The short version
- The parent owns the Astuzo account and gives consent for their children.
- Homework photos are processed to read the homework and are never stored.
- Session text (the problems, hints and conversation) is kept for 90 days, then deleted automatically.
- Some processing happens outside Canada, with service providers in the United States and the European Union. They’re listed below, with what each one keeps.
- No ads. We don’t sell personal information. This website uses no cookies and no third-party trackers.
- You can see, correct or delete your family’s information at any time.
Who we are
Astuzo is made by TheChildrenAI (“we”, “us”), based in Ontario, Canada, which operates the Astuzo homework tutor app and this website, astuzo.ca. Our privacy officer, Hamed Nouri, is responsible for how we handle personal information and can be reached at support@astuzo.ca.
The law we follow
We handle personal information under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles: accountability, identified purposes, consent, limited collection, limited use and retention, accuracy, safeguards, openness, individual access, and the ability to challenge our compliance. Astuzo is not yet offered in Quebec. Before it is, we’ll update our practices and this policy to meet Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25.
Children’s information
Astuzo is used by children, but the account belongs to a parent or legal guardian, who must be an adult. The parent creates each child’s profile and consents to the collection and use of the child’s information described here. Children cannot create accounts, and they don’t need an email address or password. We collect only what the tutor needs to help with homework, we don’t show children ads, and we don’t use their information for marketing. If we learn that we have a child’s information without a parent’s consent, we delete it.
What we collect, and why
| Information | Why | How long we keep it |
|---|---|---|
| Parent account: email address, name if provided, sign-in method (Apple, Google or email), account settings | To create and secure the account, send parent reports, and provide support | Until the account is deleted |
| Child profile: first name or nickname, grade, and an optional avatar | To personalise the tutor and pitch hints at the right grade | Until the profile or account is deleted |
| Homework photos | To read the homework problem | Not stored. Processed and discarded. |
| Session text: the homework problems as text, the child’s answers and messages, and Spark’s replies | To run the tutoring session, write the parent report, keep children safe, and fix problems | 90 days, then deleted automatically |
| Voice: what a child says when they choose to talk instead of type | To turn speech into text for the tutor | Audio is processed to create text and not kept by Astuzo; the resulting text is session text |
| Safety records: messages flagged by our safety filters | To protect children and tell the parent about a safety concern | As long as needed to handle the concern, and no longer than the session text unless required by law |
| Subscription status (trial, active or expired) from the App Store or Google Play | To give access to the paid features | Until the account is deleted, and as required for tax and accounting records |
| Waitlist: email, and optionally your child’s grade, your province, and the page you signed up from | To tell you when Astuzo launches and send occasional launch news | Until you unsubscribe or ask us to delete it, or until launch plus 12 months |
We don’t collect payment card numbers: the App Store or Google Play handles payments.
Service providers and data processed outside Canada
We use service providers to run Astuzo, and we send each one only what it needs. Our servers and database are currently in the European Union and some providers process information in the United States, where it may be accessible to authorities under local law. We plan to move our servers and database to Canada, and we’ll update this list when we do.
| Provider and location | What it does | What it keeps, under its terms |
|---|---|---|
| Amazon Web Services, Germany (servers) and United States (email, read-aloud audio cache) | Runs our servers, sends parent reports, and caches read-aloud audio so the same sentence isn’t generated twice | Our data, as we direct. Cached audio of Spark’s messages, which can include a child’s first name (for example “Hi Noah!”) |
| Supabase, Sweden | Hosts our database: accounts, child profiles and session text | Our data, as we direct (session text is deleted after 90 days) |
| Google (Gemini API), United States | Reads homework photos and writes the tutor’s replies | Doesn’t use our prompts, photos or replies to train or improve its products. Logs them for a limited period only to detect abuse. |
| OpenAI (moderation), United States | Checks children’s messages and homework text for safety | Doesn’t train on API data; keeps no logs for the moderation service |
| Groq, United States | Turns a child’s speech into text when they choose to talk | Doesn’t keep the audio or text, except up to 30 days if needed to investigate a technical problem or abuse |
| Google Cloud Text-to-Speech, United States | Turns Spark’s messages into speech for read-aloud | Doesn’t log the text or audio |
| Apple and Google | Sign-in, subscriptions and payments (once the app is in the stores) | Under their own privacy policies |
The speech, read-aloud and moderation providers receive the text or audio they process, not your email address. Spark’s messages can include a child’s first name. We check our providers’ terms before we use them and will update this list if a provider changes.
What we don’t do
- We don’t sell or rent personal information.
- We don’t show ads in the app or use children’s information for advertising.
- We don’t let children chat with other people.
- This website doesn’t use cookies, analytics trackers or third-party scripts.
This website
astuzo.ca is a static website. It sets no cookies and loads no third-party trackers. Our hosting provider may keep standard server logs (such as IP address, page requested and browser type) for security and troubleshooting. The waitlist form sends only what you type in, plus the page you came from. If you join the waitlist, your browser remembers the first page you visited for that tab session (in session storage, not a cookie) so we know which page brought you in.
How we protect information
We use safeguards suited to the sensitivity of the information, including encryption in transit, access controls limited to the people who need it, and automatic deletion of session text after 90 days. No system is perfectly secure. If a breach creates a real risk of significant harm, we’ll notify affected families and the Office of the Privacy Commissioner of Canada as the law requires.
Your rights and choices
- Access and correction: ask for a copy of the information we hold about you or your children, and ask us to correct it.
- Deletion: delete your account in the app’s parent area, or email us. This deletes your children’s profiles and session history.
- Withdraw consent: you can withdraw consent at any time by deleting a child’s profile or your account. The tutor can’t work without it.
- Reports: turn parent report emails on or off in the parent area.
- Complaints: contact our privacy officer first. You can also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
We’ll respond to requests within 30 days.
Changes to this policy
If we make a material change, we’ll update the date above and tell account holders by email or in the app before it takes effect.
Contact
Hamed Nouri, Privacy officer, TheChildrenAI (Astuzo): support@astuzo.ca