AIPlayBase Privacy Policy

DRAFT — NOT FOR PUBLICATION. Prepared as a working draft. It must be reviewed and approved by a licensed US attorney with children's privacy (COPPA) experience before it is published or relied on. Nothing in this draft is a statement that AIPlayBase complies with any law or holds any certification. Bracketed items [LIKE THIS] are placeholders to be filled in.

Effective date: [EFFECTIVE DATE] Last updated: [LAST UPDATED DATE]

This Privacy Policy explains how [LEGAL ENTITY NAME], a [STATE] [ENTITY TYPE] ("AIPlayBase," "we," "us," or "our"), collects, uses, shares, and protects information when families use aiplaybase.com and its age-based experiences, including AIPlayBase Tots, AIPlayBase Kids, AIPlayBase Teens, and AIPlayBase Adults (together, the "Service").

AIPlayBase is a family learning platform. Accounts are opened by parents or legal guardians. Children use the Service only through a profile that their parent creates and controls. Section 4 ("Children's Privacy") explains our practices for children under 13 and the rights parents have under the Children's Online Privacy Protection Act ("COPPA").

1. Who we are and how to contact us

• Operator: [LEGAL ENTITY NAME]
• Postal address: [POSTAL ADDRESS]
• Email: privacy@aiplaybase.com
• Phone: [PHONE]

Parents may contact us at any time to ask questions about this policy or about the information we have collected from their child.

2. Information we collect

2.1 From parents and adult users (18+)

• Account information: name, email address, password (if you do not use single sign-on), language preference, and country/state.
• Single sign-on (SSO) information: if you sign in with Google, Apple, Microsoft, LinkedIn, or Facebook, we receive the information you authorize that provider to share, typically your name, email address, and a provider account ID. We do not receive your password for that provider. We do not use SSO to obtain your contacts, friends list, or posts.
• Family information: the co-parent you invite (name and email) and the child profiles you create.
• Payment information: subscription plan, billing status, and the last four digits and brand of your card. Payment card numbers are collected and processed by our payment processor, [PAYMENT PROCESSOR — currently planned: Stripe], and are not stored on our servers.
• Communications: messages you send to support and your email preferences.

2.2 About and from children (created by the parent)

When a parent creates a child profile, we collect:

• a first name or nickname (we recommend a nickname),
• birth month and year or an age band, used only to place the child in the right age experience (Tots, Kids, Teens),
• an avatar chosen from our library (children do not upload photos of themselves).

When a child uses the Service, we collect:

• Learning activity: missions and lessons started and completed, quiz answers, points (XP), levels, badges, streaks, and skills progress.
• Creations: projects a child builds in Creator Studio and their saved versions.
• AI assistant inputs ("Robo"): text a child types to our AI learning assistant and the assistant's responses. See Section 4.4.
• Technical information needed to run the Service: a session cookie, device and browser type, and IP address, used to keep the child signed in, keep the Service secure, and make it work. We use this information only to support the internal operations of the Service.

We design the children's experience so that children are not asked to provide their full name, email address, phone number, street address, school name, photos, video, voice recordings, precise geolocation, or government identifiers. Children cannot send messages to other users, and there is no public profile, chat room, or public posting feature for children.

2.3 Information we collect automatically

We use strictly necessary cookies and similar technologies to sign users in, remember language and preferences, prevent fraud, and keep the Service secure. On pages and experiences directed to children, we do not use third-party advertising cookies, behavioral advertising, or third-party tracking for marketing. [If any analytics tool is used on adult/parent pages, name it here and describe its settings.]

3. How we use information

We use information to:

• provide, personalize by age, and improve the Service and its learning content;
• create and manage family accounts, linked co-parents, and child profiles;
• show parents their child's progress in the parent dashboard;
• process subscriptions, payments, renewals, and refunds;
• provide customer support and send service messages (for example, receipts, security alerts, consent requests, and renewal reminders);
• send marketing emails to adult account holders only, and only as permitted by law (see Section 7);
• protect the safety and security of users and the Service, and comply with law.

We do not sell personal information. We do not share personal information for cross-context behavioral (targeted) advertising. We do not show behavioral advertising to children. We do not use children's personal information to train generalized AI models.

4. Children's Privacy (COPPA Notice)

This section applies to children under 13 and supplements the rest of this policy.

