Privacy Policy

NLA Academy enforces strict data isolation for learners under 13. Children’s accounts are activated with an 8-character invite passcode issued by a linked parent or educator — never by the child.

We do not collect email addresses, phone numbers, physical addresses, or social media identifiers from child learners. A child profile stores only a display name, the level they are enrolled in, and their learning progress.

Parents and educators may review, export or permanently delete a child’s record at any time from the Parent Portal.

Where NLA Academy is used by a school or district, we act as a “school official” with a legitimate educational interest under FERPA. Education records remain the property of the institution.

Teachers only see learners in the levels an administrator has assigned to them. We do not use student records for advertising, and we never build advertising profiles of learners.

We limit collection to what the platform genuinely needs:

• Account data — name, email and role for adult members, parents, teachers and administrators.
• Learning activity — chapters and sections read, quiz scores, reflections and certificates earned.
• Payment data — handled entirely by Stripe. NLA Academy never stores card numbers.
• Technical data — basic device and browser information used to keep the service secure and reliable.

Authentication is handled by Firebase Authentication, with records stored in Firestore behind granular, role-aware security rules. Data is encrypted in transit (TLS) and at rest.

Payments are processed directly by Stripe, a PCI-DSS Level 1 certified provider. Card details never reach NLA Academy servers.

The AI Study Companion is scoped to educational context and age-appropriate responses. Prompts are used to answer the learner in the moment and to keep the assistant safe.

AI conversations are never sold to third parties and are not used to build advertising profiles. Children’s prompts are subject to additional content filtering.

Depending on where you live — including under GDPR (EU/UK) and the CCPA/CPRA (California) — you may have the right to access, correct, export, restrict or delete your personal information, and to withdraw consent at any time.

NLA Academy does not sell or share personal information for cross-context behavioural advertising. To exercise any right, contact us through the contact page.

We keep account and learning records for as long as an account is active, so members retain access to their progress and certificates. When an account is deleted, personal data is removed within 30 days, except where we must retain limited records to meet legal, tax or accounting obligations.

We may update this policy as the platform evolves. Material changes are announced on this page with a revised “last updated” date, and — where the change is significant — by email to registered members.