design. Each profile is created and controlled by the Account Holder and comprises:
- a display name generated by the Service; the Service contains no field intended for a child's real name;
- learning progress data (responses to quizzes and activities, stars and streaks earned, and in-Service rewards such as virtual pets), processed to save a child's progress and to display it to the child and the Account Holder; and
- an optional picture-PIN used on the family's own linked device, stored in hashed form only.
5.2 Where an Account Holder chooses to enter additional information relating to a child (for example, by renaming a profile), the Account Holder does so at their own discretion. We process such information as part of the account on the legal bases set out in clause 8, and the Account Holder is responsible for ensuring they are entitled to provide it.
6. Technical data
6.1 To associate devices with the correct account and to maintain the security of the Service, we process:
- Device tokens: randomly generated identifiers created when an Account Holder links a device. A device token identifies the device, not any individual child, and enables offline use, synchronisation and remote revocation of access.
- Device descriptions: coarse technical information (such as device model and operating-system version), used to respond to support requests and diagnose faults.
6.2 Our infrastructure processes IP addresses transiently for the purposes of delivering the Service and preventing abuse. IP addresses are not stored in our application database and are not linked to child profiles. Server logs are short-lived and rotate automatically.
7. Data we do not collect; practices we do not engage in
7.1 As at the effective date of this Policy:
- the Service does not serve advertising and does not use advertising identifiers, and the Android App does not request the advertising-ID permission;
- the App does not request microphone, precise location, contacts or photo-library permissions;
- the App and the Platform do not incorporate third-party advertising or third-party tracking technologies;
- we do not use children's personal data for behavioural profiling and do not carry out automated decision-making producing legal or similarly significant effects; and
- the Website collects only aggregate, cookieless page-view statistics.
7.2 We do not sell personal data, and we do not share personal data with third parties for their own marketing purposes.
7.3 If any statement in clause 7.1 ceases to be accurate in a material respect, we will update this Policy in accordance with clause 17 before the change takes effect.
8. Purposes of processing and legal bases
8.1 We process personal data for the following purposes and on the following legal bases under Article 6 UK GDPR:
- Providing and operating the Service (account creation and authentication, saving and synchronising learning progress, linking family devices): performance of our contract with the Account Holder (Article 6(1)(b)).
- Processing child profile data as configured and directed by the Account Holder: performance of our contract with the Account Holder and, where consent is required by law, the consent of the Account Holder as the holder of parental responsibility (Articles 6(1)(a) and 8). Our contract is always with the Account Holder, not the child.
- Security, fraud and abuse prevention (device tokens, sign-in protection, rate limiting, infrastructure logs): our legitimate interests in maintaining the security and integrity of the Service (Article 6(1)(f)).
- Service administration, support and improvement (responding to support requests, diagnosing and resolving faults): our legitimate interests in operating and improving the Service (Article 6(1)(f)).
- Compliance records (records of consents and acceptances): compliance with our legal obligations (Article 6(1)(c)) and our legitimate interests in demonstrating compliance and in establishing, exercising or defending legal claims (Article 6(1)(f)).
- Service communications to Account Holders concerning their account or material changes to the Service: performance of our contract with the Account Holder. We do not send marketing communications to children, and no communications from us are directed to children.
8.2 Where we rely on legitimate interests, we have assessed that those interests are not overridden by the interests, rights and freedoms of the individuals concerned, taking particular account of the fact that some individuals are children.
9. Aggregated and anonymised data
We may create and use aggregated or anonymised information that does not identify, and cannot reasonably be used to identify, any individual, for any lawful purpose, including analysing, developing and improving the Service. Such information is not personal data and is not subject to this Policy.
10. Disclosures of personal data
10.1 We disclose personal data only as follows:
- Processors. To hosting, database and related infrastructure providers who process personal data on our behalf, on our documented instructions and under written data processing agreements complying with Article 28 UK GDPR.
- Professional advisers. To our legal, accounting, audit and insurance advisers, subject to obligations of confidentiality, where reasonably necessary.
- Legal and protective disclosures. Where we consider disclosure reasonably necessary to comply with applicable law, regulation or legal process; to respond to lawful requests from public authorities; to enforce our agreements; to detect, prevent or address fraud, abuse or security or technical issues; or to protect the rights, property or safety of AIWizly, our users or the public.
- Corporate transactions. In connection with any actual or contemplated merger, acquisition, financing, corporate reorganisation, insolvency proceeding, or sale or transfer of all or part of our business or assets (including related due diligence), in which case personal data may be disclosed to the parties concerned and their advisers subject to appropriate confidentiality obligations, and may be transferred as part of the transaction. Any recipient's processing remains subject to applicable data protection law.
- With consent. To other recipients where the Account Holder has consented.
