← Privacy Policy

COPPA Policy

For Families in the United States  ·  Effective September 1, 2026  ·  Last updated August 7, 2026

This is ilmSpark’s direct notice to parents in the United States under COPPA. It applies to accounts for which the parent selects the United States. It stands on its own and should be read with the Privacy Policy and Terms.

Who this applies to

ilmSpark is directed to children in Grades 1–8. Because grade level does not reliably establish age, every U.S. child profile is treated as belonging to a child under 13 and receives the protections described here.

Who collects information

ilmSpark. Contact: info@ilmspark.com. Phone: (647) 697-1673. Mailing address: 202-2149 Yonge Street, Suite 1027, Toronto, ON M4S 2A2.

What we collect and why

We collect the following from the parent: the child’s first name and grade level. Through the child’s use, we generate answers, correctness, progress through math concepts, and a text transcription of handwritten work produced by our AI provider from a photo that is not retained in ilmSpark’s primary systems.

This information is necessary for core tutoring: evaluating work, generating lessons and hints, and tracking mastery. Account and session information is used for security. Parent contact and billing information is used for parent-account support and billing; child information is not used for billing.

We do not sell child information, use it for advertising, or use it to train our AI provider’s models.

Service providers

Child information is disclosed only to providers acting on ilmSpark’s behalf:

  • The AI evaluation provider processes handwritten-work images and returns results. It does not use child information for advertising or model training under our account configuration; its standard retention is 30 days.
  • Database and hosting providers store or operate the Service.
  • The email provider sends account-related messages to the parent.
  • The payment processor handles verification and subscription billing; child information is not sent to it.
  • We use no advertising network, behavioural analytics vendor, or marketing platform that receives child information.

Retention

Learning and profile data is retained in primary systems while the account is active and deleted within 30 days after a verified deletion request. Routine backups are purged on their regular cycle and used only for disaster recovery. Other retention periods are described in Section 8 of the Privacy Policy.

Parental verification

Before a child profile can be created on a U.S. account:

  • We collect a parent contact email for account, verification, billing, support, safety, and privacy communications. Email verification is not our COPPA consent method.
  • The parent confirms having read and accepted the Terms and Privacy Policy. This is contract assent and is not itself COPPA consent.
  • The parent completes a small credit or debit card transaction through our payment processor, which is refunded immediately once verified.
  • The verified monetary transaction is ilmSpark’s parental-consent method. It is used because the applicable COPPA Rule recognizes a monetary transaction using a payment method that notifies the primary account holder as an approved method. We retain the transaction reference and timestamp. No child information is collected until the required steps are complete, and the account-level gate prevents child-profile creation before successful verification.

If verification fails, no child profile is created and no child information is retained. Verification may be attempted again.

Parent rights

Parents may:

  • Review child information held by ilmSpark.
  • Request correction of inaccurate information.
  • Request deletion.
  • Refuse further collection while keeping the parent account where feasible.
  • Withdraw consent and request account closure and deletion.

Contact info@ilmspark.com. We will respond within a reasonable time consistent with the Privacy Policy. Access may be paused while a request is processed.

Other disclosures

ilmSpark does not use persistent identifiers to track children across websites or services and does not collect audio recordings. A session cookie keeps the parent signed in and is not used for child tracking.

Changes

If we materially change how previously collected U.S. child information is collected, used, or disclosed, we will contact the parent and obtain any new consent required by law before applying the change. This Policy continues to govern previously collected information until it is deleted under the Privacy Policy.