Privacy Policy

1. General information and data controller

This Privacy Policy describes the principles of processing personal data in the Sibot Academy educational service available at sibotacademy.pl.

Sibot Academy is an educational platform for children aged 7 and above, providing interactive quizzes and lessons about artificial intelligence. Access is only possible through an account created by a parent or legal guardian.

2. Child protection principles — key information for parents

Children under 13 do not have full legal capacity to enter into contracts. Therefore:

• Only the parent or legal guardian is the contracting party.
• The child is an authorised user — they do not enter contracts or give consent.
• All consents to data processing (beyond those strictly necessary to provide the service) are given by the parent.
• The parent may delete the account and child profile at any time.

3. What data we process

3.1 Parent account data

• Email address (for login and communication).
• Password (stored as a cryptographic hash — never in plain text).
• Billing data (where applicable, depending on the chosen plan).
• Consent history (timestamp, scope, document version).

3.2 Child profile data

• Nickname or first name (we recommend using a nickname rather than a full name).
• Lesson and quiz progress (completed modules, star count, results).

3.3 Technical and security data

• Session identifiers and authentication tokens.
• Security logs (anonymised or pseudonymised).
• Browser and device information (to ensure the service works correctly).

4. Purposes and legal bases for processing

5. Privacy by default and data minimisation

Sibot Academy applies the principles of privacy by default and privacy by design (Article 25 GDPR):

• We collect only data that is strictly necessary to operate the service.
• Default settings are always the most privacy-protective option.
• We do not apply advertising profiling to children or adult users.
• Text entered by the child in quizzes is not logged in analytics systems.
• Third-party integrations are kept to the absolute minimum necessary.

6. Cookies and tracking technologies

6.1 Types of cookies

We use only two types of cookies:

• Essential cookies — required for the service to function (session, authentication, settings). No consent required.
• Analytics cookies — only after the parent gives consent in account settings.

6.2 Consent management

On your first visit, a cookie banner is displayed with the option to:

• Accept essential cookies only (the default option).
• Optionally consent to analytics cookies.
• Withdraw consent at any time in account settings.

7. Data recipients — sub-processors

Data may be shared only with trusted sub-processors necessary to operate the service:

• Hosting and server infrastructure provider (located in the EEA or with appropriate transfer safeguards).
• Authentication system provider (Clerk — managing parent accounts).
• Database provider (Neon Postgres — storing progress data).
• Email provider (optional, only for parents who have given consent).

We do not share data for advertising purposes, do not sell data, and do not disclose it to any third parties beyond the sub-processors listed above.

8. Data security

We apply appropriate technical and organisational measures (Article 32 GDPR):

• Encryption of data in transit (HTTPS/TLS).
• Passwords stored only as cryptographic hashes.
• Server-side moderation of content entered by the child.
• Restricted access rights for staff.
• Regular security reviews.

9. Rights of parents and users

As a parent or legal guardian, you have the right to:

• Access — you may check what data we hold at any time.
• Rectification — you may correct inaccurate data in your account settings.
• Erasure — you may delete the account and all child data.
• Restriction of processing — you may request that processing be paused.
• Data portability — you may receive your data in a structured format.
• Object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting prior processing.

To exercise your rights, contact us at kontakt@sibotacademy.pl. We will respond within 30 calendar days.

You also have the right to lodge a complaint with your national data protection authority. In the UK: Information Commissioner's Office (ICO) — ico.org.uk. In the EU: your country's supervisory authority.

10. Privacy policy for children (simplified version)

11. Changes to this Privacy Policy

We will notify parents of any significant change to this Privacy Policy with at least 14 days' notice via email or an in-app message. Continued use of the service after changes take effect constitutes acceptance of the updated policy.

12. Contact

Sibot Academy | sibotacademy.pl | Privacy Policy | Version 1.0 | 1 April 2026