Privacy Policy

This Privacy Policy explains how Inskillz (“Inskillz”, “we”, “us”) collects, uses, stores, and shares information when a Parent buys, manages, or uses our AI-literacy Course for children aged 7–12, and when a Child uses Child Mode.

Contact: support@inskillz.com

Effective with version 1.0.0. We may update this Policy from time to time (see Changes below).

Who we are

The Inskillz service is provided by **Inskillz OÜ**, a company registered in Estonia (European Union). Inskillz OÜ is the controller of Parent account data and of Child Profile data processed for the Course, unless we clearly tell you that another group company is responsible for a specific processing activity.

We may later involve a Finnish group company once it is formed. Until we publish that change, Inskillz OÜ remains the contracting party and controller described in this Policy.

Inskillz may be offered to Parents in multiple regions, including the Middle East, Europe, and other markets we choose to serve (for example parts of Asia or the United States). Availability, currency, and local consumer protections can vary by region.

For formal privacy requests, email support@inskillz.com. On request we will provide our current registered address and company registry details.

Who this Policy covers

- Parents (or legal guardians) who create an account, buy an Enrollment, give consent, or contact us. - Children who use Child Mode only through a Join Code provided by their Parent. Children do not create accounts and should not send us personal contact details.

Information we collect

We aim to collect the minimum needed to run and improve the Course and meet legal duties.

Parent information may include:

- Email address and sign-in verification status - Account and session identifiers - Purchase and Enrollment records (amount, currency, status, timestamps, payment-provider references) - Support messages you send us - Limited technical data needed for security, reliability, and presentment (for example IP address, user agent, approximate request country used to show a price)

Child Profile information is deliberately limited:

- Age band (for example 7–9 or 10–12) - Optional nickname - Learning progress, completion state, and learning-outcome signals for the Course, Modules, Activities, and Project (for example what was started, finished, or revisited — not a Child’s free-text “wrong answers” as a permanent score record) - Join Code state (issued, rotated, or revoked) - Consent and Deletion Request records linked to that Child Profile

We do not require a Child’s full legal name, date of birth, school, email, phone number, photograph, or precise location for the Course.

Payment card details are handled by our payment processor. We do not store full card numbers on Inskillz systems. We may store limited payment metadata (for example last4, brand, or provider references) needed for support, refunds, and records.

How we use information

We use information to:

- Create and secure Parent accounts (passwordless email sign-in) - Take payment, create Enrollments, and provide Course access across the markets we serve - Let a Parent set up a Child Profile and issue a Join Code - Operate Child Mode and record progress so the Parent can see course outcomes - Adapt pacing, difficulty, hints, content order, or recommendations inside the Course so the experience better fits that Child’s learning progress (a tailored learning experience) - Improve Inskillz over time using learning and product signals (including in aggregated or de-identified form where practical) - Record and evidence parental consent, withdrawals, and re-grants - Process refunds, support requests, Deletion Requests, and account administration - Maintain security, prevent fraud or abuse, debug incidents, and meet legal obligations - Understand product funnel performance with privacy-conscious analytics (for example purchase, start, module, completion, and feedback events)

We do not sell personal information. We do not use Child Profile data for behavioural advertising. We do not send marketing emails to Children.

We may send Parents transactional messages (sign-in, purchase, access, completion, consent or policy notices, support replies). Occasional product updates may be sent to Parents; you can ask us to stop non-essential messages by contacting support.

Legal bases

Depending on the activity and where you are, we rely on one or more of:

- Parental consent for Child Profile processing needed for Child Mode, Parent-visible outcomes, and in-Course tailoring based on that Child’s learning progress - Performance of a contract with the Parent (account, Enrollment, payment, Course delivery, support) - Compliance with legal obligations (for example tax, accounting, responding to lawful requests) - Legitimate interests in securing the service, preventing abuse, measuring reliability, and improving the product in ways that do not require unnecessary Child identifiers — balanced against Parent and Child rights

Where EU/EEA (and similar) rules apply, parental consent is our primary basis for Child Profile learning data used in Child Mode and personalisation. Child Mode stays locked until child-data processing consent is granted, and locks again if that consent is withdrawn.

Mandatory local laws (including UAE personal-data and child digital-safety rules where they apply, and GDPR/local EU rules where they apply) may give Parents additional rights. Nothing in this Policy limits non-waivable rights.

