MAPLEMIND PRIVACY POLICY
Version 4.1 | Effective Date: July 12, 2026
1. WHO WE ARE
MapleMind ("MapleMind", "we", "us", "our") is operated by MapleMind Technologies Inc., a corporation based in Red Deer, Alberta, Canada. We are the data controller for the personal information processed through the MapleMind mobile app and related web services (the "Service") — an AI-powered tutor aligned to Canadian curricula.
• Privacy Officer / contact:
[email protected]
• Support:
[email protected]
2. WHO THE SERVICE IS FOR, AND HOW ACCOUNTS WORK
MapleMind is intended for K-12 learners and their parents/guardians. Because children's privacy matters, a parent or legal guardian is the account holder for any user below the age of digital consent in their region (13 in the US, Canada, and UK; 16 in the EU/EEA and elsewhere). During sign-up we ask for a birthdate (a neutral age screen); if the user is below that age, the parent must create and verify the account and provide verifiable parental consent before the child can use the AI features.
3. THE PERSONAL INFORMATION WE COLLECT
• Account information: email address; your name and the student's display name (a nickname is fine); a securely hashed password (for email accounts); province and grade; subscription status.
• Learning content: the questions and messages the student sends to the tutor, the tutor's responses, and any images the student uploads (e.g., a photo of a homework problem or written work). Learning progress (streaks, completed topics, activity history).
• Parental-consent information: for child accounts — the guardian's name and email, the consent given, and a record of it (date, version, IP address, and user agent for audit). Parent identity verification is performed by our verification provider, SuperAwesome KWS (Kids Web Services) (see §6); KWS handles and deletes the sensitive verification data (e.g., a nominal payment-card check or ID verification) — we receive only a pass/fail result, not the card, ID, or face-scan data.
• Technical information: IP address, device/user-agent, and similar metadata used for security, fraud prevention, and operating the Service.
• Subscription information: MapleMind offers a free tier and an optional paid subscription. For purchases made in the iOS or Android app, we process purchase records and an app-specific identifier through Apple/Google and RevenueCat. For purchases made on the web, payment is processed by Stripe, Inc.; Stripe collects and processes your payment card details (we never receive your full card number) and we store only a Stripe customer reference, subscription reference, plan, and billing status.
We practise data minimisation — we collect only what we need to provide the Service, and we do not request precise location, contacts, or unnecessary identifiers.
4. HOW WE USE YOUR INFORMATION, AND OUR LEGAL BASES
• Provide the AI tutoring (process questions/images to generate responses; track progress) — the core Service you signed up for. Legal basis (GDPR): Contract (Art. 6(1)(b)).
• Optional personalisation (adapt teaching to the student's needs) — off by default; only if you opt in. Legal basis: Consent (Art. 6(1)(a)), parent-authorised under Art. 8.
• Security, fraud prevention, abuse/safety monitoring — keep the Service and children safe. Legal basis: Legitimate interests (Art. 6(1)(f)), weighted to the child's interests.
• Keep parental-consent and acceptance records — prove lawful consent. Legal basis: Legal obligation / compliance.
• Send transactional emails (verification, consent, data export, important notices) — operate your account. Legal basis: Contract.
For users in Canada (PIPEDA) and the US (COPPA + state laws), we rely on verifiable parental consent for child accounts and process data consistent with those laws. We do not sell personal information, and we do not show children targeted advertising.
5. PERSONALISATION (OPTIONAL, OFF BY DEFAULT)
If you turn it on, MapleMind may create and store notes about how the student learns (e.g., topics they find difficult) and use those notes to tailor that student's tutoring (the notes are added to that student's own tutoring prompts). These notes are used only for the student's own learning — never to train AI models, for advertising, or any other purpose. Personalisation is off by default, and you can turn it off or delete the notes at any time.
6. AI PROCESSING AND OUR AI PROVIDER (OPENAI)
To generate tutoring responses, we send the student's questions, learning context (display name/nickname, grade, province, subject), and any uploaded images to our AI provider, OpenAI, which processes them solely to return a response. This processing is necessary to provide the Service.
• OpenAI acts as our processor under a signed Data Processing Agreement.
• OpenAI does not use your content to train its own models.
• It is never sold or used for advertising.
• OpenAI retains API data only briefly (up to ~30 days for abuse monitoring) and we have disabled additional logging.
• Transfers to OpenAI in the United States are covered by Standard Contractual Clauses in the DPA.
We do not train AI models on your content, and we never sell it or use it for advertising. (For optional, controllable personalisation that keeps notes to tailor a student's own lessons, see §5.)
You are interacting with an AI system, and tutoring responses are AI-generated. MapleMind does not make solely-automated decisions that produce legal or similarly significant effects about you (GDPR Art. 22; Québec Law 25) — the AI assists learning and does not determine access to education, grades, or any binding outcome.
7. PARENTAL CONSENT AND CHILDREN'S PRIVACY
For child accounts, before any AI feature is enabled:
1. The parent/guardian creates and verifies the account (email verification).
2. The parent's identity/age is verified by SuperAwesome KWS (verifiable parental consent).
3. The parent reviews a clear notice — including that data is sent to OpenAI to run the tutor — and agrees. (Because that disclosure is essential to the Service, declining it means the AI features can't be used.)
