Privacy Policy
Effective September 1, 2026 · Last updated August 7, 2026
This Policy explains how ilmSpark collects, uses, discloses, stores, and protects information through ilmspark.com and related applications, including information relating to children. It is intended to comply with PIPEDA for Canadian users and COPPA for United States users. U.S. families should also read the separate COPPA Policy.
1. Who we are
ilmSpark operates an online math tutoring platform for Grades 1–8 and is based in Ontario, Canada. Contact our Privacy Officer at info@ilmspark.com. We aim to acknowledge privacy inquiries within five business days.
2. Scope
This Policy covers parents and guardians who create accounts and children whose learning activity is recorded under those accounts. Children may not create accounts, provide consent, or sign in independently. Every child profile is controlled by the parent account holder.
3. Consent
The parent creates the account, reviews this Policy and the Terms, accepts the applicable notices, provides child profile information, and may withdraw consent or request deletion. For U.S. accounts, a child profile cannot be created and no child information can be collected until the qualifying parental-verification process in the COPPA Policy is completed.
4. Information collected
Parent information
Email address; password hash where applicable; name; time zone; Google account email and name if Google sign-in is used; and payment processor identifiers, plan, billing interval, status, and billing dates. ilmSpark does not store card numbers.
Child profile information
First name and grade level, provided by the parent. We do not request a child’s date of birth, home address, photograph, or school name.
Learning information
Attempts, answers, correctness, question data, confidence scores, misconception codes, hints used, text transcriptions of handwritten work, mastery status, misconception patterns, review schedules, session identifiers, and checkpoint results.
We do not knowingly collect a child’s precise geolocation, contacts, audio, or video.
5. Purposes
We use information to create and secure accounts; personalize curriculum and lessons; evaluate submitted work; generate lessons, reviews, and hints; track progress; operate subscriptions and billing; send parent account and progress communications; maintain security; and conduct limited internal quality review using stored text transcriptions and evaluation results.
We do not sell information, use child information for behavioural advertising, or use child submissions or progress data to train or improve underlying AI models beyond generating that child’s own lesson or response.
6. Processing and storage
Account and progress data is stored with our database provider in Canada Central. A handwritten-work image is sent from our server to the AI evaluation provider, which returns an evaluation, confidence score, transcription, and any misconception code. The image is not written to ilmSpark’s database or file storage and is not retained in ilmSpark’s primary systems.
The AI provider acts on our behalf and may use subprocessors. Our account is configured for standard 30-day retention on the provider’s systems; during that period data may be accessed only for safety and security purposes. The provider is not permitted to use the data for advertising or model training under our configuration and commercial terms.
For AI hints, the relevant question, incorrect answer, and conversation history are sent to the AI provider. ilmSpark does not write the hint conversation to its database and stores only the number of hints used.
Email is delivered by an email provider; payments are processed by a payment provider. Providers are selected for appropriate contractual data-protection commitments and may process information only to provide services to ilmSpark.
7. Disclosures
We disclose information only to service providers operating the platform; law enforcement or regulators where legally required; and a successor entity in a merger, acquisition, or sale, subject to applicable notice requirements. We do not share child information with other parents, children, or the public.
8. Retention and deletion
Account and child profile data is retained while the account is active and deleted after a verified deletion request. Learning data is retained while needed to provide ongoing progress tracking and is deleted after a verified deletion request or account closure. Billing records are retained for the period required for tax, accounting, fraud, and dispute purposes. Support, security, and operational logs are retained only as needed for their stated purposes.
Upon a verified deletion request, applicable data is deleted from primary systems within 30 days, except records required to be retained by law. Routine backups are purged on their regular cycle and used only for disaster recovery during that period. Vendor deletion requests are made as appropriate.
9. Security
We use safeguards appropriate to the sensitivity of information, including encryption in transit and at rest through our infrastructure, access controls, segregation of family data, and verification of parent ownership before access, correction, or deletion requests. No system is completely secure.
10. Access and correction
A parent may request access to, correction of, or deletion of their or their child’s information, withdraw consent, or request that further collection stop. Contact info@ilmspark.com. Canadian requests are handled in accordance with PIPEDA, generally within 30 days. U.S. parental rights are described in the COPPA Policy.
11. U.S. COPPA notice
For United States families, the separate COPPA Policy at ilmspark.com/coppa provides the direct notice, explains the information collected from children, identifies service-provider categories, describes parental verification, and explains parental access, correction, deletion, and withdrawal rights. It is incorporated into this Policy for U.S. accounts.
12. Cookies and analytics
Our public website, ilmspark.com, uses Google Analytics 4 to understand how visitors find and use the site. Google Analytics uses cookies and collects information such as pages viewed, general location (city or region level), device and browser type, and how a visitor arrived at the site. We do not use advertising cookies, cross-site advertising tracking, or device fingerprinting, and this analytics tool does not run on child accounts or child-facing parts of the Service. The authentication system separately sets a session cookie to keep a parent signed in. We do not use child information for advertising. Visitors may opt out of Google Analytics using Google’s opt-out browser add-on.
13. Complaints
Contact info@ilmspark.com first. Canadian parents may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. U.S. parents may complain to the Federal Trade Commission at reportfraud.ftc.gov.
14. Changes
We will notify parents of material changes before they take effect. If a change materially affects previously collected U.S. child information, we will obtain any consent required by law before applying it.
15. Contact
ilmSpark · Ontario, Canada · info@ilmspark.com