Legal

SmartStudy Privacy Policy

Free early access for Ontario parents, legal guardians and individual educators. The pilot has not opened yet: do not submit information about a real child until SmartStudy invites you. Provider access and transfer review ongoing.

Version 1.0  ·  Effective September 26, 2026
No behavioural advertising
No sale of information
Not used to train general AI models

Version 1.0, effective September 26, 2026. Scope: free early-access service for Ontario parents/legal guardians, individual educators (independent tutors and teachers in their personal capacity), and parent-authorized K–8 learners

This Privacy Policy explains how 7110961 Canada Inc., operating as SmartStudy handles personal information in the constrained Phase 1 pilot. SmartStudy's Privacy Officer is accountable for the policy. SmartStudy is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). This policy applies to the SmartStudy web application, to SmartStudy's public website including the curriculum guide, the glossary, the waitlist and the public assistant, and to the service email and notifications SmartStudy sends.

SmartStudy's public assistant answers questions about the service. It is for adults, it does not ask for or need personal information, and users are told not to type any. SmartStudy does not use what is typed into it to build a profile of any person and does not link it to a learner record.

This policy is a notice, not blanket consent. Each adult acknowledges it during account creation and separately accepts the Service Terms. Before the first learner field, the parent/legal guardian completes the learner-data notice and authorization. An educator cannot complete that authorization.

B1. Scope and authority

Phase 1 covers verified Ontario adult parents/legal guardians, individual educators (independent tutors and teachers acting in their personal capacity), and parent-authorized K–8 learners. It includes parent-controlled educator connection (educator-initiated invitation or parent-initiated sharing), scoped named-educator access including session notes and formal progress reports, the authenticated adult Homework Decoder, the parent-only Report Card Decoder, child read-aloud, and adult-only push notifications. It does not include Quebec or other provinces, payments/subscriptions, schools, boards, tutoring companies, institutions, educator organization/staff accounts, educator-created learners, public child-data collection, image, PDF, or other document uploads outside the named decoder tools, microphone/voice input, speech-to-text, learner messages, marketing, public sharing, or diagnostic/sensitive accommodation records.

For learners who cannot provide meaningful consent themselves, SmartStudy seeks parent/legal-guardian authorization and provides age-appropriate explanations. SmartStudy considers the learner's maturity and privacy interests and will follow the counsel-approved transition process.

An educator may start a connection with a no-learner-data invitation link, or a parent may share a learner with a named educator by email; in both paths the parent reviews the connection notice, decides, and controls the scope. The educator's adult or professional status is not parent authority, and an educator can never create a learner.

B2. Information handled

Depending on use, SmartStudy handles:

  • adult name/email, profile image if supplied, identity-provider ID, parent or individual-educator role, Ontario confirmation, 18+ result, account/security state, document records, support, and rights requests;

  • learner first name/nickname/alias, grade, province/family link, interests, non-diagnostic interaction/display preferences, credential/session;

  • invitation-token identifier (opaque; no learner or parent fields); named educator, grant scope and expiry; parent authorization and connection-notice versions, status, revocation; educator session notes, formal progress reports and parent acknowledgements; learner grouping labels; and scoped activity evidence;

  • curriculum selections, questions, answers, attempts, assignments, progress/mastery estimates, rewards, reports, generated materials, and timestamps;

  • a parent- or authorized-educator-submitted worksheet photo, PDF, or typed question, grade/mode, visible completed work, extracted/redacted worksheet text, coaching/worked solution, curriculum/learner links and capture metadata; and for the Report Card Decoder, the parent-submitted report card photo or PDF and the structured explanation capture, with accommodation and similar sensitive detail omitted from output;

  • AI messages, curriculum and minimum relevant learner context, responses, safety/quality signals, and model metadata;

  • on-screen text selected for read-aloud, voice/locale, transient synthesized audio/word timing and service metadata, but no user voice;

  • in-app notification records and, if an adult enables push, a device push subscription held while enabled. Push payloads never contain a child's full name and no notification channel targets a learner;

  • minimum IP/request, device/browser, session, log, diagnostic, abuse-prevention, and security data produced while operating the service;

  • a referral code an adult creates or follows, and the record of which account shared a code and which account used it, held so SmartStudy can allocate promotional credits; and

  • for a learner's messages to the AI tutor, an automated safety category and the time it was raised, recorded as self-harm, danger, or harm by another person, without the learner's own words.

