Last Updated: March 5, 2026

Privacy Policy

At Techwillow Studio (“we,” “our,” or “us”), protecting your privacy is fundamental to our mission. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our AI-powered educational platform at studio.techwillow.ca.

We are committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law, as well as applicable provincial privacy legislation and globally recognised privacy standards including the EU/UK GDPR where applicable.

1. Accountability

Techwillow Studio is the organisation responsible for the personal information it collects and controls. Our Privacy Officer is accountable for our compliance with PIPEDA and can be reached at:

2. Information We Collect

2.1 Account Information

When you register for an account, we collect personally identifiable information, including:

  • Full name and email address — used to create and authenticate your account.
  • Password — stored as a bcrypt hash; we never store plain-text passwords. If you register via Google Sign-In, no password is stored by us.
  • Google account information — if you choose to sign up or log in using Google, we receive your name, email address, and Google account identifier from Google. We do not receive your Google password or payment information.
  • Subscription and billing information — processed and stored exclusively by Stripe, our third-party payment processor. We do not store complete payment card numbers or CVV codes on our servers.

2.2 Children’s Information

Techwillow Studio allows parents and legal guardians to create child profiles for the purpose of generating personalised educational worksheets. We are deeply committed to protecting children’s privacy.

  • Limited collection: We collect only the child’s first name (or a nickname chosen by the parent), their grade level, and selected learning preferences. No contact information is solicited from or about children.
  • Parental control: All child profiles are created, managed, and deleted entirely by the parent account holder. Children cannot independently register or modify their profiles.
  • No marketing: We never use children’s data for advertising, profiling, or any purpose beyond generating educational content.
  • Consent: By creating a child profile, the parent or legal guardian expressly consents to the limited collection and use of that child’s information as described in this policy.

2.3 Usage and Technical Data

We automatically collect certain information when you use the Service:

  • Log data: IP address, browser type, operating system, referring URL, and pages visited.
  • Usage metrics: Number of worksheets generated, topics selected, difficulty settings chosen, and time on platform. This data is used solely to improve the Service.
  • Device information: Device type, screen resolution, and unique session identifiers.
  • IP addresses for rate limiting: IP addresses are temporarily stored in our rate-limiting system to prevent abuse of public-facing features. These records are automatically purged on a rolling basis and are not linked to your account profile.

2.4 AI-Generated Content

Worksheet generation and our educational chatbot are powered by third-party AI inference services. When you use these features, only the relevant educational parameters (grade, subject, topic, difficulty, and your question) are transmitted to the AI provider. No personally identifiable information about you or your child is transmitted to any AI provider.

We use the following AI providers, depending on availability:

We identify the purposes for which personal information is collected before or at the time of collection. When you create an account via email, you are asked to affirmatively check a box accepting this Privacy Policy and our Terms of Service. When you register using Google Sign-In, a notice is displayed at the point of registration. This constitutes your expressed consent to the collection, use, and disclosure of your personal information for the following purposes:

  • Service delivery: To provide, operate, and maintain our worksheet generation platform.
  • Personalisation: To tailor educational content to your child’s grade and curriculum requirements.
  • Communication: To send transactional emails such as account confirmation, subscription updates, usage notifications, and security alerts. We do not send marketing emails without your explicit consent.
  • Platform improvement: To analyse aggregated, anonymised usage patterns and improve our AI models and user interface. Individual user data is never sold.
  • Security and fraud prevention: To detect, investigate, and prevent fraudulent transactions and other illegal activities.
  • Legal compliance: To meet our obligations under applicable laws and regulations.

You may withdraw your consent at any time by submitting an account deletion request through your account settings or by contacting our Privacy Officer. Withdrawal of consent may result in our inability to provide certain services to you.

4. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information. We may share your information only in the following limited circumstances:

  • Service providers (processors): We engage the following trusted third-party service providers who act as data processors on our behalf. Each is bound by data processing agreements and is prohibited from using your data for their own purposes:
    • Supabase — database hosting and authentication (servers may be located in the United States).
    • Vercel — application hosting and edge delivery (servers may be located in the United States and other regions).
    • Cloudflare R2 / Cloudflare Workers — PDF file storage and AI inference delivery (servers may be located in the United States and other regions).
    • Stripe — payment processing and subscription management.
    • Brevo (formerly Sendinblue) — transactional email delivery.
    • Google — identity provider (Google Sign-In) and AI inference (Google Gemini fallback). Google’s use of data received through Google Sign-In is governed by the Google Privacy Policy.
    • Groq — AI question generation (curriculum parameters only; no PII transmitted).
  • Legal requirements: We may disclose information if required to do so by Canadian law or in response to valid requests by government authorities (e.g., a court order or a government agency acting within its lawful authority).
  • Business transfers: If Techwillow Inc. is involved in a merger, acquisition, or asset sale, your personal information may be transferred. If this occurs, we will notify you by email and/or prominent notice on our website at least 30 days before your information becomes subject to a different privacy policy.

5. International Data Transfers

Some of our service providers operate servers outside of Canada, including in the United States. When your personal information is transferred outside of Canada, it may be subject to the laws of the country where it is stored or processed, which may differ from Canadian privacy law. By using our Service, you acknowledge this transfer. We take commercially reasonable steps to ensure that our service providers protect your data in a manner consistent with this Privacy Policy.

6. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes identified in this policy, or as required by applicable law:

  • Active accounts: Account data is retained for the duration of your account.
  • Worksheet PDF retention by plan:
    • Explorer: Your 3 lifetime worksheets and PDFs are stored permanently.
    • Starter: Worksheets and PDFs are automatically deleted 90 days after generation.
    • Professional & Premium: Worksheets and PDFs are stored permanently while your subscription is active. Upon cancellation or downgrade, a 90-day grace period applies before permanent deletion.
  • Deleted accounts: Upon a confirmed account deletion request, personal information is permanently purged within 30 days. All generated worksheet PDFs stored in cloud storage are deleted at the same time.
  • Aggregated analytics: De-identified, aggregated data may be retained indefinitely for platform improvement.

7. Data Security

The security of your data is a priority. We implement industry-standard safeguards including:

  • TLS/SSL encryption for all data transmitted between your browser and our servers.
  • Encryption at rest for database data via Supabase’s AES-256 encryption.
  • Row Level Security (RLS) policies ensuring users can only access their own data within our database.
  • Access to personal data is restricted to authorised personnel on a need-to-know basis.

No method of electronic transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

8. Security Breach Notification

In the event of a security breach that poses a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible in accordance with PIPEDA’s breach notification requirements. Notification will be provided via email to the address associated with your account, and will include the nature of the breach, the information affected, and steps we are taking to mitigate harm.

9. Your Rights Under PIPEDA

As a Canadian resident, you have the following rights with respect to your personal information:

  • Right of access: You may request a copy of the personal information we hold about you.
  • Right to correction: You may request that we correct inaccurate or incomplete personal information.
  • Right to withdraw consent / erasure: You may request deletion of your account and associated personal information via your account settings.
  • Right to complain: If you believe we have not handled your personal information in accordance with PIPEDA, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, please contact our Privacy Officer at privacy@techwillow.ca. We will respond within 30 days of receiving your request, as required by PIPEDA.

10. Cookies

We use cookies and similar tracking technologies. Please see our Cookie Policy for full details.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by posting the revised policy on this page, updating the “Last Updated” date, and sending an email notification to registered users at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the revised policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our Privacy Officer: