Privacy Policy

CloudKids Academy is an AI-powered educational platform for children aged 6–17, operated by a company registered in Morocco. We are committed to protecting the privacy of all users, and especially of children who use our platform.

This Privacy Policy explains what personal data we collect, how we use it, how we protect it, and your rights in relation to it. If you have questions, contact us at hello@cloudkids.academy.

We collect the following categories of data:

Account Information

• Name and email address (required to create an account)
• Password (stored as a secure cryptographic hash — never in plain text)
• Role (parent or learner) and age group (for learners)
• Avatar selection

Learning Activity

• Courses enrolled in and lessons completed
• XP points earned and level progression
• Certificates earned
• Code written in the in-browser playground (not stored persistently)

Community Content

• Posts, comments, and project showcases you choose to publish
• Likes and reports you submit

Payment Information

• Subscription plan and status
• Payment processor customer ID (Stripe or Paddle)
• We do not store card numbers or banking details — these are handled entirely by our payment processor

Technical Data

• IP address and browser type (collected automatically by our hosting provider, Vercel)
• Session authentication cookies

We use your data only for the following purposes:

• To create and manage your account
• To deliver courses, track progress, and award certificates
• To process subscription payments and send billing-related emails
• To operate the community safely, including moderation of reported content
• To send transactional emails (account verification, welcome, subscription updates)
• To improve the platform through anonymised usage analytics
• To comply with legal obligations

We do notsell your personal data. We do not use your data for advertising. We do not use children's data to build behavioural profiles.

CloudKids Academy is designed for children and we take their privacy with the utmost seriousness. We comply with the US Children's Online Privacy Protection Act (COPPA) and the GDPR provisions relating to children's data.

• Children under 13 may only use the platform through a parent or guardian account. Parents provide consent by creating and linking a child account.
• We collect only the minimum data necessary for children to use the service.
• Children's data is never shared with third parties for marketing purposes.
• Community display names are used instead of real names on public-facing areas.
• There is no direct peer-to-peer messaging between children.
• Parents can request deletion of their child's data at any time by contacting us.

We share your data only with trusted service providers necessary to operate the platform:

• Firebase / Google Cloud — authentication and database storage
• Vercel — hosting and serverless infrastructure
• Paddle — payment processing as Merchant of Record (they handle billing, taxes, and chargebacks on our behalf)
• Resend — transactional email delivery
• Anthropic / Google — AI features (AI providers do not receive personally identifiable information in prompts)

All third-party providers are bound by data processing agreements and are required to maintain appropriate security standards. We do not share data with any other third parties.

We use a single essential session cookie (__cloudkids_session) to keep you signed in. This cookie is strictly necessary for the platform to function and does not track you across other websites.

We do not use advertising cookies, tracking pixels, or third-party analytics that identify individual users. We use Vercel Analytics for anonymised performance metrics only (no personal data).

We retain your personal data for as long as your account is active. If you delete your account:

• Your profile, learning history, and community content are deleted within 30 days
• Billing records are retained for 7 years as required by tax regulations
• Anonymised, aggregated usage statistics may be retained indefinitely

Depending on your location, you may have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request that we correct inaccurate data
• Deletion — request that we delete your personal data ("right to be forgotten")
• Portability — receive your data in a structured, machine-readable format
• Objection — object to certain types of processing
• Withdrawal of consent — withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at hello@cloudkids.academy. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your personal data:

• All data is transmitted over HTTPS (TLS encryption)
• Passwords are hashed using industry-standard algorithms — never stored in plain text
• Session cookies are HttpOnly and Secure
• Access to production databases is restricted to authorised personnel only
• Firebase Security Rules restrict data access to authenticated users

Despite our best efforts, no method of transmission over the internet is 100% secure. If you believe your account has been compromised, contact us immediately.

Your data may be processed on servers located in the United States and the European Union, where our infrastructure providers operate. We ensure that any such transfers are protected by appropriate safeguards, including standard contractual clauses where required by applicable law.

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. The effective date at the top of this page will always reflect the most recent version.

For privacy-related questions or to exercise your rights, contact us at hello@cloudkids.academy.

If you are located in the European Union and believe we have not addressed your concern adequately, you have the right to lodge a complaint with your local data protection authority.