SmartStudy does not need or request exact adult or learner date of birth for Phase 1. Do not provide unrequested or highly sensitive information. SmartStudy does not knowingly collect information about a child except through a learner profile a parent or legal guardian has created and authorized. If SmartStudy finds it holds learner information without that authorization, it deletes the information.

B3. Purposes and limits

SmartStudy uses information to authenticate and secure accounts/sessions; let a parent authorize/revoke a named educator and enforce the approved scope; provide curriculum-aligned learning, AI tutoring, practice, assignments, progress/reports, and parent oversight; decode an authorized worksheet or a parent-submitted report card and prepare coaching; provide read-aloud; personalize difficulty and explanations; administer promotional credits; send necessary service messages and adult-enabled push notifications; operate support and privacy-rights processes; run the automated safety check described in B9 and alert that learner's parent where it triggers; operate the referral programme and allocate the resulting credits; investigate safety/security concerns that actually come to its attention; diagnose reliability; and maintain required legal/security/accountability records.

SmartStudy does not use learner information for behavioural advertising, sell it, disclose it to data brokers, or use identifiable account/learner content to train or fine-tune a general-purpose model. A materially new purpose requires assessment and, where required, notice and authorization before use. SmartStudy does not build an advertising or marketing profile of a learner, does not use rewards or prompts to encourage a learner to give more information than a feature needs, and does not make learner information public by default.

B4. Learner authorization, educator grants, and withdrawal

Before accepting the first learner field, SmartStudy presents a separate learner-data notice and requires an unchecked affirmative authorization from the parent/legal guardian. SmartStudy records the notice version/hash, adult identity, asserted authority, action, and server time. Learner creation and authorization evidence are linked atomically. Only a parent account can create a learner.

For an educator-initiated connection, the invitation carries only an opaque token; SmartStudy shows the parent the educator's identity and a versioned connection notice, and the parent affirms it before any grant exists. For a parent-initiated share, the parent names the educator by email and chooses the scope and expiry; a grant to a not-yet-registered educator is held pending until that educator verifies the matching account. In both paths the grant, its notice version, and its evidence are recorded; until a grant is active the educator cannot upload identifiable work or receive learner information. Grant scopes are tiered: view; view and progress (adds progress/activity/assessment and AI-tutoring content); view and assign (adds creating and assigning work).

On grant revocation, SmartStudy revokes affected educator sessions and stops new access, uploads, AI calls, assignments, and disclosures by that educator. On learner-authorization withdrawal, SmartStudy revokes affected parent/educator/learner sessions and stops new processing that depends on authorization. Existing records remain available only as allowed by the approved workflow and are deleted or de-identified under the retention process, subject to backup expiry, item-specific legal holds, security records, and minimized accountability evidence.

B5. AI and automated recommendations

SmartStudy sends the minimum context needed for an enabled AI feature to Google Cloud Vertex AI. Inputs may include a learner question, curriculum context, relevant settings, and recent conversation context. Outputs may be stored to provide the feature, progress view, safety response, or support process.

For the authenticated Homework Decoder, Vertex AI receives the submitted photo or PDF before SmartStudy can redact its contents. SmartStudy then redacts detected names, emails, and phone numbers from extracted text before later model calls and application persistence. If that automated redaction cannot be completed, the request is stopped and nothing from it is saved; the submitting adult may try again. The Report Card Decoder uses a separate, stricter extraction that saves only allowlisted fields and rejects the request without saving anything if extraction fails or a prohibited identifier is detected; its output omits accommodation, therapy, and similar sensitive details that may appear in teacher comments. The authenticated routes are designed not to persist the raw photo or PDF, but save the resulting structured capture for the submitting adult and authorized parent under the approved period.

AI can be wrong, biased, or inappropriate. It supports rather than makes final significant decisions. SmartStudy maintains counsel-approved transparency, correction/reporting, evaluation, monitoring, access, incident, and disable processes. A parent, or a learner able to ask for themselves, may ask for a plain-language explanation of the main factors behind an automated result that affects the learner, and ask for a person to review it, by writing to privacy@smartstudy.ca. This applies to the automated safety check described in B9 and to any automated check of a learner's answers that SmartStudy prepares for an adult.

