Your Privacy Matters

1. Who We Are

SmartStudy is operated by 7110961 Canada Inc., a corporation incorporated under the laws of Canada. Our services are designed for Canadian families and are subject to Canadian federal and provincial privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial equivalents.

Our data infrastructure is hosted in Canada (AWS ca-central-1 — Montreal) wherever technically possible.

2. What This Policy Covers

This policy applies to:

• The SmartStudy landing website (this site)
• The SmartStudy mobile and web application
• Any communications we send you (email, push notifications)

It does not apply to third-party websites we may link to. Those sites have their own privacy policies.

3. Information We Collect

3.1 Early Access Waitlist

When you sign up for our early access list, we collect:

• Your first name (required)
• Your last name (optional)
• Your email address (required)
• Your province (optional)
• Number of children in your household (optional)
• How you heard about us (optional)
• Whether you consent to marketing communications (your explicit choice)
• Your browser's user agent string (for CASL compliance records)

3.2 Account Registration

When you create a SmartStudy account, we collect:

• Parent/guardian: name, email address, province, timezone
• Child: first name, grade level, learning interests
• Billing information (processed by Stripe — we do not store card numbers)

3.3 Learning Activity

To provide the tutoring service, we collect:

• Session activity: questions answered, accuracy, time spent
• Curriculum progress: topics covered, mastery levels
• Gamification data: XP, streaks, badges earned
• Conversation content with Maple (our AI tutor)

3.4 Technical Information

We automatically collect standard technical information when you use our service:

• IP address (used for security and fraud prevention, not profiling)
• Device type and operating system
• App version

We do not use cookies for tracking or advertising on this site.

4. How We Use Your Information

We use personal information only for the purposes for which it was collected:

We do not sell your personal information. We do not use your child's data to train AI models for third parties. We do not serve advertising.

5. Children's Privacy

SmartStudy is designed for students from Kindergarten to Grade 12. We take children's and students' privacy with the utmost seriousness.

• Parental consent required. A parent or guardian must create the account and provide consent before a child can use SmartStudy.
• Pseudonymisation. Children are identified internally by a random pseudonym (e.g., "Learner-7429-K4"). Their real name never appears in learning data, logs, or AI prompts.
• No behavioural advertising. We never use a child's data for advertising purposes.
• No third-party data sharing for children. Children's learning data is never shared with third parties except as strictly necessary to deliver the service (e.g., our AI provider processes conversation content to generate responses).
• Granular consent. Optional features (voice input, location awareness) require separate, explicit parental consent and can be withdrawn at any time.
• Data minimisation. We collect only what is necessary to provide personalised tutoring.

We are aware of Ontario's Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) and the broader PHIPA framework. While SmartStudy is not a health information custodian, we apply equivalent care to children's educational data.

6. How We Share Your Information

We share personal information only in the following limited circumstances:

6.1 Service Providers

We use a small number of trusted service providers who process data on our behalf under strict data processing agreements:

• Supabase — Database and authentication (hosted in Canada, AWS ca-central-1)
• Amazon Web Services — AI inference (Bedrock, ca-central-1 where available)
• Stripe — Payment processing (PCI-DSS compliant)
• Voyage AI — Curriculum embedding (anonymised content only, no PII)

These providers are contractually prohibited from using your data for their own purposes.

6.2 Legal Requirements

We may disclose information if required by Canadian law, court order, or to protect the safety of a child.

6.3 Business Transfers

If SmartStudy is acquired or merges with another company, your information may be transferred. We will notify you in advance and you will have the option to delete your account.

6.4 What We Never Do

• We never sell personal information
• We never share children's data with advertisers
• We never share data with AI companies for model training

7. Data Retention

• Active accounts: Data is retained while your account is active.
• Account deletion: When you request deletion, your child's identity mapping is destroyed immediately. All other personal data is deleted within 30 days.
• Waitlist signups: Retained until you unsubscribe or request deletion.
• Billing records: Retained for 7 years as required by Canadian tax law (Income Tax Act).
• Anonymised aggregate data: May be retained indefinitely for service improvement (no individual can be identified).

8. Your Rights Under PIPEDA

As a Canadian resident, you have the right to:

• Access — Request a copy of the personal information we hold about you
• Correction — Request correction of inaccurate information
• Withdrawal of consent — Withdraw consent for optional uses (e.g., marketing emails) at any time
• Deletion — Request deletion of your account and personal information
• Complaint — File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, contact us at privacy@smartstudy.ca. We will respond within 30 days.

9. Marketing Communications (CASL)

We comply with Canada's Anti-Spam Legislation (CASL).

• We only send marketing emails to people who have given express consent.
• Every marketing email includes a clear, one-click unsubscribe link.
• Unsubscribe requests are processed within 10 business days.
• Service emails (receipts, security alerts, password resets) are not marketing and do not require opt-in.

To unsubscribe from marketing emails, click the unsubscribe link in any email or contact us at privacy@smartstudy.ca.

10. Security

We implement industry-standard security measures:

• All data is encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Children's identity data is stored in a schema-isolated, access-controlled database table
• Authentication uses Supabase Auth with PKCE flow
• Payment data is handled exclusively by Stripe (PCI-DSS Level 1)
• Access to production systems is restricted to authorised personnel

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at security@smartstudy.ca.

11. Changes to This Policy

We may update this policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify registered users by email at least 14 days before changes take effect
• For significant changes affecting children's data, require fresh parental consent

Continued use of SmartStudy after the effective date constitutes acceptance of the updated policy.

12. Contact Us

For privacy questions, access requests, or complaints:

You also have the right to contact the Office of the Privacy Commissioner of Canada: