Pikoo Privacy Policy

1. Who We Are

Pikoo is operated by: 9450-0329 Québec inc. Province of Québec, Canada Person responsible for the protection of personal information: Anthony Pugliese Email: privacy@pikoo.ca

2. Data Minimization Principle

Pikoo is designed according to a data minimization principle. We collect only the information strictly necessary for the operation of the service. We deliberately avoid collecting sensitive or unnecessary information about children.

3. Personal Information Collected

When creating an account, we may collect:

• First and last name of the parent or guardian
• Email address
• Information necessary to manage the subscription
• Secure login credentials
• For child profiles, we strongly recommend the use of a pseudonym. We do not request or require a last name, date of birth or child address. Parents may provide a school grade and school documents or instructions to create activities

Usage Data and Payment Information

We collect certain technical and usage data to improve the user experience and ensure service security. Payments and subscriptions are handled by third-party providers, including Apple App Store, Google Play and RevenueCat for subscription management, including web purchases. We do not store full credit card numbers.

• Unique device identifiers
• IP address
• Device type and operating system
• Interaction data within the Application (progress, features used, time spent)

4. Purpose of Collection

We use personal information to:

• Create and manage accounts
• Manage subscriptions
• Provide educational features
• Personalize the experience
• Improve the Application
• Ensure security and prevent fraud
• Comply with legal obligations
• We do not use children’s personal information for behavioral advertising purposes

5. Parental Consent

Pikoo is designed for use by children under parental supervision. For children under 14 years of age, parental or guardian consent is required before collecting or using their personal information. The account is intended for a parent or guardian. Required consents concerning a child must be obtained for the relevant purposes; accepting the Terms of Use does not replace separate consent where required.

6. Disclosure of Information

We may disclose certain personal information to service providers for hosting, payment processing, and technical support; when required by law; or in the event of a merger or acquisition, subject to appropriate safeguards. We do not sell personal information.

7. Hosting, Transfers, and Retention

Our providers may process or store information outside Québec, including in the United States. Such a transfer requires a privacy impact assessment and a written agreement addressing risks and safeguards. Contact our privacy officer to ask about recipients and processing locations applicable to your information. Personal information is retained only as long as necessary for the purposes described in this Policy or as required by applicable law. Account data is retained while needed for the service. After closure, information must be destroyed when no longer needed, subject to legal obligations. Anonymization may replace destruction only when legal and regulatory requirements are met.

8. Security of Information

We implement reasonable security measures, including encryption of communications, restricted access to data, and technical and organizational safeguards appropriate to the sensitivity of the information. Despite these measures, no system is completely secure.

9. User Rights

In accordance with applicable laws, including Québec’s Law 25, you have the right to access your personal information, request correction of inaccurate information, withdraw consent subject to limitations, request deletion where permitted by law, and request data portability where applicable. To exercise these rights, contact us at the address in Section 1.

10. Cookies and Similar Technologies

We use technologies similar to cookies to ensure proper functioning of the Application, measure usage, and improve the user experience. You may manage certain preferences through your device settings.

11. Artificial Intelligence

If Pikoo uses artificial intelligence tools to generate educational content, data is used solely to provide the requested functionality. Generated content may contain inaccuracies, and parents are encouraged to supervise use. We do not use children’s data to train artificial intelligence models for external commercial purposes.

12. Management of Privacy Incidents

In accordance with Law 25, 9450-0329 Québec inc. implements measures to prevent, detect, and manage privacy incidents. If an incident presents a risk of serious injury, we will notify the Commission d’accès à l’information du Québec, inform affected individuals as soon as possible, and implement measures to reduce risks and prevent recurrence. Every privacy incident must be entered in the legally required register, even when it does not present a risk of serious injury.

13. Changes and Contact

We may modify this Policy to reflect legislative or operational changes. The most recent version will be published within the Application along with the updated date. For questions regarding privacy, contact 9450-0329 Québec inc. at privacy@pikoo.ca.

14. Services and privacy choices

We use services including Supabase for accounts, data and hosting, RevenueCat for subscription management, and AI processing providers for requested activities. School documents, answers, progress and support messages may contain personal information. The material needed to analyse school documents and generate activities is shared with OpenRouter and the model providers used, including OpenAI and xAI (Grok), after your explicit permission in the app. Text for online audio reading is sent to Google Cloud Text-to-Speech. You can withdraw permission in settings; new processing will be blocked, but requests already sent cannot be recalled. Avoid including unnecessary names or contact details in uploads.

On the website, Google Analytics audience measurement starts after you agree. Without permission, we count selected actions without cookies or visitor identifiers; events contain no personal information. In the app, usage measurement with PostHog and Google Analytics depends on consent and parent-area rules. A random identifier links visits on one installation; it resets on sign-out or withdrawal of consent. Child actions are only added to grouped totals. Website and app choices are separate.

Account deletion removes access to profiles and associated data. Some technical generation logs are retained after account identifiers and submitted or generated content have been removed. Information may also be retained to meet legal obligations.

15. Requests and privacy complaints

Email our privacy officer at privacy@pikoo.ca to request access, correction, portability or to submit a privacy complaint. Include your account email and the purpose of your request, without attaching identity documents or passwords. Proportionate verification of your identity or parental authority may be necessary.

Access, correction and portability requests are handled diligently within the statutory 30 days of receipt. Portability covers computerized personal information collected from you, in a structured, commonly used format, subject to legal conditions and exceptions.

For a complaint, describe the facts and the outcome you seek. The privacy officer reviews the matter and communicates the follow-up. You may also exercise your remedies with the Commission d’accès à l’information du Québec.

16. Responsibilities and withdrawing consent

Anthony Pugliese is the person responsible for the protection of personal information. He is your contact for requests, complaints and questions about providers, retention and destruction. Internal access must be limited to people who need the information for their duties.

You can withdraw analytics consent in website preferences or the app’s privacy settings. For other consent-based processing, contact the privacy officer. Withdrawal may prevent a feature that requires the information from working; legal retention obligations continue to apply.