10.2 We do not disclose personal data to advertisers or data brokers.
11. International data transfers
11.1 Personal data is stored on infrastructure located in the United Kingdom and/or the European Economic Area.
11.2 Where personal data is transferred to a country outside the United Kingdom that has not been the subject of UK adequacy regulations, we implement appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with supplementary measures where required.
12. Retention
12.1 We retain personal data for no longer than is necessary for the purposes for which it is processed, determined as follows:
- Account and profile data: for the life of the account.
- Deletion of a child profile: that profile's personal data is removed from our active systems without undue delay and in any event within 30 days.
- Deletion of an account: the account's personal data is erased from our active systems without undue delay and in any event within 30 days.
- Backups: residual copies of deleted data may persist in encrypted backups until those backups are overwritten in the ordinary course, within a further period of up to 90 days. Backups are not used to restore deleted data except where necessary for disaster recovery, in which case deletion is re-applied.
- Compliance records: records of consents and acceptances are retained for as long as necessary to demonstrate compliance with our legal obligations, including for the duration of applicable limitation periods.
- Correspondence: for as long as necessary to deal with the matter concerned and for applicable limitation periods.
- Infrastructure logs: short-lived and rotated automatically.
12.2 Notwithstanding clause 12.1, we may retain personal data for longer where retention is required by law, or where retention is reasonably necessary in connection with actual or reasonably anticipated legal claims, regulatory investigations or the enforcement of our agreements.
13. Security
13.1 We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage, including: encryption of connections to the Service; storage of passwords and picture-PINs in hashed form only; per-family access controls enforced at database level (row-level security); and narrow, revocable device credentials that an Account Holder can unlink at any time.
13.2 No method of transmission over the internet or method of electronic storage is completely secure. While we take steps appropriate to the risk, we cannot guarantee the absolute security of personal data.
13.3 Account Holders are responsible for maintaining the confidentiality of their credentials and for the security of devices they choose to link to the account.
14. Your rights
14.1 Subject to the conditions and exemptions in applicable law, you have the right to request access to, rectification or erasure of, or restriction of the processing of, your personal data; the right to object to processing based on legitimate interests; the right to data portability; and, where processing is based on consent, the right to withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal).
14.2 These rights may be exercised directly: an Account Holder can sign in at learn.aiwizly.com/family to view the family's information, delete individual child profiles or delete the entire account. Requests may also be made by email to info@aiwizly.com.
14.3 We may take reasonable steps to verify the identity of a requester and, where the request concerns a child's data, that the requester holds parental responsibility for that child, before acting on a request.
14.4 We respond to requests within one month of receipt. Where a request is complex or we receive a number of requests, we may extend this period by up to two further months, in which case we will inform you within the first month. Where a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it, as permitted by Article 12(5) UK GDPR.
14.5 You have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk). We encourage you to contact us at info@aiwizly.com in the first instance so that we can seek to resolve your concern.
15. Children's data and parental controls
15.1 Only the Account Holder may create child profiles, link devices and give or manage consents.
15.2 The Account Holder may at any time review a child's learning progress, rename or delete a child profile, or delete the entire account, via learn.aiwizly.com/family or the App's Grown-ups area.
15.3 Consent may be withdrawn by deleting the relevant profile or the account; the retention provisions in clause 12 apply. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
15.4 Children cannot alter consents, make purchases or communicate with other users or third parties through the Service.
16. Third-party websites and services
This Policy applies only to the Service. It does not apply to any third-party website or service, including any site linked from the Website. We are not responsible for the privacy practices of third parties, whose own notices govern their processing.
17. Cookies
17.1 The Platform uses strictly necessary cookies only, for the purpose of keeping a signed-in Account Holder signed in and securing the session.
17.2 The Website does not set advertising or cross-site cookies; visitor statistics are collected on an aggregate, cookieless basis (clause 7.1).
17.3 Any material change to our use of cookies will be reflected in an update to this Policy.
18. Changes to this Policy
18.1 We may amend this Policy from time to time. The current version, with its effective date, will be published on this page.
18.2 Where a change materially affects how we process children's personal data, we will notify Account Holders directly before the change takes effect and, where required by law, obtain fresh consent.
18.3 Continued use of the Service after the effective date of an amended Policy constitutes acknowledgment of the amended Policy; where applicable law requires consent to a change, we will seek it.
19. Governing law
This Policy, and any dispute or claim arising out of or in connection with it, is governed by the laws of England and Wales. Nothing in this Policy affects any statutory rights that cannot be excluded or limited under applicable law.
20. Contact
AIWIZLY LIMITED, 64 Southwark Bridge Road, London, England, SE1 0AS — company number 16500442.
Email: info@aiwizly.com