Privacy Policy

HysonLearn (“we”, “us”, “our”) provides a child-first learning platform for primary-school children. This policy explains how we collect, use, and protect personal data for parents who use our service and for the children whose accounts they create.

The platform is currently offered as a private alpha to invited households in the United Kingdom and Hong Kong. We act as the data controller for the personal data described below.

• Parent account: name, email address, hashed password, account creation and last-login timestamps.
• Child profile: first name (or chosen display name), year group, and an age derived from date of birth. We do not store contact details for children.
• Learning data: answers a child gives to questions, time spent on tasks, badges earned, avatar choices, and which lessons have been completed.
• Optional voice notes:short voice recordings a child may make while using certain activities. These are kept on the child's account and only used to play the recording back.
• Technical data: session cookies that keep the child logged in, a small amount of error-diagnostic data (e.g. which page failed to load) and basic usage counts. We do not use marketing or advertising trackers.

For users in the UK, we rely on the following lawful bases under UK GDPR:

• Contract — to provide the service the parent has signed up for (creating accounts, saving progress, showing the right lessons).
• Legitimate interests— to keep the service safe, debug problems, and improve learning content. We balance this against the rights of children and apply extra safeguards where children's data is involved.
• Consent— for any optional features (such as voice notes) and for anything that processes a child's data beyond what the parent has set up. Consent can be withdrawn at any time.

For users in Hong Kong, we collect and use personal data in line with the Personal Data (Privacy) Ordinance (Cap. 486) and the six Data Protection Principles. The categories of purpose above are also the purposes for which Hong Kong users' data is collected.

HysonLearn does not sell personal data. We share limited data with the following processors only as needed to run the service:

• Vercel— hosts the application and runs scheduled jobs. Application data passes through Vercel's edge and serverless infrastructure.
• ElevenLabs— text-to-speech provider used to generate audio for certain lessons. Text we send for speech synthesis does not include a child's personal details.
• AI language-model features are currently disabled. The Ask-Hyson hints and AI-written weekly summaries do not run, and no child data is sent to any third-party AI provider. We will not enable these features until data-processing agreements are in place; this policy will then name the specific providers and the safeguards that apply.
• Email provider — for transactional messages such as password resets and invitation emails. (Specific vendor to be confirmed before general release.)

We may also share data where we are legally required to, for example in response to a valid request from a regulator or law-enforcement body in the UK or Hong Kong.

Our hosting and AI processors operate from data centres in the United Kingdom, the European Economic Area, the United States, and other jurisdictions. When personal data leaves the UK or Hong Kong we rely on transfer mechanisms permitted by UK GDPR (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) and on the cross-border requirements of the PDPO. The specific transfer mechanism for each processor will be documented in the next version of this policy.

We keep parent and child account data for as long as the account is active, plus a short period afterwards in case the parent reactivates. When you delete an account we delete the personal data associated with it within 30 days, except where we are required to retain it for legal or audit reasons. Anonymised, aggregated learning statistics may be kept for longer to improve the service.

Because HysonLearn is in private alpha, we may also wipe data between alpha and general release — see the Beta Program Terms.

Under UK GDPR you have the right to:

• access the personal data we hold about you or your child;
• ask us to correct inaccurate data;
• ask us to delete data (the “right to be forgotten”);
• restrict or object to certain processing;
• request a copy of your data in a portable format;
• withdraw any consent you have given;
• complain to the Information Commissioner's Office (ico.org.uk).

Under the PDPO you have the right to:

• be informed about whether we hold personal data about you;
• request a copy of your personal data;
• request correction of inaccurate personal data;
• complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (pcpd.org.hk).

We may charge a small fee for data-access requests as permitted by the PDPO.

Children's accounts on HysonLearn are created and managed by a parent or guardian. Parents can review, export, and delete their child's data at any time from the parent dashboard. For more detail see our Children's Privacy Notice, which describes how we apply the ICO's Age Appropriate Design Code (the “Children's Code”) to children in the UK and equivalent protections for children in Hong Kong.

Passwords are stored only as cryptographic hashes; we never store passwords in plain text. Data in transit is protected with TLS. Access to production data is limited to a small number of named operators. We will publish a more detailed security overview before general release.

We may update this policy as the platform evolves. When we make material changes we will notify the parent account holder by email and post a banner inside the app. The “Last updated” date at the top of this page records the most recent change.

If you have a question about this policy or want to exercise any of the rights described above, contact us at privacy@hysonlearn.com.

A named Data Protection Officer will be listed here before general release.