Privacy policy
Last updated: 27 September 2026 · Version 2.1
The short version
- A parent holds the account. We ask for a child's first name or nickname, age, school year and learning preferences, and nothing that identifies them to the outside world.
- We use the data to run the lessons, the helper and your reports. Never for advertising, never sold, never used to train AI models.
- The helper's replies to your child come from Google's Gemini models. Lesson drafting, parent insights and support answers come from models running on Amazon Web Services in London. Messages are checked by OpenAI's moderation service. Voices come from ElevenLabs. Payments go through Stripe. None of them may keep or train on your child's data.
- You can read every conversation, export everything, delete a child's data, and complain to us or to the ICO.
1. Who is responsible
The controller is Clove9 (the trading name of Prem Dev, sole trader, until WonderPath is incorporated), Office 128, 18 Young Street, Unit LGE, Edinburgh, EH2 4JB, Scotland, United Kingdom. Data protection contact: info@wonderpath.co.uk. ICO registration is in progress; the registration number will be shown here when issued. WonderPath does not have a statutory Data Protection Officer; the founder is responsible for data protection decisions.
2. Who can use WonderPath
Accounts are created and operated only by a parent or legal guardian aged 18 or over ("the parent"). Children never register themselves and use WonderPath through a profile the parent creates. The parent confirms at sign-up that they hold parental responsibility, and that confirmation is recorded with the policy version and time. For children under 13 the parent gives consent on the child's behalf, as section 9 of the Data Protection Act 2018 requires. A paid plan is a further check that the account holder is an adult.
3. What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Parent email, hashed password or Google sign-in identifier, optional display name | To run your account and contact you about it | Contract |
| Consent records (type, policy version, time, browser) | To show what you agreed to and when | Legal obligation |
| Child profile: first name or nickname, age, school year, avatar, learning and accessibility preferences, any learning needs you choose to tell us | To pitch lessons and the helper at the right level and adapt the display | Consent of the parent (learning needs are special category data and are used only to adapt the experience) |
| Learning activity: lessons completed, answers, hints used, scores, badges, journal entries, achievement photos you upload | To run the service and produce your child's progress and your reports | Contract; consent of the parent for the helper |
| Helper conversations: what your child types or says and what the helper replies | To give hints, keep the conversation safe, and let you read it | Consent of the parent |
| Safety events: refusals, blocked topics, requests for the answer | To protect children and show you what happened | Legitimate interests (child safety); legal obligation where a referral is required |
| Payment status and plan (card details are held by Stripe, never by us) | To provide the plan you pay for | Contract |
| Technical data: IP address and browser at sign-in, error logs, audit log of significant actions | Security and reliability | Legitimate interests (security) |
| Analytics events (only if you accept analytics cookies) | To see which pages and features are used, without child names | Consent |
We do not ask for, and ask you not to enter, a child's surname, home address, telephone number, school name, or photographs of their face. The helper is instructed to refuse and redirect if a child offers personal details.
4. Adaptation and automated decisions
WonderPath adapts the difficulty and order of lessons from your child's answers, and the helper adapts its language to the age and preferences on the profile. These are automated adjustments to a learning experience, not decisions with legal or similarly significant effects. No child is labelled, graded for a school, or refused a service by an algorithm. Learning needs you record are used only to adapt the experience and are never inferred by the software from behaviour. You can change or remove any preference at any time, and a person will review any adaptation you question.
5. Who processes data for us
| Processor | What for | Where | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | UK (London) | Not applicable |
| Amazon Web Services | Hosting the website files and sending emails (account, report and safeguarding emails) | UK (London) | Not applicable |
| Amazon Web Services (Bedrock) | Lesson drafting, parent insights, research digests and support replies to grown-ups. Receives lesson objectives, anonymised learning summaries and the text of support messages | UK (London) | Not applicable; AWS does not use inputs or outputs to train models |
| Google (Gemini API) | The helper's replies to your child. Receives the child's age, preferences, the current lesson and the conversation; never a surname, address or school | USA | UK Extension to the EU-US Data Privacy Framework and standard contractual clauses; paid tier terms exclude training on our data |
| OpenAI (moderation service only) | Classifies each message and reply as safe or not. Generates nothing | USA | Standard contractual clauses; API data is not used for training |
| ElevenLabs | Turns the helper's reply into speech on plans with voices | USA | Standard contractual clauses |
| Stripe | Payments and subscription management (Stripe is a controller for card data) | EU and USA | Stripe's own safeguards |
| PostHog (EU) | Analytics, only after you accept analytics cookies; no session recording | EU (Germany) | UK adequacy for the EU |
We will update this table before adding a processor, and tell you by email if the change affects children's data. No processor may use your child's data for its own purposes or to train AI models.
6. Who else may see data
- Family members or a teacher you invite to a child's Circle see that child's progress and what you choose to share with them.
- Where we reasonably believe a child is at risk of significant harm, we may share the minimum necessary with the local authority or the police, as our Safeguarding Policy describes.
- We do not sell personal data, share it with advertisers, or use it for marketing to children.
7. How long we keep data
Periods are set out in the Data Retention Policy. In short: for as long as the account is open, then thirty days after a deletion request; consent records for thirty days after deletion; safety events for twelve months; payment records for six years as tax law requires.
8. Cookies and local storage
Strictly necessary storage keeps you signed in and remembers settings. Analytics cookies are set only if you accept them on the banner, and you can change your mind from "Cookie settings" in the footer. Details are in the Cookie Policy.
9. Your rights
- See and export. Export a child's data as a file from the privacy section of your account, or ask us for a copy of anything else.
- Correct. Change profile details in Settings at any time.
- Delete. Delete a child's profile and data from that child's settings (seven-day cooling-off, then deletion within thirty days). To close the whole account, email info@wonderpath.co.uk with the subject "Close my account".
- Withdraw consent. Switch the helper off for any child in that child's settings; withdraw analytics consent in the footer.
- Object or restrict. Email us and we will stop or limit the processing you object to, unless the law requires it.
- Complain. Email info@wonderpath.co.uk with the subject "Data protection complaint". We acknowledge within 30 days and respond without undue delay, as the Data (Use and Access) Act 2025 requires. You can also complain to the Information Commissioner's Office at ico.org.uk.
10. Security
Data is encrypted in transit and at rest. Each family can see only its own data, enforced in the database. Staff who read children's conversations hold a DBS or PVG check. Parent passwords are hashed and a child's access PIN is hashed with lockout after repeated failures. We tell you and, where required, the ICO within 72 hours of a breach that puts you or your child at risk.
11. Children's Code
WonderPath is designed to the ICO Age Appropriate Design Code: high-privacy defaults, minimum data, no profiling for marketing, no nudges to keep using it, no advertising, plain language for parents and, in the product, for children. A summary of our data protection impact assessment for the helper will be published when it is signed off during the beta.
12. Changes
We email you at least 14 days before a material change. Where a change affects how a child's data is processed we ask you to consent again before that feature continues.
13. Contact
info@wonderpath.co.uk, or by post to Clove9, Office 128, 18 Young Street, Unit LGE, Edinburgh, EH2 4JB, Scotland, United Kingdom.