4. The parent receives a welcome email summarising what they consented to and how to access, monitor, export, or delete the student's data and withdraw consent.
Parents can at any time review, export, or delete the student's information, withdraw consent (which turns off the AI features), and contact our Privacy Officer with questions.
For parents (COPPA and similar laws): We collect from a child only the information described in §3, and we do not condition the child's participation on disclosing more personal information than is reasonably necessary. At any time you may review the information collected from your child, refuse to permit its further collection or use, and request its deletion. If we learn that a child below their region's age of consent is using the Service without verified parental consent, we will suspend the account and delete the data. A short, child-friendly version of this notice is available at /legal/kids-privacy.
8. WHO WE SHARE INFORMATION WITH (SUB-PROCESSORS)
We share personal data only with a small set of trusted service providers ("sub-processors") that process it on our behalf, under contract, and only to deliver the Service. The current list — including each provider's purpose and location — is at /legal/subprocessors. We do not sell personal information. Apple and Google act as independent controllers for app distribution and payments.
8a. COOKIES AND LOCAL STORAGE
We use only essential local storage — for example, to keep you signed in and remember your settings. We do not currently use third-party analytics or advertising cookies, and we do not track you across other apps or websites. If we add analytics in the future, we will update this policy and obtain consent where required (e.g., in the EEA/UK).
9. INTERNATIONAL DATA TRANSFERS
We operate from Canada and use service providers primarily in the United States. Where we transfer the personal data of individuals in the EEA/UK, we rely on appropriate safeguards (e.g., Standard Contractual Clauses) with our providers.
10. HOW LONG WE KEEP INFORMATION
We keep personal data only as long as needed to provide the Service or as required by law:
• Account, learning content & progress: until you delete your account, or after 24 months of inactivity (whichever comes first).
• Email verification codes: 15 minutes (single-use).
• Unverified sign-ups: deleted after 7 days.
• Parental-consent and acceptance records: retained 24 months after account deletion (then deleted; guardian details are pseudonymised on deletion) to evidence lawful consent.
• Safety/abuse reports: 24 months.
When you delete your account, your data is removed within 30 days (consent records are retained as above).
11. YOUR RIGHTS AND CHOICES
Depending on your region, you have rights to: access your data, receive a portable copy, correct it, delete it, withdraw consent, object to or restrict certain processing, and not be subject to unfair automated decisions. You can:
• Export your data in the app: Settings → Account → Export My Data (we email you a machine-readable copy).
• Delete your account in the app: Settings → Account → Delete Account, or via /legal/delete-account.
• Exercise any other right by contacting
[email protected]. We respond within the timeframe required by law (generally 30 days).
For child accounts, the parent/guardian exercises these rights on the student's behalf.
Québec residents (Law 25): you may also request de-indexation of certain information, portability of your data, and to object to decisions based solely on automated processing. We report confidentiality incidents to the Commission d'accès à l'information (CAI) and to affected individuals as required.
You may also lodge a complaint with your data-protection authority — e.g., the Office of the Privacy Commissioner of Canada (priv.gc.ca); in Québec, the Commission d'accès à l'information (cai.gouv.qc.ca); the UK ICO (ico.org.uk); your EU member-state authority; or your U.S. state Attorney General.
11a. U.S. STATE PRIVACY RIGHTS
If you are a U.S. resident (e.g., California, Colorado, Connecticut, Virginia, and other states with privacy laws), you have rights to know/access, correct, delete, and obtain a portable copy of your personal information, and to opt out of its sale, sharing, or use for targeted advertising.
• We do not sell or share your personal information, and we do not use it for targeted or cross-context behavioural advertising.
• We honour opt-out preference signals such as Global Privacy Control (GPC), where applicable.
• Categories of personal information we collect: identifiers (email, name/nickname); internet/activity data (questions, learning content, uploaded images); commercial information (subscription records); coarse location (province/country); and inferences used only for optional personalisation. We do not collect sensitive personal information in order to infer sensitive characteristics.
• We retain each category as described in §10 and disclose it only to the service providers in our Sub-processor list (/legal/subprocessors), to provide the Service.
• To exercise a right, contact
[email protected]; we will not discriminate against you for exercising it. For child accounts, the parent/guardian exercises these rights.
12. SECURITY
We protect personal data with measures including encryption in transit, hashed passwords and verification codes, access controls, rate limiting, and restricted internal access. No system is perfectly secure, but we work to safeguard your information and to notify you and regulators of any breach as required by law.
13. CHANGES TO THIS POLICY
We may update this policy. If we make a material change, we will update the effective date, post the new version, and — where required — notify you and/or seek renewed consent. Each parental consent is recorded against the policy version in force at the time. Previous versions are available on request at
[email protected].
This policy is available in English and French; the French version is provided to Québec users as required by the Charter of the French Language.
14. CONTACT
• Privacy Officer:
[email protected]
• Mail: MapleMind Technologies Inc., Red Deer, Alberta, Canada