4.1 Parental consent first

We do not knowingly collect personal information from a child under 13 until we have obtained verifiable parental consent from the child's parent or legal guardian. A parent creates the family account, receives a direct notice describing our practices, and gives consent before the child's profile is activated. [Describe final consent method(s) — see parental-consent.md; e.g., "a card verification through our payment processor" or "a signed consent form."]

A parent can consent to our collection and use of their child's information without consenting to disclosure of that information to third parties, except to service providers that are necessary to operate the Service (Section 4.3).

4.2 What we collect from children and why

We collect only the information reasonably necessary for the child to participate in an activity. We do not condition a child's participation on disclosing more information than is reasonably necessary.

4.3 Who we share children's information with

We do not sell children's personal information and do not disclose it to third parties for advertising. We disclose it only to service providers that process it on our behalf to operate the Service, under written contracts that require them to protect it and use it only for our purposes:

We may also disclose information if required by law, to protect the safety of a child, or in connection with a merger or acquisition, in which case the successor must honor this policy.

4.4 The Robo AI assistant

Robo is an AI learning assistant designed for each age group. Text a child types to Robo is sent to our AI provider to generate a response. We instruct children not to share personal details, we filter messages for personal information and unsafe content before they are sent, and [we require our AI provider by contract not to use this data to train its models and to delete it after processing — confirm contract terms]. Parents can review their child's Robo conversations in the parent dashboard, turn Robo off for any child, and delete conversations. [Confirm final retention period in Section 9.]

4.5 Parents' rights

A parent or legal guardian may at any time:

• review the personal information we have collected from their child;
• request deletion of that information;
• refuse to permit further collection or use of their child's information (which may mean closing the child's profile);
• withdraw consent to any disclosure to third parties beyond what is needed to operate the Service.

Parents can do most of this directly in the parent dashboard (Settings → Child profile → Privacy). Parents may also email privacy@aiplaybase.com or write to [POSTAL ADDRESS]. Before we provide a child's information, we take reasonable steps to confirm that the requester is the child's parent.

4.6 Teens (13–17)

Teen profiles are also created and managed by a parent. We apply the same protections to teens: no sale of personal information, no targeted advertising, no public profiles, and no messaging between users. Teens can see their own data, and parents can request access or deletion.

5. Your choices and rights (adults)

You can access, update, export, or delete your account information in your account settings or by contacting us. You can unsubscribe from marketing emails at any time using the link in any marketing email. Depending on your state of residence (for example, California, Colorado, Connecticut, Virginia, Texas, and other states with consumer privacy laws), you may have additional rights to access, correct, delete, or obtain a copy of your personal information, and to opt out of sale, sharing, targeted advertising, or profiling. Because we do not sell or share personal information for targeted advertising, there is nothing to opt out of in those categories, but you may still submit any request to privacy@aiplaybase.com. We will not discriminate against you for exercising your rights. You may use an authorized agent where state law allows. If we deny your request, you may appeal by replying to our decision.

[Attorney: confirm which state privacy laws apply based on revenue/volume thresholds and add any required state-specific disclosures, including California "Notice at Collection" categories and retention periods.]

6. Global Privacy Control

We honor Global Privacy Control (GPC) browser signals as an opt-out request where state law requires it.

7. Email communications

• Service emails (receipts, security, consent requests, account notices) are sent to parents and adult users and are not marketing.
• Marketing emails are sent only to adult account holders, identify themselves as advertisements where required, include our postal address, and include a working unsubscribe link. We process unsubscribe requests within 10 business days.
• We do not send marketing emails to children and do not collect children's email addresses.

8. Security

We maintain a written information security program with administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit, access controls limited to staff who need access, logging, and vendor contracts requiring appropriate security. No system is perfectly secure; if we learn of a security incident affecting your information, we will notify you as required by law.

9. Data retention

We keep personal information only as long as reasonably necessary for the purpose it was collected, and then delete it securely. We do not keep children's personal information indefinitely.

10. International users

The Service is operated in the United States and intended for US residents. If you use it from elsewhere, your information will be processed in the United States.

11. Changes to this policy

If we make material changes, we will notify parents by email and in the Service before the change takes effect. If a change affects how we collect, use, or disclose children's personal information, we will obtain new verifiable parental consent before applying it.

12. Languages

This policy is available in English, Spanish, Portuguese (Brazil), and French (Canada). If there is any conflict, the English version controls. [Attorney: confirm.]

13. Contact

[LEGAL ENTITY NAME] · [POSTAL ADDRESS] · privacy@aiplaybase.com · [PHONE]