Privacy Policy

1. Who We Are

Canopy Families is a service of Mackie AI Enterprises Limited (company number 17107639), registered in England & Wales.

ICO registration number: ZC110311

Contact: [email protected]

2. Our Commitment to Children's Privacy

This policy explains what the service actually collects, why it is needed, who receives it, and the controls available to families. Children also see a shorter explanation before starting a learning chat.

3. What Data We Collect

Parent and guardian accounts:

• Name, email address, authentication records, notification choices, and account settings
• Subscription plan and Stripe customer or subscription references; Canopy does not store full card details
• Feedback, parent-advisor prompts, router-assistant prompts, and support communications you choose to send

Children's profiles (created by parent or guardian only):

• Display name, school year group, account identifier, and a protected PIN where used
• Learning subjects, session times, message content, AI replies, message counts, and safety flags
• When practice games are enabled: game and question-pack version, round times and completion status, fixed-choice answers, attempts, hints requested and questions finished. These games use prepared content, not AI; their fixed choices are not sent to the chat safety classifier.
• Approved-device security records, including an opaque device token hash, device name, and last-seen time
• Parent-configured schedules and safety settings

Home-network protection (full-access plan): router or device details, DNS configuration identifiers, service settings, connection status, and DNS analytics such as blocked domains and query totals supplied by NextDNS.

School Week preview: when a parent opts in, we save their household preference, supplied fictional examples, proposed events and deadlines, edited revisions, exact-revision approvals, mock calendar results and operation status. This preview does not accept pasted school correspondence, connect to Google Calendar, read Gmail, receive school emails or send content to an external AI service. Please use the supplied fictional examples only. Planner records are accessible only through the current parent owner's household.

AI usage and allowance records: family and, where applicable, learning-session references; the AI feature used; model and provider request references; request times and completion status; token and tool counts; estimated provider cost and the pricing version used. Separate allowance records hold the family's allowance period, amounts reserved or charged, and whether a request is settled or uncertain. These records do not copy prompts, replies, names, credentials or safety-classifier verdicts, but their references can link them to a family or session, so they are not anonymous.

AI safety abuse controls: child references, hourly classification counts and opaque call references with short recovery leases. These records limit repeated or simultaneous remote safety checks; they do not contain message content or classifier verdicts.

Technical and website data: service logs, IP-derived request information, browser or device type, consent preferences, and — only after opt-in and never on children's pages — website analytics and anonymous performance measurements such as route, network speed and Web Vitals.

Security and abuse-prevention data: Cloudflare Turnstile runs only on parent registration, sign-in and password-change verification. It receives security signals needed to distinguish people from automated traffic, including network and IP information, browser and operating-system characteristics, the Canopy hostname and site key, challenge timing, interaction, and outcome. Canopy does not send names, email addresses, passwords, form entries, user communications, or child learning content to Turnstile. For selected child-access endpoints, Canopy converts the endpoint's existing security credential — such as a device, approval, or link token, or a child reference — into a secret-keyed, one-way identifier before short-lived rate-limit counters are sent to Upstash. Raw credentials, identifiers, IP addresses, PINs, and form contents are not stored in that rate-limit database.

We do not request biometric data or store full payment-card details. A message and the automated safety flag applied to it may reveal or infer health or wellbeing information. We treat that information as especially sensitive.

4. Why We Process Information

Depending on the activity, we rely on providing the service requested by the parent or guardian, our legitimate interests in operating a secure and useful family service, compliance with legal obligations, or consent for optional analytics. We assess children's interests and rights before relying on legitimate interests.

We rely on our legitimate interests to authenticate users, prevent automated account abuse, enforce proportionate rate limits, and protect the service. Turnstile and Upstash are strictly necessary security controls and do not depend on optional analytics consent.

Parent or guardian approval is required before a child profile is created, but it is not treated as a blanket legal basis for every later use of a child's information. Where safety analysis reveals or infers health information, an additional UK GDPR Article 9 condition and appropriate safeguards are required.

You can withdraw optional analytics consent at any time using the Analytics settings control. Parents can request deletion or object to other processing by contacting [email protected].

5. How We Use Data

• To provide age-appropriate AI learning experiences tailored to your child
• To save learning sessions and give parents or guardians the oversight described in the service
• To run automated content-safety checks, record flags, and send parents safety alerts
• To authenticate users, approve devices, prevent misuse, and operate network protections
• When you opt in to DNS advisories in Family Settings, to email a prompt to check your home setup after two successful checks, at least 15 minutes apart, find no traffic on a profile that previously had traffic. Profile traffic does not establish device, child, mobile-data, or whole-household protection.
• To distinguish automated abuse from genuine parent account access and limit repeated requests to security-sensitive child-access endpoints
• To administer subscriptions, respond to feedback, and provide requested support
• To apply shared AI allowances, account for provider usage, retain uncertain charges safely, and limit abuse of remote safety checks; this operational accounting is separate from optional website analytics
• To measure and improve non-child pages when a visitor has opted in to analytics

6. Data Sharing

We do not sell or rent personal data. Information is disclosed only where needed to operate the service, process payments, deliver requested communications, protect a child or another person from serious harm, or comply with law.

• Child and parent prompts are sent to Anthropic's commercial API to classify or generate responses
• Child AI replies are checked by the commercial API before they are shown. A rejected reply is withheld; a safety result on that reply is not itself a safety flag against the child or a parent notification.
• Parents can view their child's saved sessions and flagged messages in the authenticated dashboard
• A generic safety-alert email is sent through Resend; it does not contain the child's name or message content
• DNS requests and analytics for connected full-access families are processed by NextDNS
• Cloudflare receives only the security signals required for Turnstile, while Upstash receives secret-derived identifiers and short-lived counter state for distributed rate limiting
• Account, hosting, payment, and optional analytics providers receive the limited data needed for their functions

We review provider roles, contracts, security measures, sub-processors, and international-transfer safeguards. Some providers may also act as independent controllers for limited activities such as payment fraud prevention or their own legal obligations.

7. Service Providers and Recipients

The following providers are present in the current implementation:

• Supabase — authentication and database hosting. Privacy information
• Vercel — application hosting, delivery, service logs, consent-gated Web Analytics, and consent-gated Speed Insights performance measurements. Privacy notice
• Anthropic — AI safety classification and child or parent AI responses through the commercial API. Privacy centre
• Resend — transactional and safety-alert email delivery. Privacy policy
• Stripe — checkout, subscriptions, billing portal, and payment fraud controls. Privacy policy
• NextDNS — DNS filtering and DNS analytics for families using home-network protection. Privacy policy
• Google — Google Tag Manager and tags it delivers, only after analytics opt-in and never on child-facing routes. Privacy policy
• Cloudflare — Turnstile bot protection on parent registration, sign-in and password-change verification. It receives the limited security signals described above, but Canopy does not send it the form fields entered into our service. Cloudflare's Turnstile Privacy Addendum says it acts as our processor when protecting Canopy and as a controller when it uses Turnstile signals to improve its bot-detection capabilities. Turnstile privacy addendum
• Upstash — short-lived distributed rate-limit counters keyed by secret-derived identifiers for selected Canopy API endpoints. Privacy policy

We update this list when the implemented provider set changes materially.

8. Data Retention

Account, profile, device, and safety data: retained while the family account is active, subject to the shorter periods below. An account-deletion request enters a controlled deletion queue after a 24-hour cooling period. Our worker removes directly controlled account data from the application database, Supabase authentication, and any linked NextDNS profile, with retries if a step fails.

Child learning history: homework conversations and practice-game activity are removed from our application database after 30 days, measured from the end of a session or its start if unfinished. The maintenance job runs hourly. A session linked to an undelivered safeguarding alert is held until that alert is delivered, so its supporting context is not lost before notification. Deleting a session also removes its messages and associated game attempts and hints; it does not restore a weekly learning allowance already used. Parent activity based on that session then disappears.

