Privacy policy

Docea AI is used by children. This policy explains, in plain language, what we collect, why, who sees it and what you can ask us to do.

Last updated: 15 September 2026

Text shown [like this] is a placeholder that will be completed before launch.

1. Who we are

Docea AI ("Docea", "we", "us") is an AI tutor for learners aged 7 to 17 and the parents, teachers and mentors who support them. The service is provided by [legal entity name], a company registered in [country] under number [company number], with its registered office at [registered address].

For the purposes of data protection law (including the EU General Data Protection Regulation and the UK GDPR), we are the controller of the personal data described here. Where a school authorises Docea for its pupils, see section 7.

Questions about this policy or your child's data go to [email protected]. Data protection officer: [DPO name and contact details]. EU representative: [EU Article 27 representative, if required]. UK representative: [UK representative, if required].

2. What this policy covers

This policy covers the Docea web app, the Docea mobile app where available, and this website. It applies to everyone who uses Docea, wherever they live. Some sections add rules for particular places.

This website does not use analytics or advertising cookies and does not ask you for personal information. If you email us, we use your message to reply.

3. Information we process

Account information

Email address, first name, password (stored only as a salted hash, never in readable form) and account role: learner, parent, teacher or mentor.
Year and month of birth and country. We ask for a full date of birth to work out the age, but store only the year and month. We do not collect location beyond the country.
If a parent or guardian's consent is needed: their email address, and a record of each consent decision (what was allowed, when, which version of our notice, how it was verified, and a scrambled, non-reversible form of the device's IP address and browser).
If a card check is used: the result of the check, the card type (credit or debit), the card's country, the amount, and the payment and refund references. We never see or store the card number, its last four digits or the cardholder's name.
Second sign-in step: an encrypted authenticator app key or a passkey's public key, and one-time recovery codes stored in a form we cannot read back. We keep a security log of sign-in events.

Learner profile and learning activity

What we hold about a child's learning depends on the choices a parent (or the learner, when old enough) has allowed. Section 6 lists, for each choice, the data it covers. In outline: the learner's first name, school year, curriculum and subjects; tutor conversations; drill answers and progress; study plans; coding notebooks; what the tutor remembers; and, only where allowed, circle posts, mentor notes and class records.

Voice recordings a learner sends are turned into text and not stored. Photos of worksheets a learner uploads are read to extract the questions.

Family information

Family links between parents or guardians and learners.
Parent settings: daily time limits, quiet hours, safety settings, daily usage totals and wellbeing signals (which contain no scores and no message content).

Safety information

Messages are checked by safety filters tuned to the learner's age band, including a filter for personal information.

Technical information

Security and operations logs, error reports and performance measurements. Message content is removed from these logs, and the tutor service identifies learners in its logs only by a scrambled code. Logs are kept for 30 days.
We do not use third-party advertising, and we do not use analytics tools that track you across other sites.

4. How we use it and our lawful bases

Where the GDPR or UK GDPR applies, we rely on the lawful bases below. Where we rely on legitimate interests, we have weighed them against the rights of the people involved, with extra care for children.

Purpose	Data	Lawful basis
Create and run accounts, sign-in and security	Account information, technical information	Contract; legitimate interests in keeping accounts secure
Tutoring, AI replies, memory, analytics, circles, mentoring and classes for a child below the age of consent	Only the data covered by the choices allowed (section 6)	Consent given by the parent or guardian, or authorisation by a school where section 7 applies
The same features for a learner at or above the age of consent, and for adults	Learner profile and learning activity	Contract, or the learner's own consent where required
Parent controls and family features	Family information	Legitimate interests of parents in supporting their child
Safety screening of conversations and posts	Learning activity, safety information	Legitimate interests in protecting children; legal obligation where safeguarding law requires it
Asking for parental consent and verifying the parent	Child's first name, birth year and month, country, parent's email, card check result	Legal obligation (the consent rules themselves)
Fix errors and keep the service running	Technical information	Legitimate interests in a reliable, secure service
Respond to requests, complaints and legal claims	Any relevant data	Legal obligation; legitimate interests

5. Children, age and parental consent

Everyone who signs up gives a date of birth and country. We work out the age on our side and compare it with the age of digital consent in that country. Below that age, a parent or guardian must agree before we process anything about the child beyond asking for that agreement. Where we have not reviewed a country's rules, or no country is given, we use 18, the most protective age.

Age of digital consent by country

Country	A parent must consent below	Law
United States	13	COPPA, 16 CFR 312.2
United Kingdom	13	UK GDPR Art. 8(1)
Austria	14	DSG §4(4)
Belgium	13	Loi du 30 juillet 2018, art. 7
Bulgaria	14	Personal Data Protection Act art. 25c
Croatia	16	GDPR Implementation Act art. 19(1)
Cyprus	14	Law 125(I)/2018 s.8(1)
Czechia	15	Act 110/2019 §7
Denmark	15	Databeskyttelsesloven §6(2)
Estonia	13	Personal Data Protection Act §8(1)
Finland	13	Data Protection Act 1050/2018 §5
France	15	Loi 78-17 art. 45 (under 15: parent and child consent together)
Germany	16	GDPR Art. 8(1)
Greece	15	Law 4624/2019 art. 21
Hungary	16	GDPR Art. 8(1)
Ireland	16	Data Protection Act 2018 s.31(1)
Italy	14	D.Lgs. 196/2003 art. 2-quinquies(1)
Latvia	13	Personal Data Processing Law s.33
Lithuania	14	Law on Legal Protection of Personal Data art. 6(1)
Luxembourg	16	GDPR Art. 8(1)
Malta	13	S.L. 586.11 reg. 3
Netherlands	16	GDPR Art. 8(1); UAVG art. 5(1)
Poland	16	GDPR Art. 8(1)
Portugal	13	Lei 58/2019 art. 16(1)
Romania	16	GDPR Art. 8(1)
Slovakia	16	Act 18/2018 §15(1)
Slovenia	15	ZVOP-2 art. 8(1)
Spain	14	LOPDGDD 3/2018 art. 7(1)
Sweden	13	Lag 2018:218 ch. 2 §4
Iceland	13	Act 90/2018 art. 10
Liechtenstein	16	GDPR Art. 8(1) (EEA)
Norway	13	Personopplysningsloven §5
Brazil	17	Lei 15.211/2025 (ECA Digital) art. 24; LGPD art. 14
India	18	DPDP Act 2023 s.2(f), s.9(1)
South Africa	18	POPIA s.1, s.34-35
Australia	18	Privacy Act 1988 s.26GC (Children’s Online Privacy Code)
South Korea	14	PIPA art. 22-2(1)
China	14	PIPL art. 28, art. 31
Any other country, or none given	18	Docea policy (most protective)

In California, the sale or sharing of personal information of under-16s needs opt-in (Cal. Civ. Code 1798.120(c)). Docea does not sell or share personal information, so this does not change the age above.

A learner at or above the age of consent but under 18 may make their own choices, and still gets the high-privacy defaults in section 15. Parent, teacher and mentor accounts must be 18 or over.

How consent works

A child below the age of consent who signs up gets a paused account and no access. We email the parent or guardian address they give (which must differ from the child's) a single-use link that expires after 72 hours. When a parent adds a child from their own account, the request goes to the parent's own email.
The parent reads a plain-language notice (version 2026-09-15.3) of who we are, what we collect, how AI is used, what we never do and their rights, and then makes each of the eight choices in section 6 separately. Nothing is ticked in advance. A parent can allow tutoring without allowing anything that shows the child to other people.
The parent can also decline. Declining deletes what we collected to ask.
If no decision is made within 14 days, everything we hold to ask for consent, including the parent's email address, is deleted.

How we check it is the parent

Email plus is used for the five internal choices (tutoring, AI processing, memory, analytics and service emails), where the data stays inside Docea and the providers we contract. After the parent agrees by email, we send a confirmation 24 hours later with a link to change their mind, so a parent whose mailbox was used by the child finds out. This is the method COPPA allows for services that do not disclose children's data (16 CFR 312.5(b)(2)(viii)).
A card check is needed for the three choices that let people outside the family see the child's data: learning circles, mentor access and teacher access. We charge a small amount (50 cents, 50 pence or 50 euro cents, depending on the country) to a credit or debit card, refund all of it straight away, and email the parent to say it was charged and refunded. The statement shows both, marked DOCEA VERIFY, so the account holder knows it was them. Prepaid cards are not accepted. This is the card method in 16 CFR 312.5(b)(2)(ii), and it gives the separate consent COPPA requires before a child's data is disclosed (312.5(a)(2)).
In India, Brazil, South Africa, South Korea and China, the law asks for a verified adult for any processing, so the card check is needed for every choice, and email plus is not enough.
The card check is built but not switched on yet. Until it is, parents cannot allow learning circles, mentor access or teacher access, and parents in the five countries above cannot give consent. A school can still authorise teacher access where section 7 applies.

If we learn that we hold data about a child below the applicable age without consent, we delete it. Parents who believe this has happened can write to [email protected].

6. The eight choices a parent makes

Each is separate. A service only uses a child's data for a purpose the child's current choices allow, and it checks this on every request, so turning a choice off takes effect straight away.

Choice	What it allows	Data it covers	Verification needed	A school may authorise
Tutoring and practice	Tutor sessions, drills, study plans and progress tracking.	Tutor sessions and messages, drill answers and scores, study plans, skill mastery, enrolments, achievements, coding notebooks.	Email plus	Yes
AI processing	Sending your child’s questions and answers to an AI model to produce the tutor’s replies.	The text sent to the model for each reply, and short-lived conversation context, deleted when this choice is turned off.	Email plus	Yes
Personalisation memory	Remembering what helps your child learn, so sessions build on each other.	Memory notes about the learner and their numerical search representations (vector memory).	Email plus	Yes
Product analytics	Internal statistics about how learning features are used. No profiling, no advertising. Off unless you tick it.	Progress snapshots used for statistics. Also what a parent sees as progress over time in the family view.	Email plus (never available in India)	No
Service emails	Operational emails about the account. Never marketing.	The email address and the queue of emails waiting to be sent.	Email plus	No
Learning circles	Study groups where other learners can see what your child posts.	Posts, replies, circle and cohort memberships, published notebooks.	Card check	No
Mentor access	A mentor outside your family can see your child’s learning data.	The mentor link, invites, and the mentor’s goals, plans and session notes about your child.	Card check	No
Teacher access	A teacher of a class your child joins can see your child’s learning data.	Class enrolments, seats, class snapshots and extra-time arrangements a teacher sets.	Card check	Yes

In India, Brazil, South Africa, South Korea and China every choice needs the card check. In India, product analytics cannot be allowed at all, because the law forbids tracking or behavioural monitoring of children (DPDP Act s.9(3)).

A learner who is old enough to consent for themselves starts with tutoring, AI processing, memory and service emails, and can change these. Analytics is never switched on for them by default.

7. Schools

In the United States, the United Kingdom, and EU and EEA countries, a school can authorise Docea for its pupils in place of a parent. We allow this only within these limits:

A school must be verified by Docea and accept our school data processing agreement before it can authorise anything.
The school official must confirm the data is used only for the school's educational purposes and not for any commercial purpose.
A school can authorise only tutoring, AI processing, memory and teacher access. It can never authorise product analytics, service emails, learning circles or mentor access.
Teacher access from a school reaches only teachers of that school's classes.
Where we have a parent's email address, we tell the parent about the school's authorisation, with a link to manage it.
A parent's choice overrides the school's. A parent can narrow what the school authorised, and withdrawing or declining consent ends every school authorisation for that child.
School officials must use a second sign-in step, and every authorisation or revocation is recorded.

School authorisation follows the FTC's COPPA guidance for schools (COPPA FAQ section N), which is guidance rather than part of the rule itself.

8. AI processing

The tutor's replies are produced by AI models. A child's messages are sent to a model only if AI processing is allowed.
Models run on Docea's own servers through our self-hosted model gateway. A commercial model provider is used only as a fallback, and only under contract terms that forbid training on your child's data or keeping it.
Message logging is turned off: the tutor, tools and memory services tell the gateway on every request not to log or store message content, and the gateway is configured not to keep prompts or replies. We are completing the same setting for the whole shared gateway, so that it also covers the few requests that do not carry it, before children use the service. Your child's data is never used to train AI models, for anyone.
To remember earlier sessions (if memory is allowed), the tutor stores notes about a learner and a numerical representation of them used for search. Learners can see and correct these notes.
AI features such as readiness scores help learning. They do not make decisions with legal or similarly significant effects on anyone.
AI can be wrong. See the AI section of our terms of service.

9. What we never do with children's data

We do not sell or share children's data.
We do not show children advertising or profile them for it.
We do not send children marketing. Marketing is off for every account created through the age check.
We do not use children's data to train AI models. There is no setting that allows it.

Inside Docea, a child's data is visible only as the child's choices allow: to linked guardians, to teachers only with teacher access, to mentors only with mentor access and an accepted invite, and to circle members only with learning circles.

Outside Docea, we use service providers (subprocessors) who process data only on our instructions:

Category	What they do	Provider
Hosting and infrastructure	Servers that run Docea, its databases and its self-hosted AI models	[hosting provider, location]
Email delivery	Consent, password reset and service emails	[email provider or self-hosted, location]
AI model fallback	Only if the self-hosted models are unavailable; no training, no retention	[provider, when enabled]
Card check	Processing the refunded verification charge (Stripe)	[Stripe entity, location]

We may also disclose information where the law requires it, or to protect a child or anyone else from harm.

11. International transfers

Docea is used around the world. Our servers are located in [country or region]. When personal data moves from the UK or the European Economic Area to a country without an adequacy decision, we use approved safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. You can ask us for a copy at [email protected].

12. How long we keep it and how we delete it

Pending consent: what we collect to ask a parent (the child's details and the parent's email) is deleted after 14 days without a decision, and straight away if the parent declines.
Learning data: kept only while the choice it depends on is allowed. Turning a choice off deletes the data that existed only because of it. For example, turning off memory deletes the memory notes and the vector memory.
Deletion across every store: when a child's data is deleted, we delete it from every service and store that holds it: the databases, the caches, the vector memory and the email queue. Deletion finishes only when each store is checked and reports nothing left. If a store is unavailable, we retry until it is done. Deletion is permanent, not a hidden flag.
Backups are kept for 30 days and deleted data ages out of them within that time. Erasure requests are completed within 30 days.
Records we keep on purpose: the record of consent decisions, card check results, security logs and the proof that a deletion finished. These contain no learning data and are kept for the life of the account plus 7 years, as proof that we acted lawfully.
Operational logs are kept for 30 days. Password reset links expire after one hour.

13. Security

Passwords are stored as salted hashes, and new passwords must meet a strength policy. Sign-in, sign-up and reset attempts are rate limited.
Teacher, mentor, school official and admin accounts must set up a second sign-in step (a passkey or authenticator app) before their first session. Parents can choose to. Repeated wrong codes lock the step for 15 minutes.
Changing consent to allow more, withdrawing it, downloading a child's data and deleting an account ask you to confirm it is you again.
Every service checks a child's current consent choices on each request, and refuses if it cannot check.

No system is perfectly secure. If a personal data breach puts you at risk, we will tell you and the relevant regulators as the law requires. Signing in with Google, Microsoft or Apple is built but not switched on yet.

14. Cookies and similar storage

The Docea app uses only strictly necessary first-party cookies to keep you signed in, and a short-lived cookie that keeps a browser on the parental consent path after an under-age date of birth is entered. We do not use advertising, analytics or cross-site tracking cookies. This website sets no cookies.

15. High-privacy defaults for under-18s

We apply the UK Age Appropriate Design Code (ICO Children's Code) to every learner under 18, wherever they live:

Location off. There is no location feature, and we store no location beyond the country.
Profile private. A learner profile is never public and is not discoverable by other users.
Analytics off. Product analytics runs only if a parent ticks it. Nothing is pre-ticked.
No nudges. No streak pressure or streak-loss messages, no "you're behind" copy, and no prompts to share more or turn privacy settings down.
No marketing.
Children can see who is watching. Learners have a "My privacy" screen that names the parents, guardians and schools who can see their learning and what each one decides about, in plain words.

16. Your rights and parents' rights

What parents can do

From the Family area of the app, the link in our emails, or by writing to [email protected], a parent can:

Review what they agreed to, which choices are on, who granted each one and how, and any school authorisation.
Change individual choices. Turning a choice off is always allowed and takes effect straight away; the data that existed only because of it is deleted. Turning a choice on may need the card check.
Withdraw consent with immediate effect. The child's sessions are signed out and every service stops using the data at once.
Download all data we hold about their child, from every service, in one file.
Delete everything. The app shows progress as each store is cleared.

Everyone's rights

Depending on where you live, you also have rights of access, correction (learners can correct tutor memory notes themselves), deletion, restriction and objection, portability, and to withdraw consent. Account holders can download their account data and delete their account in the app. Children can use these rights themselves when they are old enough. We will check your identity and your relationship to the child before acting on an emailed request, and reply within one month (or the period your local law sets).

17. US privacy rights (including California)

Categories collected: identifiers (name, email), education-related information (learning activity), audio (voice turned into text and not stored) and visual information (worksheet photos), internet or network activity (technical logs) and inferences used for learning (mastery, readiness, tutor notes). Sources and purposes are in sections 3 to 6.
Sensitive personal information: account sign-in credentials, used only to provide the service.
No sale or sharing: we do not sell personal information or share it for cross-context behavioural advertising, including that of consumers under 16.
Your rights: to know, access, correct and delete your personal information, and not to be discriminated against for using them. You can use an authorised agent. Email [email protected].

18. Safeguarding

If something in a conversation or a post suggests a child may be at risk of serious harm, we may review it and, where necessary, share relevant information with a parent or guardian, the child's school or the authorities, as safeguarding law allows or requires. To report a concern, email [email protected]. If a child is in immediate danger, contact local emergency services first.

19. Changes to this policy

We will update this policy when our processing changes, and change the date at the top. The consent notice has a version number stamped on every consent record, so we can show exactly what a parent agreed to. If a change needs new consent, we will ask for it before it takes effect.

20. Contact and complaints

Privacy questions and requests: [email protected]
Safeguarding concerns: [email protected]
Help with your account: [email protected]
Post: [legal entity name], [registered address]

Please contact us first so we can try to put things right. You can also complain to a regulator at any time:

United Kingdom: the Information Commissioner's Office, ico.org.uk/make-a-complaint
United States: the Federal Trade Commission, reportfraud.ftc.gov
EU and EEA: the data protection authority where you live or work, listed by the European Data Protection Board
Elsewhere: your national data protection authority.

21. The laws we follow

These are the main laws behind the rules above. Ages of consent by country, with links, are in section 5.

United States: Children's Online Privacy Protection Rule, 16 CFR Part 312, as amended by the 2025 final rule; FTC COPPA FAQ; California Civ. Code 1798.120.
European Union: GDPR, in particular Articles 8 (children's consent), 12 (plain language), 17 (erasure) and 25 (privacy by design and default).
United Kingdom: UK GDPR Article 8; the Age Appropriate Design Code; Data (Use and Access) Act 2025 s.81.
Brazil: LGPD art. 14; ECA Digital, Lei 15.211/2025.
India: Digital Personal Data Protection Act 2023; DPDP Rules 2025.
South Africa: POPIA s.34-35.
South Korea: PIPA art. 22-2.
China: PIPL art. 28 and 31.
Australia: Children's Online Privacy Code (in development under the Privacy Act 1988).

Following these laws is how we have designed Docea. We do not claim any certification, and this policy is being reviewed by a lawyer before launch.