Privacy Policy

1. Introduction

Nova Academy ("we," "our," or "us"), a service of IAMP Holdings LLC, operates the educational platform at learnnova.ai ("the Service"). We are committed to protecting the privacy of children and families who use our Service.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and how we protect it. It applies to all users of the Service, including parents, guardians, and children.

We comply with the Children's Online Privacy Protection Act (COPPA) and are committed to protecting children's privacy online.

2. Information We Collect

Information from Parents and Guardians

• Email address and name — collected automatically when you sign in with Google
• WhatsApp phone number — optional, provided if you choose to receive lesson notifications via WhatsApp
• Payment information — payment processing is handled entirely by Stripe. We do not receive or store your credit card number, expiration date, or CVC. We only store your subscription plan and status.

Information about Children

Children never interact with the Service unsupervised during account setup. All child profile information is entered by a parent or guardian:

• First name — used to personalize the learning experience
• Grade level — used to select age-appropriate content
• Avatar emoji — a decorative selection, not a photograph

As children use the Service, we automatically collect the following learning data:

• Responses to math activities and problems
• Time spent on activities
• Progress and achievement data (badges earned, skills mastered)
• Placement diagnostic results
• AI-generated hints and feedback shown to the child

Automatic Technical Information

• Session cookie — an HttpOnly JWT cookie with a 30-day expiration, used to keep you signed in
• localStorage — stores your selected child ID and text-to-speech mute preference (no personal information)
• sessionStorage — stores in-progress lesson state, automatically cleared when the browser tab is closed

We do not use advertising cookies, tracking pixels, or third-party analytics tools that track users across websites.

3. How We Use Information

We use the information we collect to:

• Personalize the learning experience for each child based on their grade level and responses
• Provide AI-powered tutoring, hints, and feedback during lessons
• Track progress and generate achievement badges
• Send lesson-completion notifications to parents (via email or WhatsApp, based on your preferences)
• Process subscription payments through Stripe
• Improve our curriculum, AI models, and Service quality

4. Third-Party Services

We use the following third-party services. Each receives only the minimum data necessary to perform its function:

We do not sell, rent, or trade personal information to any third party. These services are used solely to operate and improve the Service.

5. Children's Privacy (COPPA Compliance)

Nova Academy is designed for children in grades K–5 (typically ages 5–11). We take COPPA compliance seriously and have implemented the following safeguards:

• Parental consent is required. Only parents or guardians can create accounts. Account creation requires Google Sign-In, which serves as verifiable parental consent. Children cannot create accounts or sign in on their own.
• Parents enter all child information. Children never provide personal information directly. A parent or guardian enters the child's first name, grade level, and avatar emoji during profile setup.
• Minimum necessary data collection. We collect only the information needed to provide personalized math instruction.
• No behavioral advertising. We do not display ads of any kind. Children's data is never used for advertising or marketing purposes.
• No third-party marketing. We never sell, share, or disclose children's personal information to third parties for their marketing or promotional purposes.
• No social features. The Service does not include chat, messaging, forums, public profiles, or any feature that allows children to communicate with other users.
• Parental access and control. Parents can review their child's information, request corrections, delete child profiles, and refuse further collection at any time (see Section 6 below).

6. Parental Rights & Controls

As a parent or guardian, you have the right to:

• Access — View all information we have collected about your child, including learning data and progress
• Modify — Update your child's name, grade level, or avatar at any time through the Manage Children settings
• Delete — Remove a child's profile and all associated learning data through the Manage Children settings, or by contacting us
• Refuse further collection — Request that we stop collecting data from your child while maintaining access to existing data
• Manage notifications — Enable, disable, or change your email and WhatsApp notification preferences at any time
• Delete your entire account — Request complete account deletion, including all parent and child data, by emailing us at [email protected]

We will respond to all parental requests within 30 days.

7. Data Security

We implement appropriate technical and organizational measures to protect personal information:

• All data is transmitted over HTTPS (TLS encryption)
• The Service is hosted on secure cloud infrastructure (Railway)
• Authentication tokens are stored in HttpOnly cookies, preventing access from client-side JavaScript
• No personally identifiable information is stored in client-side storage (localStorage or sessionStorage)
• Database access is restricted to application-level credentials and not exposed publicly

While no method of transmission or storage is 100% secure, we take reasonable precautions to protect the information entrusted to us.

8. Data Retention

We retain account and learning data for as long as your account is active. If you delete a child's profile, their learning data is permanently removed. If you request full account deletion, all data associated with your account — including all child profiles, learning data, and parent information — is permanently deleted.

To request account deletion, email us at [email protected] from the email address associated with your account. We will process deletion requests within 30 days.

9. Your Rights

You have the right to:

• Access the personal information we hold about you and your children
• Correct inaccurate information
• Delete your account and all associated data
• Opt out of non-essential communications (WhatsApp and email notifications)

To exercise any of these rights, contact us at [email protected].

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes — especially changes that affect how we collect, use, or share children's information — we will notify you by email before the changes take effect. We will also update the "Last updated" date at the top of this page.

Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy, our data practices, or your child's information, please contact us:

Nova Academy (IAMP Holdings LLC)

Email: [email protected]