Privacy & Security Policy
We built MiSpark to keep your family's data safe from the open web. Here is exactly how we protect you.
No Public AI Training
Unlike public AI chatbots, the data you enter into MiSpark is sent via secure enterprise API endpoints. Your child's profiles, interests, and struggles are never used to train public AI models.
Strict Data Siloing
Your account utilizes Row Level Security (RLS). This means your digital backpack, learner profiles, and generated plans are cryptographically locked to your specific user ID.
1. Information We Collect
To provide our services, we collect minimal data:
- Account Information: Your email address and secure authentication data.
- Learner Profiles: We deliberately ask for nicknames, not full legal names. We collect grade levels, focus durations, broad zip codes (for local field trips), and learning preferences to customize your curriculum.
- Feedback Data: Hearts and stars ratings you provide on generated activities so our system can learn your child's preferences.
2. Children's Privacy (COPPA)
MiSpark is designed strictly for use by parents, educators, and legal guardians. It is not intended for use directly by children under the age of 13. By using MiSpark, you represent that you are the parent or legal guardian inputting non-identifying preferences (nicknames) to generate educational materials.
3. Third-Party Services
We use trusted, industry-standard infrastructure to run MiSpark:
- Supabase: For secure database hosting and authentication.
- Stripe: For secure payment processing. We never see or store your credit card information.
- Enterprise LLMs: We use secure, zero-retention API agreements to generate lesson plans. Your prompts are processed and immediately discarded by the model providers, not saved for training.
Your Right to Delete & Data Retention
You own your data. At any time, you can request a complete deletion of your account, all associated learner profiles, and generated portfolios by contacting support or via your account dashboard. Upon verification of your request, your personal data will be hard-deleted from our active databases within 30 days. Once deleted, this data cannot be recovered.