DRAFT — NOT FINAL. NOT LEGAL ADVICE. DO NOT PUBLISH. This is a structural starting point for counsel to review and complete, grounded in what the product actually does as of 2026-10-23. Every bracketed [TODO] is a fact only Hafid or counsel can supply. See README.md in this folder for what each factual claim below is based on in the real code.

Privacy Policy (draft)

Last updated: [TODO — date of actual publication, not this draft]

Who we are

TutoLys is operated by [TODO — exact legal entity name, e.g. “BylTek Labs Inc.” — and its jurisdiction of incorporation]. You can reach us about privacy matters at info@tutolys.ca ([TODO — postal address]). [TODO — once Quebec Law 25 applies, name the designated person responsible for the protection of personal information (“responsable de la protection des renseignements personnels”) — this is a legal requirement, not optional, and none has been named yet].

What TutoLys is, and who it’s for

TutoLys is a learning platform for children in Quebec’s elementary curriculum (JK through grade 6). An adult — a parent/guardian, or a school on behalf of its students — creates and manages the account. A kid accesses the app on a device paired to that account by a one-time code; a kid never creates their own account, sets their own password, or provides information directly to us.

Information we collect

From the adult (guardian, tutor, or school administrator)

• Email address and password (stored as a cryptographic hash, never in plain text).
• Display name and preferred language, if provided.
• Organization information (household, solo-tutoring practice, or school) and your role within it.
• Subscription and billing status. We do not store your card number or other payment details — these are handled directly by our payment processor, Stripe; we retain only a Stripe-issued customer reference and subscription identifier.

About the kid, provided by the guardian

• A nickname — never the child’s full legal name.
• Grade level.
• Birth year only — never a full date of birth.
• A key identifying a bundled, pre-set avatar — never an uploaded photo or any image of the child.
• A record that you consented to this collection: the date/time, and which guardian account gave it.

Generated by the kid’s use of the app

• Which exercises were attempted, whether the answer was correct, how long it took, and whether a hint was used. This is used to compute progress indicators (mastery of a skill, play streaks) shown to the guardian or an authorized tutor — never shared outside the organization that created the kid’s profile.
• Device and session identifiers needed to keep this data correctly attributed and secure, not for tracking across other services.

Why we collect it

• To operate the core product: present age/grade-appropriate exercises, track progress against Quebec’s official curriculum (PFEQ), and show a guardian or tutor what a child has learned.
• To operate the account: authentication, billing, and support.
• To meet our own legal and security obligations (e.g., responding to a data-subject request, detecting abuse).

We do not use a child’s data for advertising, and do not sell personal information to any third party. [TODO — counsel to confirm this statement matches final business practice before publishing, especially if any analytics/advertising vendor is added later.]

Who we share it with

• Stripe (payment processing) — for guardians/schools on a paid plan. Stripe receives payment details directly; we never see or store them.
• SendGrid (transactional email) — to deliver account emails (invitations, password resets). SendGrid does not receive a child’s information, only the guardian’s email address and message content.
• A school’s own staff, if the account is a school organization — scoped to the students actually assigned to that staff member, not the whole school.
• [TODO — hosting/infrastructure provider, once Track C’s hosting decision is made. This affects where data is physically stored and which jurisdiction’s rules on cross-border transfer apply — must be filled in before publication, not left as a placeholder.]

We do not share a child’s information with any other party, and do not permit any processor to use it for their own purposes.

How long we keep it

• Raw gameplay event data is compressed after 30 days and permanently deleted after 24 months from when it was recorded.
• Account and profile data (guardian account, kid profile, progress summaries, reports) is kept for as long as the account is active, or until you request deletion (see “Your rights,” below).
• If you close your account, kid profiles are archived (hidden, not visible to anyone, but not yet erased) unless you specifically request erasure.

Your rights

As the guardian who manages a kid’s profile, you can:

• Access and export everything we hold about your kid — their profile, progress, and any reports generated — as a single downloadable file, from within the product (an organization administrator feature today; a self-serve guardian-facing surface in the website is not built yet — see Track F).
• Request erasure (“right to be forgotten”). This permanently deletes your kid’s raw gameplay history and anonymizes their profile (we keep enough of a record — with the personal details removed — to avoid corrupting a tutor’s or school’s own historical reports that reference it, rather than silently breaking them).
• Correct inaccurate information, by editing the profile directly.
• Withdraw consent at any time, which we treat as an erasure request.

To exercise these rights today, contact [TODO — support email/process — no self-serve guardian-facing flow exists yet outside an organization administrator].

Security

Passwords are never stored in plain text. Communication between our services uses short-lived, narrowly-scoped credentials rather than a long-lived shared secret, so that a credential used for one purpose (e.g., reading progress) cannot be reused for another (e.g., deleting data). [TODO — counsel/Hafid to add any further security commitments, and confirm against the hosting decision once made.]

Children’s privacy

This service is directed, in part, at children under 13, and is designed around that from the ground up: a child never creates their own account or provides information directly to us — only a verified adult does, and we require an explicit, logged consent action before any child profile is created. [TODO — counsel to confirm specific COPPA verifiable-parental- consent-method requirements are met by the current flow, and to address Quebec Law 25’s specific provisions for minors’ data, which differ in some respects from COPPA.]

Changes to this policy

[TODO — standard “we’ll notify you of material changes” clause, to be drafted by counsel alongside the final version.]

Contact us

[TODO — final contact details.]