Privacy Policy
Your child's data is sacred to us. Here's exactly what we collect, why we collect it, and how we protect it — in plain language.
Effective Date: May 1, 2026 · Version 1.0Overview & Our Commitments
Our promise to Canadian families: SmartStudy exists to help children learn — not to profit from their data. We collect only what is necessary to deliver the Service, we keep it entirely within Canada, and we will never sell it, advertise with it, or share it without your explicit consent.
This Privacy Policy describes how 7110961 Canada Inc., operating as SmartStudy™ ("SmartStudy," "we," "us," "our"), collects, uses, stores, and discloses personal information when you use our platform, including the Maple AI study coach, the parent dashboard, and all associated services (the "Service").
This policy applies to:
- Parents and guardians who create and manage accounts
- Children who use SmartStudy through a parent-managed account
- Visitors to our website at smartstudy.ca
We comply fully with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), applicable provincial privacy legislation, and the Canada Anti-Spam Legislation (CASL).
Who Controls Your Data
The data controller responsible for your personal information is:
- Legal entity: 7110961 Canada Inc.
- Operating name: SmartStudy™
- Registered office: 200 Colborne St West, Whitby, Ontario, L1N 1X2
- Country: Canada
- Privacy contact: privacy@smartstudy.ca
Our designated Privacy Officer is responsible for overseeing compliance with PIPEDA and responding to privacy-related inquiries and complaints.
What We Collect
We collect three categories of information:
| Category | Specific Data | Who It Relates To | Required? |
|---|---|---|---|
| Account Information | Name, email address, password (hashed), province/territory, subscription status | Parent / Guardian | Required |
| Child Profile | First name or nickname, grade level, province, preferred learning style settings, accessibility needs (optional) | Child | Required |
| Learning & Usage Data | Session logs, questions asked, answers given, time spent, XP earned, weekly progress, badges, skill assessments, Maple conversation transcripts | Child | Required |
| Voice Data | Audio input processed in real-time for speech recognition (not stored after processing unless transcript retention is enabled) | Child | Optional |
| Payment Information | Billing name, last four digits of card, billing address. Full card numbers are processed by our payment processor and never stored by SmartStudy. | Parent / Guardian | Required for paid plans |
| Technical Data | IP address (anonymized), browser type, device type, session timestamps, error logs | All users | Automatic |
| Communications | Support emails, feedback submissions, waitlist sign-ups | Parent / Guardian | When provided |
What We Do Not Collect
- Children's last names, home addresses, or phone numbers
- Photos or video from device cameras
- Geolocation beyond province/territory selection
- Social media profiles or third-party account data
- Sensitive health or medical information (accessibility preferences are optional and self-reported)
- Device contacts, call logs, or files outside the app
Children's Information
This section is the most important part of our policy. If you read nothing else, read this.
SmartStudy is a service for children, and we treat data about children with the highest level of care. We follow the principle of data minimization — we collect the least amount of information necessary for Maple to do her job.
Parental Consent & Control
- A parent or guardian must create and maintain the account. Children cannot self-register.
- By creating a child profile, you provide verifiable parental consent for us to collect and use your child's information as described in this policy.
- Parents may view, edit, or delete all child profile information at any time from the parent dashboard.
- Parents may request a complete export of their child's data within 30 days of the request.
- Parents may request permanent deletion of their child's account and all associated data.
What Children's Data Is Used For
Information collected about your child is used exclusively to:
- Personalize Maple's teaching style, pacing, and content to your child's learning profile
- Track curriculum progress and generate your weekly parent report card
- Operate the gamification system (XP, weekly progress, badges)
- Enable spaced-repetition scheduling of review topics
- Support accessibility features and UDL accommodations
- Ensure child safety through content moderation and parental review tools
Children's Data Is Never Used For
- Advertising, behavioral profiling, or marketing to children
- Sale or sharing with third parties for commercial purposes
- AI model training without explicit additional parental consent
- Any purpose other than those listed above
How We Use Data
We use personal information only under the following lawful bases, as required by PIPEDA:
| Purpose | Lawful Basis | Data Used |
|---|---|---|
| Delivering and personalizing the Service | Contractual necessity | Account, child profile, learning data |
| Parent dashboard & reporting | Contractual necessity | Learning data, session logs |
| Processing payments | Contractual necessity | Billing information |
| Sending weekly report card emails | Consent (CASL compliant) | Email, learning data summary |
| Responding to support requests | Legitimate interest | Email, account data |
| Safety monitoring & content moderation | Legitimate interest | Conversation transcripts |
| Platform security & fraud prevention | Legitimate interest | Technical data, IP addresses |
| Service improvement (de-identified) | Legitimate interest | Aggregated, anonymized usage statistics |
| Legal compliance | Legal obligation | As required by law |
AI & Maple Data
Maple's intelligence is powered by AI models. Understanding how your child's interactions are handled is important to us.
Conversation Processing
- Conversations with Maple are processed in real-time on Canadian-hosted servers to generate responses.
- Session transcripts are stored and are reviewable by parents in the parent dashboard for up to 90 days, after which they are archived in anonymized form.
- Parents may flag any Maple response for human review at any time from the parent dashboard.
AI Model Training
- We do not use your child's identifiable conversations to train AI models without your explicit, separate consent.
- We may use de-identified, aggregated patterns (such as which types of hints help children most) to improve curriculum content and Maple's pedagogical approach.
- Any future opt-in for more detailed AI improvement participation will be presented separately and clearly.
Voice Processing
When voice input is used, audio is streamed to our Canadian servers for speech-to-text conversion. The raw audio is not stored; only the text transcript is retained subject to the transcript retention policy above. Parents can disable voice features entirely from account settings.