School Week preview records: sources and derived text become eligible for removal after 30 days from source receipt. Completed-operation metadata has a separate 30-day period; audit metadata expires 30 days after its action. Minimal approved plans and calendar mappings remain until 30 days after the event or deadline. Minimal duplicate and approval-replay records become eligible once all linked retention periods have ended and operations are reconciled; duplicate recognition ends when these records are removed. Unresolved operations are held for reconciliation. Hourly maintenance uses bounded batches, so expiry does not mean immediate physical removal. Turning off the preview does not stop retention. One minimal current worker checkpoint per opted-in household remains until household deletion; it contains phase, lease and fixed counts, not school text or a run history. Account deletion removes resolved local planner data once no in-flight or uncertain operation remains.

AI usage metadata: expires 30 days after the initial provider-call start, including any retry attempts. Hourly maintenance removes expired records in bounded batches; a backlog may require further runs. Deleting the linked learning session or family removes the associated usage rows. This period is separate from the retention of conversation content and provider copies.

AI allowance and reservation records: kept through their allowance period and eligible for removal 35 days after that period ends, through bounded maintenance batches. Deleting child learning history or usage metadata does not erase a reserved or uncertain allowance amount or restore credit. Family deletion removes the family's allowance records.

AI safety admission records: recovery leases expire after 60 seconds; hourly maintenance removes expired leases and classification-counter windows older than two hours in bounded batches. A newer request may replace an older hourly counter. Child deletion removes these records. Lease expiry and allowance eligibility are not promises of immediate physical deletion.

Short-lived access records: child magic links expire after 15 minutes and pending device approvals after 10 minutes. Expired link and approval records are removed after seven days, and PIN-attempt records after 30 days.

DNS creation and deletion records: private operation and profile references, state and timestamps help track provider work when a response is interrupted or uncertain. They do not contain DNS queries, school correspondence, child content or credentials. Confirmed deletion records are eligible for removal after 30 days; unresolved operations remain available for operator reconciliation rather than being reported as complete.

Optional DNS advisories: these emails are off unless you explicitly opt in in Family Settings. Turning them off cancels queued advisories; an email already sending may still arrive. Completed delivery metadata is eligible for removal after 30 days, through a bounded maintenance sweep, when transport acceptance was acknowledged or a cancellation occurred before any payload was prepared for sending. Acceptance is not proof that an email reached your inbox. Failed records, cancellations with uncertain transport acceptance, and other unacknowledged delivery records remain available for operator review. The application outbox stores identifiers, timestamps, retry state and a keyed payload fingerprint, not email addresses, email bodies or raw DNS queries.

Turnstile challenges: challenge tokens expire after five minutes and can be validated only once. Cloudflare's retention of Turnstile security signals and aggregated service analytics is governed by its Turnstile Privacy Addendum and Privacy Policy.

Abuse-prevention counters: Upstash rate limits use one-minute windows for practice-game requests and ten-minute windows for selected child-access requests, with automatically expiring keys. Canopy disables Upstash rate-limit analytics and sends only a scoped HMAC identifier, counter state, and expiry — not a raw IP address, account or child identifier, account content, PIN, device credential, approval credential, or link token.

Provider copies and backups: follow the provider's applicable retention and backup cycle. For example, Anthropic states that standard commercial API inputs and outputs are deleted from its backend within 30 days unless a different agreement, safety enforcement, or legal requirement applies.

We are continuing to formalise periods for other fields and provider copies. The 30-day child learning period above applies to the application database; provider backups and logs follow their own applicable cycles.

9. Your Rights and Your Child's Rights

As a parent or guardian, you have the following rights under UK GDPR in relation to both your own data and your child's data held by us:

• The right to access all data we hold
• The right to correct inaccurate or incomplete data
• The right to request complete erasure (“right to be forgotten”)
• The right to restrict processing
• The right to withdraw consent at any time without affecting prior lawful processing
• The right to data portability

To exercise a right, contact us at [email protected]. Rights depend on the circumstances and lawful basis. We normally respond within one calendar month and will explain if an extension or exemption applies.

10. ICO Registration

Mackie AI Enterprises Limited is registered with the Information Commissioner's Office under registration number ZC110311.

If you have concerns about how we handle your data that we have not resolved to your satisfaction, you have the right to lodge a complaint with the ICO at ico.org.uk.

11. Changes to This Policy

We will notify all registered parents and guardians of any material changes to this policy by email before they take effect. We will never make retroactive changes that reduce your rights or protections.

The date at the top of this page reflects when this policy was last updated.