Hosting and international transfers

Application hosting and our primary database are operated in the Frankfurt region (Germany, European Union).

If you access Inskillz from outside the EU/EEA (for example from the UAE, elsewhere in the Middle East, Asia, or the United States), your information is transferred to the EU for hosting and processing. We do this because it is necessary to provide the contracted Course with our current infrastructure, and we use providers under written terms that include appropriate data-protection obligations.

Transfers from the EU/EEA to other countries may occur when we use processors or support tools that operate partly outside the EU/EEA. Where required, we use appropriate safeguards (for example standard contractual clauses or equivalent mechanisms).

If residency or transfer rules that apply to us change, we may relocate or reconfigure infrastructure and will update this Policy as needed.

Who we share information with

We share information only as needed to run Inskillz, including with:

- Hosting and database providers - Payment processors (card payments, refunds, fraud checks) - Email delivery providers (sign-in codes/links and transactional mail) - Operators acting for Inskillz in our Back Office, under access controls - Professional advisers or authorities when required by law or to protect rights, safety, or the service - A future Finnish group company, if and when it is formed and involved in operating the service (we will update this Policy if that changes responsibilities)

Processors act on our instructions. We do not authorise them to use Parent or Child Profile data for their own marketing.

Cookies and similar technologies

We use cookies and similar technologies that are needed to:

- Keep a Parent signed in on the Parent host - Keep a short-lived Child Mode session on the play host - Prefer security and host separation (Parent, Child, and Operator sessions are not shared across hosts)

We may also use a limited visitor or analytics identifier to measure funnel performance. We do not use this to build advertising profiles of Children.

Consent, withdrawal, and deletion

Terms acceptance at purchase is a contract term. It is not withdrawn as “consent”; ending the commercial relationship follows refund, support, or deletion paths instead.

Child-data processing consent is separate, Child-Profile-scoped, and withdrawable at any time from the Parent Dashboard. Withdrawal:

- Takes effect for future Child Mode processing and in-Course tailoring that depends on that consent - Locks Child Mode - Does not by itself delete the Child Profile, progress, or Enrollment - Can be re-granted later without buying again (while the Enrollment remains valid)

A Parent may request deletion of a Child Profile and related learning progress from the Parent Dashboard. Deletion Requests open a 7-day cooling-off period during which the Parent may cancel. After cooling-off, deletion can be completed as described in-product.

We may retain information we still need after deletion or withdrawal, including:

- Payment, refund, and accounting records - Consent Records (with Child Profile identifiers removed where deletion applies) so we can prove past consent for processing already performed - Security, fraud, and dispute records for a reasonable period - Aggregated or de-identified analytics that no longer identify a Parent or Child Profile

Parent choices and requests

Subject to applicable law and the nature of the request, Parents may:

- Access or correct Parent account information - Withdraw child-data processing consent - Request Child Profile deletion (with cooling-off) - Object to or restrict certain processing where the law provides that right - Ask questions about this Policy

Email support@inskillz.com or use in-product privacy controls. We may need to verify that we are dealing with the account Parent before acting. EU/EEA Parents may also have the right to lodge a complaint with their local supervisory authority; Estonian supervision is coordinated through the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) for our Estonian controller.

Security

We use technical and organisational measures appropriate to a paid children’s learning service, including encrypted transport, host-only sessions, owner-scoped access to Parent data, and separation of Child Mode from Parent identity.

No online service is perfectly secure. Please protect access to the Parent email inbox and do not share Join Codes beyond your household’s intended use.

Children’s privacy

Inskillz is designed for Children aged 7–12 under Parent supervision. We rely on the Parent (or legal guardian) to:

- Confirm they have authority to consent for the Child under the laws that apply to you - Provide only the minimal Child Profile details requested - Control Join Code access

If we learn we have collected Child contact details or other data we did not intend to hold, we will delete or minimise it where practicable.

Changes to this Policy

We may change this Policy to reflect product, legal, market, or group-structure updates. The version identifier in the document frontmatter is authoritative.

When a change requires fresh child-data related confirmation under our product rules, we will ask affected Parents to reconfirm and may provide a grace period before Child Mode is locked for non-confirmation. Continued use after notice, where reconfirmation is not required, constitutes acceptance of the updated Policy for Parent-contract purposes.

Contact

Privacy and Parent rights requests: support@inskillz.com

Controller: Inskillz OÜ (Estonia)