This Privacy Notice explains how Bright Path schooling ("we", "us", "our") collects, uses, shares, and protects personal data when you use BrightPathSchooling (the "Service"). We act as the data controller for personal data processed through the Service, except where Paddle.com Market Limited acts as controller for payment data (see "Data sharing" below).
1. Categories of personal data we collect
- Account data: parent name, email address, hashed password, and login identifiers.
- Family profile data: child first name, grade level, and selected curriculum region (province or state).
- Learning data: lessons viewed, quiz answers, scores, streaks, and progress records.
- Support and communications: messages you send us through the contact form or email.
- Usage and device data: IP address, browser and device type, pages viewed, and diagnostic logs, used for security and product improvement.
- Cookies and similar technologies: essential cookies for authentication and preferences. We do not use advertising cookies.
Payment card details are collected by Paddle directly and are not stored on our servers.
2. Purposes and legal bases
- Provide the Service — creating your account, delivering lessons and quizzes, tracking progress. Legal basis: performance of a contract.
- Security and fraud prevention — protecting accounts and systems. Legal basis: legitimate interests.
- Customer support — responding to your requests. Legal basis: performance of a contract and legitimate interests.
- Product improvement — understanding how the Service is used to make it better. Legal basis: legitimate interests.
- Legal compliance — meeting tax, accounting, and other legal obligations. Legal basis: legal obligation.
3. Children's data
BrightPathSchooling is intended to be operated by a parent or legal guardian on behalf of their child. The parent creates the account and provides the limited child profile information needed to personalize learning (first name, grade, curriculum). We do not knowingly collect personal data directly from children without parental involvement. Parents can view, update, or delete their child's profile at any time from the parent dashboard.
4. Data sharing
We share personal data only with:
- Service providers / subprocessors that help us run the Service, including cloud hosting, database, authentication, and email delivery providers, and Google (Gemini API) for generating lesson and quiz content;
- Paddle.com Market Limited, our Merchant of Record, which independently processes payments, manages subscriptions, handles tax compliance, and issues invoices;
- Professional advisers such as accountants and lawyers where required;
- Authorities where we are legally required to disclose information.
We do not sell personal data, and we do not share it for third-party advertising.
5. International transfers
Our infrastructure and some subprocessors may process data outside your country of residence, including in Canada, the United States, and the European Economic Area. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.
6. Retention
We keep personal data only as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Account and learning data are retained while your account is active and typically deleted or anonymized within 12 months after your account is closed, unless a longer period is required by law.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing of your personal data, to data portability, to withdraw consent, and to lodge a complaint with your local data protection authority. You can exercise most rights directly in the parent dashboard, or by contacting us. We respond within the timeframes required by applicable law (generally within one month for GDPR requests).
8. Security
We use appropriate technical and organizational measures to protect personal data, including encryption in transit, encrypted storage, access controls, and audit logging. No system is completely secure; if we become aware of a security incident affecting your data, we will notify you as required by law.
9. Cookies
We use a small number of essential cookies to keep you signed in and remember your preferences. We do not use advertising or cross-site tracking cookies. You can manage cookies through your browser settings; disabling essential cookies may prevent parts of the Service from working.
10. Changes to this Notice
We may update this Privacy Notice from time to time. Material changes will be communicated through the Service or by email. The "Last updated" date at the top of this page always reflects the current version.
11. Contact
For privacy questions or to exercise your rights, contact us via the contact form on our homepage. For payment-related privacy questions, please contact Paddle at paddle.com/legal/privacy.