B6. Providers, disclosures, and location

SmartStudy discloses the minimum necessary information to:

  • Google Cloud for application hosting, Cloud SQL, storage, network, logging, security, and related operations;

  • Firebase Authentication and the adult-selected Google, Apple, or Microsoft sign-in provider, or email link sign-in, for authentication;

  • Google Cloud Vertex AI for enabled AI features;

  • Amazon Web Services (SES, Canadian region) for authentication, security, and necessary service email;

  • the browser's push service, if an adult enables push notifications, to deliver minimized notification payloads;

  • Microsoft Azure AI Speech (Canada Central) for real-time read-aloud using a prebuilt voice, with the browser/operating-system speech service as fallback;

  • the authorized parent and learner according to access controls;

  • a named individual educator only for educator-created/assigned work, session notes and reports that educator prepares, and the progress information within an active parent grant's scope;

  • confidential professional advisers, insurers, forensic specialists, or incident responders where reasonably necessary; and

  • regulators, courts, law enforcement, child-protection authorities, or others where required or permitted by law.

Core application infrastructure is configured in Canadian regions where supported, runtime Vertex AI is configured in Montreal, service email is sent from a Canadian region, and the Azure Speech resource is provisioned in Canada Central. Authentication, browser push and speech services, network, support, telemetry, backup, or subprocessors may process information outside Canada, where local lawful-access rules apply. SmartStudy does not promise Canada-only processing. It remains accountable for provider processing and applies approved contractual, technical, and organizational safeguards. Where SmartStudy gives personal information to a provider to process on its behalf, the information stays under SmartStudy's control and the transfer is a use rather than a disclosure for that provider's own purposes. SmartStudy uses contractual and other means to give the information a comparable level of protection while it is being processed. While information is outside Canada it may be accessible to the courts, law enforcement, and national security authorities of that country.

Separately from user data: offline generation of SmartStudy's static curriculum paraphrase content used US-region AI services (Microsoft Azure OpenAI; Anthropic). Those batches processed public curriculum text and SmartStudy-authored copy only, never personal information, and those services are not connected to the running product.

The current provider/location summary and approved subprocessor/transfer information are available from the Privacy Officer on request at privacy@smartstudy.ca.

B7. Device storage and analytics

SmartStudy uses only device storage necessary for authentication, session continuity, learner access, security, feature state, and preferences in Phase 1. Optional marketing analytics, advertising storage, and attribution identifiers are disabled. Learner, legal, authorization, and rights surfaces do not use optional tracking. SmartStudy does not use advertising cookies or third-party marketing tags anywhere in the service, including on its public pages. If an adult follows a referral link, SmartStudy stores the referral code on that device so that it can allocate the credit. That storage holds only what the referral needs, is removed when the account is created or after 30 days, whichever comes first, and is never set on a learner surface.

Operational and security events are minimized. They must not add a learner field, free text, persistent marketing identifier, or provider outside the approved inventory.

B8. Safeguards and breaches

SmartStudy applies safeguards appropriate to child information, including authenticated sessions, role-based access, encryption in transit, managed cloud controls, environment/child-data release gates, logging, change review, incident processes, and accountable privacy/security roles.

No system is completely secure. SmartStudy assesses every breach of security safeguards. Where a breach creates a real risk of significant harm, SmartStudy reports it to the Privacy Commissioner of Canada and notifies the affected individual and, for a learner, that learner's parent, as soon as feasible. SmartStudy keeps a record of every breach of security safeguards for at least 24 months, whether or not it meets the reporting threshold.

B9. Safety and unlawful content

SmartStudy is not an emergency, crisis, medical, therapy, or child-protection service. Monitoring is not continuous and no control detects every concern.

SmartStudy applies an automated check to the messages a learner sends to the AI tutor. The check looks for words and phrases suggesting self-harm, danger, or harm by another person. Where it triggers, SmartStudy records the category and the time only, never the learner's words, and alerts that learner's parent that a check-in is needed without quoting the learner. No SmartStudy staff member receives or reviews these alerts and there is no screen on which they appear. Where the check suggests harm by another person, the AI tutor's reply also points the learner to a trusted adult and to a children's help line, so that the learner has a route that does not depend on the parent alert.

The check is a safety feature and is not a monitoring, counselling, or child-protection service. If a person at SmartStudy does become aware of information suggesting that a child may need protection, SmartStudy follows the runbook, which requires a direct report to a children's aid society and does not treat an alert to the parent as discharging that duty.

