Privacy Policy

1. Who We Are

Wizzy ("wizzytutor.com") is an AI-powered educational tutoring application for Filipino students in Grades 4-10. We are committed to protecting the privacy of our users, especially children, in accordance with the Philippines Data Privacy Act of 2012 (RA 10173) and the National Privacy Commission's guidelines on child-oriented data processing.

2. What Data We Collect

From Parents:

• First name and last name
• Email address or phone number
• Payment information (processed by PayMongo — we do not store card details)

From Children (via parent consent):

• First name (display name chosen by parent)
• Grade level
• Photos of textbook pages (for lesson generation)
• Lesson progress, quiz answers, and learning activity data

From Teachers:

• Full name
• Email address or phone number
• School name and type (optional)
• Grade levels and subjects taught (optional)
• Photos of textbook pages (for material generation)

Automatically collected:

• Device type and browser information
• Usage patterns (lessons generated, features used)
• Error logs for troubleshooting

3. Why We Collect This Data

We collect only what is necessary to provide our educational service:

• Names: To personalize the learning experience
• Email/phone: Account authentication, password recovery, payment receipts
• Grade level: To generate age-appropriate educational content
• Textbook photos: To analyze and generate lessons from educational materials
• Learning data: To track progress and provide meaningful feedback to parents
• Payment data: To process credit purchases (handled by PayMongo)

4. How We Protect Your Data

• Data is stored securely using Supabase (cloud infrastructure with encryption at rest)
• All data transmission uses HTTPS encryption
• Payment processing is handled by PCI-compliant PayMongo — we never see or store card numbers
• Child login PINs are verified using cryptographic signatures
• Single-device session enforcement prevents unauthorized account sharing
• Textbook photos are stored in secure cloud storage with access controls

5. Children's Privacy

We take children's privacy seriously in accordance with NPC Advisory No. 2024-03:

• Only parents can create child profiles — children cannot self-register
• We collect minimal data from children (first name, grade level, learning progress)
• We do not collect children's email addresses, phone numbers, birthdates, or physical addresses
• We do not use children's data for advertising or marketing
• We do not share children's personal data with third parties except as needed for the service (AI processing, cloud storage)
• Geolocation, public profiles, and direct messaging are not available to children
• Parents can request deletion of their child's data at any time

6. AI Processing

Wizzy uses Claude (by Anthropic) to analyze textbook photos and generate educational content. When you submit a photo:

• The image is sent to Anthropic's API for analysis
• Anthropic processes the image to extract educational content
• Generated lessons are stored in our database for your continued access
• Anthropic does not retain the images or use them for training their AI models

Text-to-speech audio is generated via ElevenLabs. The text content is sent for audio synthesis and is not retained by ElevenLabs for other purposes.

7. Data Sharing

We do not sell your personal data. We share data only with:

• Anthropic (Claude AI): Textbook photos and educational content for lesson generation
• ElevenLabs: Text content for audio narration
• Supabase: Database and file storage
• PayMongo: Payment processing
• Law enforcement: Only when required by Philippine law or court order

8. Your Rights Under RA 10173

As a data subject under Philippine law, you have the right to:

• Be informed — know what data we collect and why
• Access — request a copy of your personal data
• Correct — update inaccurate personal data
• Erase — request deletion of your data
• Object — object to data processing
• Data portability — receive your data in a usable format
• File a complaint — with the National Privacy Commission

To exercise any of these rights, contact us at [email protected].

9. Data Retention

We retain your data only as long as necessary:

• Account data: Until you delete your account
• Lesson content: Until you delete the lesson or your account
• Payment records: As required by Philippine tax law (minimum 10 years)
• Textbook photos: Until the lesson is deleted

When you delete your account, we delete all personal data within 30 days, except where retention is required by law.

10. Data Breach Notification

In the event of a data breach that affects your personal data, we will notify you and the National Privacy Commission within 72 hours, as required by RA 10173. If your child's data is affected, we will notify both you (the parent) and provide age-appropriate notice.

11. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or legal requirements. We will notify you of material changes through the app or via email.

12. Contact Us

For privacy concerns or to exercise your data rights:

Email: [email protected]

National Privacy Commission: https://privacy.gov.ph