Children's Privacy Policy

iUstaad (“we”, “us”, “our”) is committed to protecting the privacy of children who use our platform. This Children's Privacy Policy explains how we collect, use, and protect personal data from students under the age of 16, and describes the rights of parents and guardians. It supplements our general Privacy Policy.

This policy is designed to comply with the U.S. Children's Online Privacy Protection Act (COPPA), the EU General Data Protection Regulation (GDPR) Article 8, and the UK GDPR / Age Appropriate Design Code.

1. What data we collect from children

When a parent creates a child account or a child registers directly, we collect:

• Full name
• Email address
• Date of birth (required for students under 13; optional otherwise)
• Course enrolment records
• Session attendance (which sessions were joined and when)
• Assessment results and progress data
• Communication preferences (session reminders)

We do NOT collect:

• Voice recordings or audio from sessions (Zoom manages session data per their own policy)
• Video or facial analysis data
• Precise location or GPS data
• Behavioural advertising data
• Social media data

2. Why we collect it

• To provide live tutoring sessions and educational services
• To enable parents and guardians to monitor their child's progress
• To send session reminders and enrolment notifications
• To ensure platform safety and prevent abuse

We do not use children's data for advertising, marketing profiling, or any purpose unrelated to providing educational services.

3. Who can see the data

• The child (via their own account)
• Their linked parent or guardian (via the Family dashboard)
• Their enrolled instructors (course enrolment, attendance, and session data only)
• iUstaad administrators (for platform safety and support)

4. Third-party data sharing

We share limited child data with the following third-party services, solely to provide the educational service:

• Brevo (Sendinblue) — Email delivery service. Receives the child's email address to deliver session reminders and account notifications. Brevo processes data under EU GDPR with Standard Contractual Clauses.
• Zoom Video Communications — Live session platform. Session join links are generated via Zoom's API. Zoom operates under its own Privacy Policy. We do not request session recordings.

We do not sell children's personal data to any third party.

5. Data retention

• Active accounts: Data is retained while the account is active and the child is enrolled in at least one course.
• Deactivated accounts: When a parent deactivates a child's account, the account is locked immediately and all personal data is permanently deleted within 30 days.
• Assessment data: Retained for the academic year in which it was created, then anonymised.
• Session attendance logs: Retained for 12 months, then anonymised.

6. Parental rights

As a parent or legal guardian, you have the right to:

• View all data held about your child — log in and visit the Family dashboard, or email privacy@iustaad.com
• Request a data export — email privacy@iustaad.com with subject “Data Export Request”. We will respond within 30 days.
• Deactivate and delete your child's account — go to the Family dashboard and click “Deactivate account” on the child's card. Data is permanently deleted within 30 days.
• Request immediate deletion — email privacy@iustaad.com with subject “Delete Child Data”.
• Revoke consent — deactivating your child's account constitutes revocation of consent. You may also email us to request removal from any marketing or notification lists.

7. Parental consent

For students under 16, we require verifiable parental consent before creating an account or processing any personal data. Consent is collected via a checkbox attestation at the time of account creation (the parent confirms they are the legal guardian and accepts this policy). For students who already have an independent account and a parent later requests to link it, the student must approve the link via a verification email.

You may withdraw consent at any time by deactivating your child's account from the Family dashboard.

8. Contact us

For any questions about this policy or to exercise your parental rights, please contact: