Privacy Policy

1. Who we are

Wizar Learning Inc. ("Wizar", "we", "us") is an education technology company incorporated and headquartered in Vancouver, British Columbia, Canada. We operate the Learnverse platform and related services (the "Service").

Our role. When a school, school group or other educational organization provides Learnverse to its students, that organization decides how its students' and staff's data is used. It is in control of that data, and we act only on its instructions. For people who sign up to Learnverse directly, and for visitors to our website, Wizar is responsible for the data.

2. Who this policy covers

This policy applies to everyone who uses Learnverse: students, teachers, school administrators, parents and guardians. It also applies to visitors to our website, wizar.io. It covers data collected through the platform, the website and any related services.

3. Schools: your data, your control

Most students use Learnverse through their school. When they do:

• The school decides. The school chooses which students use the Service and for what purpose. We process school data only on the school's documented instructions, under a written data processing agreement signed before any student account is issued.
• Student accounts can carry no names. Each student can receive a generated ID (for example, "student1", "student2") with no name, email address or third-party sign-in. Only the school holds the list linking IDs to students. In that case the only student data we hold is learning data (progress, assessment answers and scores) against those IDs.
• Teacher accounts hold the teacher's name and work email address, so they can sign in and receive service messages.
• Consent. Where parental consent is needed, the school obtains it through its own process. We provide notice text the school can use.
• We use school data only to provide the Service to that school, and for any research the school has agreed to in writing. Never for advertising, marketing or commercial profiling.
• Security incidents. If we become aware of an incident affecting a school's data, we notify the school without undue delay, and in any case within 72 hours. We support the school in meeting its own obligations.
• Deletion and return. When our agreement ends, or at any time on the school's instruction, we delete or return the school's data. Deletion is completed within 60 days of the agreement ending, and we confirm it in writing.
• Service providers. Section 8 lists every service provider who processes school data. We give schools notice before adding a new one.
• Due diligence. We are glad to complete a school's vendor security or data protection questionnaire, to contribute to its data protection impact assessment, and to walk its data protection lead through any of this on a call.

4. What data we collect

We do not collect biometric data, precise location, financial information from students, students' social media profiles, or anything not needed for learning.

Technical data. We also collect non-identifying technical data, such as device type, browser, page load times and error logs, to keep the platform working well.

5. How we use data

We use data only to:

• Provide the Service: create accounts, sign users in, deliver the learning program and personalize its pace.
• Support teachers and schools: dashboards and reports showing progress and assessment results by student, class and competency.
• Keep the Service safe: detect and prevent unauthorized access, abuse or misuse.
• Communicate: send essential service messages (such as password resets and changes to this policy) and, with consent, educational updates.
• Improve the program: using aggregated, de-identified data that cannot be traced to any individual. Research using a school's data happens only as agreed with that school.

We never use personal data for advertising, marketing or commercial profiling, and we never sell it.

6. Children

Learnverse is designed for students in Grades 3–8 (Years 4–9). Families who sign up directly use it with children aged 7 to 14. We protect children's data as follows:

• Through school: most children use Learnverse through their school, which manages their accounts and any consent needed (Section 3).
• Direct sign-ups: for children under 13, or under the age set by local law where it is higher, we require verifiable consent from a parent or guardian before collecting any personal data.
• Private by default: a student's profile and learning data are visible only to the student, their teachers and their school's administrators. Optional sharing features are off by default.
• No profiling or targeting: we do not build behavioural profiles of children for any purpose other than their learning, and we do not target them with advertising of any kind.
• Minimal data: we collect only what learning requires.
• Parents' access: parents and guardians can ask to see, correct or delete their child's data. For school accounts, we handle these requests together with the school.

7. AI and generative AI

• Personalized pace: the platform uses students' progress data to adjust the order and difficulty of content.
• Generative AI activities: a small number of topics include generative AI activities, such as prompt writing or exploring how AI generates text. These use AI models from third-party providers (Section 8).
• What we commit to:
• No student personal data is sent to any AI provider. Interactions are anonymized.
• Student data is never used to train any AI model, ours or anyone else's.
• The school decides. In classroom use, generative AI activities are teacher-mediated, and a school can switch them off entirely. Every session still works without them.
• Safety controls keep AI outputs age-appropriate, and we review samples of AI-generated content for accuracy and appropriateness.
• Our curriculum was written by our own educators and subject experts.

8. Who we share data with

We do not sell data, and we share it only with the service providers we need to run Learnverse:

Learnverse data is hosted by Amazon Web Services in the United States (Section 9). OpenAI and Stripe process data in the United States. Our other providers may process data in the United States and other countries where they operate.

Every provider is bound by a written agreement to use the data only to provide its service to us, to keep it secure, never to use it for its own purposes (including marketing or AI training), and to delete it when the relationship ends.

We disclose data to authorities only where the law requires it. Where the law allows, we tell the affected school first.

9. Where data is hosted, and who can access it

• Hosting: Learnverse data is hosted on Amazon Web Services in the US West (Oregon) region. Backups are also held with Amazon Web Services.
• Regional hosting: schools that need their data hosted in a particular region can discuss it with us.
• Access: a small number of named Wizar engineers, based in Canada and India, can access production systems for support and maintenance only. All access is logged. Where a school uses generated student IDs, engineers see those IDs, not student names.
• Cross-border protection: wherever data is stored or accessed, the protections in this policy apply in full. Our data processing agreement with each school includes any additional contractual protections the school's local law requires.

10. Security

• Encryption: data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
• Access control: staff access is based on role and limited to what their work requires. Access to production systems is restricted to named engineers, protected by multi-factor authentication, and logged.
• Data minimization: schools can run Learnverse with student accounts that hold no names or contact details.
• Infrastructure: hosted on Amazon Web Services, whose data centres are independently certified to international security standards.
• Keeping systems current: we apply security updates promptly and scan the software we use for known vulnerabilities.
• Incident response: we keep a written incident-response procedure. We notify affected schools within 72 hours of becoming aware of an incident, and notify other affected users as the law requires.
• Reporting a concern: if you believe you have found a security issue, email privacy@wizar.io and we will respond promptly.

11. How long we keep data

Anyone can ask us to delete their data sooner.

12. Your rights

You can ask us to:

• give you a copy of the data we hold about you or your child
• correct anything inaccurate
• delete your data
• give you your data in a format you can take elsewhere
• limit or stop a particular use of your data
• withdraw consent you have given

Email privacy@wizar.io. For school accounts, we work with the school, which controls that data, to respond. We reply within 30 days, or sooner where local law requires. You can also raise a concern with the data protection authority where you live.

13. Working within your local law

Schools work under different data protection laws around the world. The commitments in this policy are our baseline everywhere. Where a school's local law asks for more, such as a particular consent age, a specific contract clause or a transfer mechanism, we write it into our data processing agreement with that school. If you have a question about how Learnverse works within your country's requirements, contact privacy@wizar.io.

14. Cookies

• Essential cookies keep you signed in and the platform secure. They cannot be switched off.
• Analytics cookies are used on our public website only, with your consent, and never inside the student platform.
• No advertising or cross-site tracking cookies are used anywhere.
• Engine diagnostics. The 3D engine keeps a randomly generated identifier in the browser for its diagnostics (Section 8).

You can manage cookies through your browser or our cookie banner.

15. Changes to this policy

When we make a significant change, we will:

• notify registered users by email and show a notice in the platform
• notify schools directly of any change that affects their data, at least 30 days before it takes effect where the change reduces protections or expands how data is used
• summarize the changes at the top of the policy and update the date
• ask for fresh consent where it is needed

16. Contact us

Wizar Learning Inc. Vancouver, BC, Canada Email: privacy@wizar.io Website: www.wizar.io

We aim to respond to every privacy enquiry within 30 days.