Privacy Policy

1. Who we are and what this covers

The operator is Michal Topchiashvili (“we”), resident in Israel. The product is Maya — website, iOS app, and PWA. The public site is https://michaltopch1-bit-craft-your-teacher.cleomare.workers.dev. The service is offered worldwide, not only in Israel.

If the law of your country of residence gives stronger protection, that stronger protection prevails. Nothing here waives a non-waivable consumer or child right.

2. Which laws may apply

Depending on where you are, the following may apply: GDPR (EU), UK GDPR and the Age Appropriate Design Code (UK), COPPA and FERPA (US; FERPA applies to schools — we are not a school), CCPA/CPRA (California) and other US state laws, LGPD (Brazil), PIPEDA (Canada), the Privacy Act (Australia), APPI (Japan), PDPA (Singapore), POPIA (South Africa), PDPL (UAE and Gulf), and Israel’s Protection of Privacy Law. We design the product to the stricter child-protection standard among them.

3. What we collect

On the device: a name the parent or child chooses, room progress, mastered topics, language, accessibility, consent choices, and a device id. No account is required to start.

From the parent: an email address to verify consent and to pause AI. We do not collect a child’s email.

When you ask for an AI lesson or voice: the text, photo, or recording is sent to the AI provider to generate that response. We do not keep photos or voice clips after the request finishes.

Payment: if you buy Maya Plus, Apple or Stripe (depending on the platform) process the payment method. We receive subscription status, not the card number.

Short-lived technical server logs (IP address, browser type, errors) to run security and fix failures — not for advertising profiles.

4. Why we use it

To run the room and catalog, fit language and age, let a parent approve or pause AI, generate a lesson or voice when asked, bill a subscription, prevent abuse, and comply with law.

There are no ads inside the lesson. We do not sell personal information. We do not do behavioral tracking for ads.

5. Legal bases (GDPR / UK GDPR and equivalents)

Contract: running the service you asked for. Legitimate interests: security, fraud prevention, reliability — balanced against children’s rights. Legal obligation: authority requests and accounting. Consent: parental verification for AI, any future non-essential cookies, and parent email. You may withdraw consent at any time without affecting lawfulness before withdrawal.

6. Children worldwide

Maya is for children with a parent nearby. The digital age of consent varies: in the US, COPPA applies under 13; in the EU the default is 16 unless a member state lowered it to 13; in the UK the Age Appropriate Design Code also applies. We require parent verification for every product age band (including 13–17) before AI unlocks on the server — stricter than the floor in some countries.

Full parent detail: the Children’s Privacy Notice. We are not a school and we do not keep a FERPA “education record.”

7. Who we share with

Cloud and hosting (Cloudflare, Vercel), optional database (Supabase), parent email, AI providers (Google, Anthropic, OpenAI / Lovable gateway) only when you ask for a lesson or speech, and payment providers (Apple, Stripe). They process under our instructions and their contracts. List: Subprocessors.

We disclose information if the law requires it, to protect a child from harm, or in a sale/reorganization of the operation — with the same restrictions.

8. International transfers

Servers and vendors may be in the US, Europe, or elsewhere. When GDPR or UK GDPR apply, we rely on adequacy decisions and/or Standard Contractual Clauses (SCCs) plus vendor restrictions. Request a copy via the email below.

9. How long we keep it

The room stays on the device until you delete it. A cloud sync copy — while the device is active or until deletion. Technical logs — a few days unless a security investigation. Subscription status — as required for accounting and local tax law. Lesson photos/voice — not kept by us after the request.

10. Your rights by region

Everywhere: access, correct, delete (“Forget everything” on the memory screen + a parent request), and object to processing that is not necessary.

EEA/UK: also restriction, portability, and withdrawal of consent. Complain to your local data-protection authority (e.g. CNIL, ICO, BfDI). We have not yet appointed an Art. 27 EU/UK representative; if required, we will post an address here.

California and other US state privacy laws: we do not sell or “share” information for cross-context advertising. You may request to know, delete, and correct. We will not discriminate against you for exercising a right.

Brazil (LGPD), Canada, Australia, Japan, Singapore, South Africa, the Gulf: the same requests via email. We will respond under local law.

11. Security

HTTPS, an HttpOnly session cookie on the web, a device secret, and parent verification on the server before AI. No security is perfect. If a breach must be notified under the law of your country, we will notify as required.

12. Cookies

Essential cookies for running the app and sign-in. Google Fonts load from Google’s servers. No advertising cookies. Details: Cookie Policy.

13. Changes

If we make a material change, we will update the date at the top and, where needed, email the parent. Continued use after that date accepts the new version, unless the law of your country requires fresh consent.

14. Contact

Privacy and rights requests worldwide: michaltopch1@gmail.com. Parent controls: /parent on the site.

Contact

michaltopch1@gmail.com