Canadian Hosting
Your child's data stays in Canada. Accounts, learning sessions, conversations with Maple, parent dashboards, and backups are stored and processed entirely on Canadian servers.
We made a deliberate architectural decision to keep all personal information in Canada from day one. This means:
- Your child's data is subject to Canadian law, not US or foreign privacy regimes
- Your data cannot be accessed under the US CLOUD Act or similar foreign legislation
- All AI model inference (powering Maple) occurs on Canadian-region servers
- Backups and disaster recovery are maintained within Canada
One nuance worth stating clearly: our public marketing pages — the website you're reading right now — are delivered by a global content delivery network so they load quickly anywhere in the world. Those pages contain no personal information; they're the same HTML, CSS, and images for every visitor. The moment you create an account or submit a form, your data flows directly to our Canadian-region database and stays there.
We will maintain this commitment as we scale and will notify users of any material infrastructure change that could affect where personal information is stored.
For families in Quebec, our data practices are built to satisfy An Act respecting the protection of personal information in the private sector (Law 25), including the parental-consent requirements under section 4.1 for the collection of personal information from children under 14.
Retention & Deletion
| Data Type | Retention Period | Deletion Method |
|---|---|---|
| Account & profile information | Duration of subscription + 30 days grace period | Permanent deletion upon account closure request |
| Learning session data | Active for the life of the account; anonymized after 2 years of account inactivity | Deletable at any time via parent dashboard |
| Maple conversation transcripts | 90 days (reviewable), then anonymized | Parent may delete individual sessions |
| Marketing site chat logs | 90 days, then purged automatically | Automatic purge |
| Anonymous public homework decodes | 7 days (claimable window), then purged if unclaimed. Photos deleted after 30 days regardless. | Automatic purge |
| Voice audio | Not stored — processed in real-time only | N/A |
| Payment records | 7 years (tax & legal requirement) | Cannot be deleted early due to legal obligations |
| Support communications | 2 years from resolution | Deletable upon written request |
| Technical / error logs | 90 days, anonymized thereafter | Automatic |
Upon account deletion, we will permanently delete all personal data within 30 days, except data we are legally required to retain (such as payment records). We will confirm deletion in writing upon request.
Security
We implement security measures appropriate to the sensitivity of the data we hold — particularly given that it includes children's information. Our safeguards include:
- Encryption in transit: All data transmitted between your device and our servers uses TLS 1.3 encryption.
- Encryption at rest: Databases and backups are encrypted using AES-256.
- Password security: Passwords are hashed using industry-standard bcrypt. We never store plain-text passwords.
- Access controls: Access to production data is restricted to authorized personnel on a need-to-know basis, with multi-factor authentication required.
- Regular audits: We conduct periodic security reviews and vulnerability assessments.
- Breach response: In the event of a data breach affecting your information, we will notify you and the Office of the Privacy Commissioner of Canada (OPC) within 72 hours as required under PIPEDA.
No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to hello@smartstudy.ca.
Your Rights
Under PIPEDA and applicable provincial law, you have the following rights regarding your personal information and your child's information:
Right to Access
Request a copy of all personal data we hold about you or your child.
Right to Correct
Update or correct inaccurate information through your account settings.
Right to Delete
Request deletion of your account and all associated personal data.
Right to Portability
Export your child's learning data in a structured, machine-readable format.
Right to Withdraw Consent
Withdraw consent for non-essential processing such as service improvement.
Right to Complain
File a complaint with the Office of the Privacy Commissioner of Canada.
To exercise any of these rights, contact our Privacy Officer at privacy@smartstudy.ca. We will respond within 30 days. We may need to verify your identity before processing certain requests.
Office of the Privacy Commissioner
If you are unsatisfied with our response, you may file a complaint with the OPC at www.priv.gc.ca or by calling 1-800-282-1376. Residents of Quebec, Alberta, and British Columbia may also contact their provincial privacy commissioners.
CASL & Communications
All commercial electronic messages sent by SmartStudy comply with Canada's Anti-Spam Legislation (CASL). Specifically:
- We obtain express or implied consent before sending marketing messages.
- Every commercial message includes our full business name, address, and an unsubscribe mechanism.
- Unsubscribe requests are processed within 10 business days.
- Transactional messages (receipts, password resets, weekly report cards) are exempt from CASL consent requirements but can be adjusted in your notification preferences.
You may update your communication preferences at any time in your account settings or by clicking "Unsubscribe" in any email.
Policy Changes
We may update this Privacy Policy from time to time as the Service evolves or legal requirements change. When we make material changes — particularly changes that affect how we collect or use children's data — we will:
- Notify you by email at least 14 days before the changes take effect
- Post a prominent notice on the Service and website
- For changes affecting children's data specifically, require renewed parental consent where required by law
The "Effective Date" at the top of this policy indicates when it was last updated. We encourage you to review this policy periodically.
Contact & Complaints
For any privacy-related questions, requests, or concerns, please contact our Privacy Officer:
- Email: privacy@smartstudy.ca
- General enquiries: hello@smartstudy.ca
- Company: 7110961 Canada Inc., operating as SmartStudy™
- Registered office: 200 Colborne St West, Whitby, Ontario, L1N 1X2
- Country: Canada
We commit to acknowledging your inquiry within 5 business days and providing a substantive response within 30 days. If a privacy matter requires more time to investigate, we will inform you of the extended timeline and reason.
Privacy questions? Ask us anything.
We built SmartStudy as parents. We take your family's privacy as seriously as our own. No bureaucratic run-around — just honest answers.
Email our Privacy Officer