Legal, draft
Privacy Policy
How ayyayo Inc. collects, uses and protects personal data across the website and the app.
Effective date: [date]. This policy covers ayyayo.ai, app.ayyayo.ai and published creations on ayyayo.ai subdomains (together, the “Services”). It is written to meet India's Digital Personal Data Protection Act, 2023 and its Rules (“DPDP”), the US Children's Online Privacy Protection Act (“COPPA”), and the EU and UK General Data Protection Regulations (“GDPR”). If you are a parent, please also read the Children's Privacy Notice.
1. Who we are
ayyayo Inc., a Delaware corporation, [registered address], is the data controller (the “data fiduciary” under DPDP). Contact: [privacy contact email]. [EU representative under GDPR Article 27, if required]. [UK representative, if required]. [grievance contact for India under DPDP].
2. What we collect
From parents and schools on the website
- Pilot waitlist: your name (optional), email, country, your child's age and language, and your consent choices with the time you gave them.
- School pilot requests: school name, your name and role, work email, city, country, classes, your message, and your consent choices.
From children in the app
- A profile: nickname, age (9 to 13) and language.
- Lesson answers as text: requests, predictions, corrections, the mastery-check answer and the rule sentence.
- Creations the child keeps, and whether they are published.
- Sign-in details for the account. [who holds the account email during the pilot]
Collected automatically
- Technical data needed to run the Services, such as IP address, used for security and rate limits.
- Sign-in cookies in the app. See the Cookie Policy.
What we do not collect
- We do not store recordings of anyone's voice. Audio is streamed to the voice model during a session and is not saved by ayyayo.
- We do not ask children for real names, schools, addresses or phone numbers.
- We do not use advertising or analytics trackers.
3. Why we use it, and on what basis
- To provide lessons and show progress: with verifiable parental consent for children (DPDP, COPPA, GDPR Article 8), and as necessary to provide the service a parent asked for.
- To answer waitlist and pilot requests: with your consent.
- To keep the Services secure and prevent abuse: our legitimate interests, and legal obligations.
- To measure whether lessons work, using lesson counts and answers: [legal basis and whether data is de-identified first].
We do not sell personal data. We do not track children, monitor their behaviour for advertising, or show them targeted advertising. We do not use children's data to train AI models. [confirm each provider's no-training terms as configured]
4. Who we share it with
Only the service providers that run ayyayo, each bound by contract to process data for us:
| Provider | What it does for ayyayo | Data it handles | Location and retention |
|---|---|---|---|
| Google Cloud (Vertex AI, Gemini Live) | The voice conversation | Live audio while a child talks, lesson text sent to the voice | [region and retention as configured] |
| Cerebras | Building creations; checking lesson answers; translating app text | What the child asked for, lesson answers as text | [region and retention] |
| Microsoft Azure AI Foundry | Replies from talking characters in published creations | Messages typed into a published creation | [region and retention] |
| Supabase | Accounts, database and file storage | Sign-in details, child profile, lesson answers, creations, form submissions | [region and retention] |
| Vercel | Hosting the website and app | Technical request data such as IP address | [region and retention] |
We may disclose data if the law requires it. If ayyayo Inc. is involved in a merger or sale, data would move only under terms that keep these protections. [confirm]
5. International transfers
Our providers may process data outside your country, including in the United States. For EU and UK data we rely on [transfer mechanism, for example Standard Contractual Clauses].
6. How long we keep it
Child profiles, lesson answers and creations: [retention period]. Waitlist and pilot requests: [retention period]. When a parent asks us to delete a child's data, we delete it within [period].
7. Your rights
Depending on where you live, you may ask to access, correct, delete or port your data, withdraw consent, object to or restrict processing, and nominate someone to act for you (DPDP). Parents can exercise these rights for their child. Write to [privacy contact email]. We reply within [response time]. You may complain to your data protection authority, including the Data Protection Board of India, an EU supervisory authority, or the UK Information Commissioner's Office.
8. Security
Data is sent over encrypted connections. Our database rejects reads with the public key; only our server can read or write it. [further security measures]
9. Changes
We will post changes here with a new effective date, and email parents about material changes.