📋 Legal

Privacy Policy

Last updated: April 2026 · Effective immediately

BrainWave is designed for children. We take privacy extremely seriously and comply with COPPA (Children's Online Privacy Protection Act), GDPR, and applicable data protection laws.

1. Who We Are

BrainWave AI ("BrainWave", "we", "us") is operated by Online Enablers. We provide AI-powered tutoring services for students aged 5–18 through our platform at brainwave.school.

2. Information We Collect

For School Accounts (Administrators):

School name, country, and administrator contact details
Email address and encrypted password
Billing information (processed by PayPal — we never store card details)

For Family Accounts (Parents/Guardians):

Parent/guardian name and email address
Child's first name and grade level
Billing information (processed by PayPal)

For Students (Children):

First name and grade level only
AI tutoring session transcripts (used to generate progress reports for parents/teachers)
Usage data (number of sessions, subjects studied)

We do NOT collect: last names of children, photos, location data, social media profiles, or any unnecessary personal data from minors.

3. COPPA Compliance (Children Under 13)

We obtain verifiable parental consent before collecting any personal information from children under 13.

Parents/guardians must create the account and provide consent
Children under 13 cannot create their own accounts
Parents can review, edit, or delete their child's data at any time
We do not use children's data for advertising or share it with third parties for marketing
Parents can contact us at coppa@brainwave.school to access or delete their child's data

4. How We Use Your Information

To provide the AI tutoring service
To generate progress reports for parents and teachers
To process payments via PayPal
To send service-related emails (account confirmation, receipts)
To improve our AI tutoring quality

We do NOT sell your data. We do NOT use your data for advertising. We do NOT share data with third parties except as required to operate the service (Supabase for database, Anthropic for AI, PayPal for payments).

5. Data Storage & Security

Data is stored in Supabase (EU/US region) with encryption at rest and in transit
Each school's data is fully isolated — no cross-school data access
Passwords are hashed and never stored in plain text
AI conversations are processed by Anthropic and subject to their privacy policy

6. Data Retention

We retain account data for as long as your account is active. Upon account deletion: student session data is deleted within 30 days, billing records are retained for 7 years as required by law.

7. Your Rights (GDPR)

If you are in the EU/UK, you have the right to: access your data, correct inaccurate data, delete your data ("right to be forgotten"), restrict processing, data portability, and object to processing. Contact privacy@brainwave.school to exercise any right.

8. Cookies

We use only essential cookies required to operate the service (session management, security). We do not use advertising or tracking cookies. See our Cookie Policy for details.

9. Contact Us

For any privacy questions or to exercise your rights:
📧 privacy@brainwave.school
📧 coppa@brainwave.school (for COPPA requests)