Privacy Policy

1. Children’s Privacy (COPPA Compliance)

Protecting the safety and privacy of young learners is foundational to our mission. In strict adherence to the Children’s Online Privacy Protection Act (COPPA):

• Parent-Managed Accounts: All accounts, course enrollments, and purchases on Zoe Academy Kids are created and managed exclusively by parents, legal guardians, or verified church educators.
• No Direct Profiling of Children: We do not require or collect full legal names, physical addresses, school names, or government IDs of children. Any child profiles created within the parent dashboard require only a non-identifying nickname to track lesson completion and badges.
• Zero Commercial Advertising: We never display third-party advertisements to children, and we never sell, rent, or trade student progress or family information to third-party data brokers or advertisers.
• Parental Rights: Parents have the right at any time to review, modify, or permanently delete their child’s profile, scores, and activity records by contacting us at hello@thezoeacademy.com.

2. Information We Collect

We collect only the minimum necessary information to provide educational curriculum, interactive learning tools, and support:

• Account & Contact Information: Parent first and last name, email address, and role (Parent / Homeschooler or Church Leader) provided when requesting sample kits or purchasing courses.
• Royal Stewardship Adventure (free game): The game has no child accounts, ads, or tracking. A child’s typed name stays on the device and is never sent to us. Only if a parent chooses to receive the free storybooks and first lesson, we collect the parent’s first name, email address, and the child’s age group (5-8 or 9-12).
• Payment & Transaction Information: When you purchase single courses, bundled suites, or subscriptions (such as Teen Guild), payments are processed securely by Stripe, Inc. Zoe Academy never receives, transmits, or stores full credit card numbers or banking credentials. Stripe retains transaction records under PCI-DSS Level 1 compliance.
• Progress & Learning Records: Lesson completion timestamps, quiz scores, and certificate issuance records tied to your private parent account.
• Technical & Security Data: IP addresses (used exclusively for rate-limiting, security validation, and fraud defense), browser headers, and session tokens.

3. How We Use Your Information

Your information is used strictly to fulfill educational commitments:

• Deliver digital workbooks, parent guides, and audio stream access.
• Issue secure 90-day private access links and magic sign-in links to your library.
• Process billing, invoices, and manage 30-day money-back guarantee requests.
• Send requested curriculum follow-ups, devotional roadmaps, and ministry updates (with one-click unsubscribe in every email).
• Ensure system performance, authentication reliability, and platform security.

4. Third-Party Service Providers

We partner only with industry-leading, privacy-compliant infrastructure providers to operate the academy:

• Stripe: Payment gateway and subscription management.
• Supabase: Encrypted cloud database and identity authentication.
• Resend: Secure transactional email bridge for receipts and magic sign-in links.
• ElevenLabs: Narration voice synthesis and audio playback delivery.
• Vercel: Edge hosting, CDN routing, and Web Application Firewall (WAF).

Each service provider is contractually bound to process data solely to execute required platform services and is prohibited from utilizing family data for independent marketing.

5. Data Retention & Security

We employ industry-standard encryption protocols (TLS/SSL) for all data in transit and AES-256 encryption at rest. Private curriculum links are protected by cryptographically signed tokens that expire automatically. We retain parent account and enrollment records only for as long as necessary to maintain active course access and meet legal accounting obligations.

6. Your Rights (GDPR & CCPA / CPRA)

Regardless of your geographic location, Zoe Academy respects your digital rights:

• The right to access and receive an export of your personal data.
• The right to rectify inaccurate account information.
• The right to request total account deletion (“Right to be Forgotten”).
• The right to opt-out of all non-essential email communications at any time.