Privacy Policy

Effective Date: October 20, 2025
Last Updated: October 20, 2025

At Thinktopia (accessible at https://thinktopia.ca), the privacy and safety of our users—especially children—are our top priorities. This Privacy Policy explains in detail how we collect, use, protect, and disclose information when you use our website, applications, and AI-driven story generation tools (“Services”).

1. Definitions

"Thinktopia" refers to the platform operated by LaClaire. (“we,” “us,” or “our”).
"Services" means all Thinktopia products, features, websites, mobile applications, and AI content generation tools.
"User" means any individual or organization using the Services, including parents, teachers, and administrators.
"Child User" means any user under the age of 16 (or under 13 where applicable under COPPA).
"User Content" refers to materials (e.g., text, images, audio, prompts) uploaded or generated through the Services.
"Generated Content" refers to AI-created stories, illustrations, and educational materials produced by our systems.

2. Information We Collect

a. Account and Profile Information

Name, email, role (parent, teacher, administrator), and password (securely hashed).
Child profiles: first name or nickname, age, grade level, and learning preferences (only with verified parental consent).
School affiliation for teacher or institutional accounts.

b. Payment Information

Payments are processed securely via Stripe. We do not store full credit card numbers. Billing information (email, amount, subscription plan, and last four digits of the card) may be retained for records.

c. Automatically Collected Information

IP address, browser type, device type, operating system, and access timestamps.
Referrer URLs, pages visited, and general site interaction.
Session identifiers and authentication tokens.
Cookies and local storage (see Section 9).

d. AI Input & Generated Data

Text prompts, story titles, descriptions, and uploaded character or illustration data.
Generated story text, images, and associated metadata (e.g., timestamp, selected art style).
We do not use individual user prompts or generated stories to train our models.

3. How We Use Information

To operate, maintain, and improve our Services and AI models.
To create and personalize stories and educational content for children.
To manage user accounts, verify parental or teacher identities, and provide customer support.
To process payments and manage subscriptions.
To send service notifications, verification emails, or important account updates.
To ensure child-safety monitoring, content moderation, and compliance with applicable laws.
To detect, prevent, or investigate fraud and unauthorized use.

4. Legal Basis for Processing (GDPR / PIPEDA)

We process information based on consent, contractual necessity, legitimate interest, and legal obligations. Parental consent is required for all child data collection.

5. Children’s Privacy and Parental Controls

We comply with the Children’s Online Privacy Protection Act (COPPA), GDPR-K (children’s provisions), and PIPEDA (Canada).
No child can create an account without verified parental or educational institution consent.
Parents and teachers can access, modify, or delete child profiles at any time.
We never display or publish a child’s personal data publicly.
Generated stories and images are stored in secure, access-restricted environments.
We encourage parental supervision and provide clear consent forms during registration.

6. User Uploaded and Generated Content

Ownership

Users retain full ownership of their uploaded or generated content. By submitting content, you grant Thinktopia a limited, non-exclusive license to store, process, and display it solely for the purpose of providing the Services.

Prohibited Content

Offensive, obscene, or discriminatory material.
Content violating copyright, trademark, or privacy rights.
Malware or harmful code.
Personal or identifying information about minors without verified consent.

7. Data Sharing and Disclosure

We do not sell or rent personal data to third parties.
We share information only with service providers necessary to deliver our Services (e.g., hosting, AI infrastructure, email, analytics, payment).
All third-party processors are bound by confidentiality and data-protection agreements.
We may disclose information to comply with legal obligations, prevent fraud, or ensure child safety.
In the event of a merger or acquisition, we will notify users and ensure data protection continuity.

8. Data Retention and Deletion

We retain account data as long as your account is active or as required by law.
Inactive or deleted accounts are anonymized after 12 months.
Parental requests for deletion are honored within 30 days.
Backups containing deleted data are purged on a scheduled cycle (up to 90 days).

9. Cookies and Web Beacons

We use cookies to:

Maintain sessions and authentication.
Save preferences (theme, language, story style).
Analyze site performance via first-party analytics.

We do not use third-party advertising cookies on child-facing pages. Users can manage cookie settings via their browser.

10. AI, Machine Learning & Data Ethics

AI models used in Thinktopia are hosted on secure servers and are not trained using identifiable user data.
Prompts and generated stories are processed transiently and not shared with external AI providers without anonymization.
We use content filters to detect unsafe or inappropriate material in both user inputs and generated outputs.
Teachers and parents can flag or delete any AI-generated content that seems unsuitable.

11. Security Measures

All data in transit is encrypted via TLS 1.3.
Passwords are hashed using bcrypt with salts.
Access to child data is restricted to verified adults only.
Servers are monitored with intrusion detection and access logs.
Regular security audits and penetration tests are performed.

12. International Data Transfers

Your information may be processed on servers located in Canada and the United States. We implement Standard Contractual Clauses (SCCs) and data-protection agreements for all cross-border transfers.

13. Your Rights

Access, correct, or delete your data.
Request portability of stored information.
Withdraw consent at any time (without affecting lawful prior processing).
Request limitation or objection to specific uses (marketing, analytics).

Parents and teachers can manage these rights on behalf of minors via the dashboard or by contacting privacy@thinktopia.ca.

14. Third-Party Services

Payments: Stripe — subject to their own privacy policies.
Analytics: Self-hosted anonymized tracking; no cross-site identifiers.
Storage: (Servers in Canada) with encryption at rest.

15. Changes to This Policy

We may update this policy to reflect service or legal changes. Updates are posted on this page with revision date. Material changes will be communicated via email or in-app notice to parents and teachers.

10. Contact Information

Thinktopia by LaClaire.
Legal Inquiries: legal@thinktopia.ca
Copyright Claims: support@thinktopia.ca
Support: support@thinktopia.ca

17. Consent

By using our Services, you acknowledge and consent to this Privacy Policy, our Terms of Service, and our Children’s Data Protection Policy.

Document Version 1.0 — Comprehensive AI Privacy Framework