Privacy Policy

1. About Wondooz

Wondooz is an educational platform designed for learners aged 5–18. We help children explore their curiosity through AI-powered conversations, vocabulary building, and career discovery. Wondooz is operated by wondooz.

2. Data We Collect

We collect the following categories of data:

• Guardian account data: email address, password (hashed), subscription status.
• Learner profile data: first name (or chosen nickname), date of birth, avatar emoji, an auto-generated login code, and an optional PIN.
• Learning activity data: questions asked, vocabulary items, saved jobs, curiosity summaries, evidence logs, and dreamscape entries created during sessions.
• Consent records: timestamp, consent version, and guardian email recorded at the time a learner profile is created for a child under 13.
• Billing data: managed entirely by Stripe. Wondooz does not store full payment card numbers.

3. How We Use Data

• To provide and improve the Wondooz learning experience.
• To personalise responses and track learning progress within the platform.
• To process payments and manage subscriptions.
• To respond to support requests.

We do not sell learner data to third parties.

4. AI Processing — Google Gemini

Questions submitted by learners are sent to Google Gemini (a large language model operated by Google LLC) to generate educational responses. Data sent to Gemini is subject to Google's data processing terms. We do not instruct Google to use learner data to train its models under the current API terms, but guardians should be aware that queries leave Wondooz's servers during processing.

5. Children Under 13 (COPPA)

Wondooz accounts for children under 13 are created and managed by a parent or guardian. We require verifiable guardian consent before creating a learner profile for a child under 13. Guardians may review, export, or request deletion of their child's data at any time.

6. Data Retention

We retain data as follows:

• Guardian accounts: When you delete your account, it enters a 30-day pending-deletion period during which you can log in and reactivate at any time. After 30 days, all account data is permanently and irreversibly deleted.
• Independent learner accounts (13 and older): Same 30-day pending-deletion period applies. You may reactivate within that window by logging in.
• Learner profiles and activity (under-13): When a guardian deletes a child profile, it enters a 30-day pending-deletion period and can be restored by the guardian. After 30 days, the profile and all associated data are permanently deleted.
• Consent records: retained for the life of the guardian account plus 3 years for compliance purposes.
• Billing records: retained as required by Stripe and applicable law.

7. Guardian Rights

As a guardian, you have the right to:

• Access and export your child's data (use the “export” button on the learner profile card in your dashboard).
• Request deletion of a learner profile and all associated data.
• Correct inaccurate profile information.
• Withdraw consent for AI processing (this will prevent the learner from using question features).

To exercise these rights, email us at info@wondooz.com.

8. Data Security

Learner data is stored in Google Firebase Firestore with access controls that restrict reads and writes to authenticated account holders. Passwords are hashed by Firebase Authentication. We use HTTPS for all data in transit.

9. Third-Party Services

• Google Firebase — authentication and database.
• Google Gemini — AI question processing.
• Stripe — payment processing.

10. Changes to This Policy

We will notify guardians by email before making material changes to this policy. The “Last updated” date at the top of this page reflects the most recent revision.

11. Contact

Questions about this policy? info@wondooz.com