Draft notice — pending legal review. Placeholders marked [TODO] will be completed before launch.
Privacy Notice
How Wynna handles your information and your child’s. There is also a kid-friendly version.
Wynna is set up by you, the parent
Wynna is used by children but set up and controlled by a parent or guardian. You create the account; your child has no login or account of their own and uses a profile under your account. By creating a child profile and uploading material, you provide consent on your child’s behalf for the limited processing described here.
What we collect
- About you: your email address; and, if you sign in with Google, your name and profile picture from Google.
- About your child: a display name you choose (a nickname is fine and encouraged), an optional year group, an avatar colour, their progress, and any answers or drafts they write while practising.
- Material you upload: notes or photos of homework. Photos are sent to our AI provider to build practice and are not stored on our servers.
We do not collect your child’s email, phone number, location, or any special-category data. Please don’t upload material that reveals it.
Why, and our legal basis
- Running your account — performance of a contract with you.
- Generating practice, hints, grading and feedback for your child, and showing you progress — [TODO: parental consent, to be confirmed with counsel].
- Keeping the service secure — our legitimate interests.
Who we share it with
We use these providers and share only what each needs:
- OpenAI (USA) — generates practice, hints, grading and feedback. Receives your uploaded notes/photos, your child’s answers and writing, year group, and (for parent coaching) your child’s display name and progress signals. Configured so OpenAI does not retain this content or use it to train its models.
- Neon — database hosting.
- Vercel — app hosting.
- Google — optional sign-in.
- Resend — sends your sign-in emails.
We do not sell your or your child’s data and do not use it for targeted advertising. International transfers rely on [TODO: Data Privacy Framework / Standard Contractual Clauses].
How long we keep it
- Uploaded photos — not stored; used in the moment and discarded.
- Child profile, progress and writing — while active; deleted after [TODO: 24 months] of inactivity.
- Your account — until you close it; deleted within [TODO: 30 days] of closure.
Your rights
You can access, correct, export or delete your child’s data, delete your whole account, or withdraw consent at any time from your family page. Deleting a child profile permanently erases their progress and writing. You can complain to the ICO (ico.org.uk) in the UK or your local supervisory authority in the EU.
Children’s privacy by design
Wynna follows the UK Children’s Code: high-privacy defaults, minimal collection, geolocation off, and no nudge techniques to extract data.
Contact: [TODO: privacy@yourdomain]. Data controller: [TODO: legal entity + address]. Last updated: [TODO: date].