If a serious safety, security, child-protection, or suspected unlawful-content concern actually comes to SmartStudy's attention, it may restrict access, preserve a narrowly necessary record, or disclose information where required or permitted by law. A counsel-approved runbook governs staff access, escalation, reporting, parent-notification exceptions, preservation, confidentiality, and deletion exceptions. Where the law requires it, SmartStudy reports suspected child sexual abuse or exploitation material and makes a child protection report. SmartStudy does not tell the person concerned where telling them is prohibited by law or would interfere with an investigation.

B10. Retention and deletion

SmartStudy keeps personal information only as long as reasonably necessary for the stated purpose and approved legal/security/accountability records. The current Phase 1 schedule is:

  • adult account: active plus ≤24 months after closure;

  • incomplete educator invitation token: short operational expiry (≤14 days), with no learner/parent fields;

  • named-educator grant/evidence: active relationship plus the approved minimized accountability period;

  • identified learner profile and activity: active use plus 12 months of inactivity, then anonymize with family and adult linkage severed, or delete, with an email to the parent 30 days before that step;

  • AI conversation content: up to 6 months for a learner, and up to 12 months for an adult;

  • automated safety category: up to 12 months, holding the category and the time only;

  • referral code and the record linking a referring and a referred account: up to 12 months after the credit is allocated;

  • Decoder / Report-Card raw photo or PDF and read-aloud text/audio: request/playback only; no intentional application persistence;

  • Decoder / Report-Card structured capture: ≤90 days or earlier parent deletion;

  • educator session notes and formal reports: within the learner schedule; educator access ends at revocation;

  • push subscription: while enabled; deleted on disable or account closure;

  • support: ≤24 months;

  • security/audit logs: ≤24 months;

  • consent/authority/document evidence: six years after closure/withdrawal, minimized outside the learner-content cascade;

  • incident/breach records: ≥24 months after a PIPEDA breach determination; longer only for applicable law/item-specific hold; and

  • backups: rolling expiry; deleted records must not return to active processing after restore.

SmartStudy publishes only periods that are implemented and evidenced. An item-specific authorized legal/safety hold is logged, reviewed, limited, and expires.

B11. Access, correction, deletion, and complaints

Subject to law and proportionate identity/authority verification, an adult or capable learner may ask SmartStudy to explain whether it holds their information and how it is used/disclosed; provide access; correct inaccuracies; withdraw consent; delete/de-identify information no longer required; or address a complaint. A parent's rights over learner information extend to educator session notes and reports about that learner, subject to any counsel-approved exception. SmartStudy responds within 30 days of receiving a request, and tells the requester if it needs the extension the law allows and why. There is no charge unless SmartStudy tells the requester the cost in advance and the requester agrees to it. Where SmartStudy refuses all or part of a request, it gives written reasons and explains how to complain.

SmartStudy applies the counsel-approved process where parent and learner interests conflict or authority is disputed. It does not assume parent control is permanent in every circumstance.

Contact:

Privacy Officer, 7110961 Canada Inc., operating as SmartStudy; 200 Colborne St West, Whitby, Ontario L1N 1X2, Canada

privacy@smartstudy.ca

If dissatisfied with SmartStudy's response, a person may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376.

B12. Service messages, changes, and accessibility

SmartStudy may send messages necessary to authenticate, secure, administer, or provide the requested account and educator grants, including the invitation email a parent initiates to connect a named educator. Adults may enable or disable optional push notifications at any time. Phase 1 sends no direct learner messages and no sales messages to educator-referred parents. Where an adult has asked for product updates, for example by selecting that option on the waitlist, SmartStudy sends them only to that address, identifies itself in each message, and includes a working unsubscribe link. SmartStudy keeps a record of that request and of any withdrawal of it. SmartStudy does not send referral invitations. An adult who chooses to share a referral code sends it themselves, through their own email or messaging service.

A material policy change receives appropriate notice and a new version. The app may require acknowledgement before continued use. A material change to learner-data purposes, categories, providers/recipients, risk, or other practices may require renewed authorization before processing. SmartStudy tells adults about a material change to this policy by email or in the app before the change takes effect.

Contact SmartStudy for an alternate accessible format or support interaction as required by law.