Privacy Policy

NLA Academy enforces strict data isolation for learners under 13. Children’s accounts are activated with an 8-character invite passcode issued by a linked parent or educator — never by the child.

We do not collect email addresses, phone numbers, physical addresses, or social media identifiers from child learners. A child profile stores only a display name, the level they are enrolled in, and their learning progress.

Parents and educators may review, export or permanently delete a child’s record at any time from the Parent Portal.

Where NLA Academy is used by a school or district, we act as a “school official” with a legitimate educational interest under FERPA. Education records remain the property of the institution.

Teachers only see learners in the levels an administrator has assigned to them. We do not use student records for advertising, and we never build advertising profiles of learners.

In the Interactive AI Book a child can type to a story character at any time. They can also speak to one — but only where a grown-up has turned that on. Talking is off for every child until then, and a child cannot turn it on for themselves. A parent or teacher switches it on for a named child from My Young Leaders (or My Students), and can turn it off again at any moment.

Nothing is recorded and no audio file is ever created. There is no recording, no upload and no stored voice clip. What the child said is turned into text by the browser and discarded as soon as they ask the next thing. It is never saved to their progress record.

Where the answer is writtendepends on a second switch, “Richer answers”, which is also off by default and also set per Young Leader by their grown-up. With it off, the character’s reply is composed on the child’s own device from the page in front of them and nothing they type reaches our servers. With it on, the question is sent to our server and on to Google’s Gemini service, which writes the reply from that same page. We keep no transcript of either side, store nothing against the child’s record, and send no name, age or account identifier with the question. Anything a child says that sounds like they need help from a grown-up is answered on their own device and is never sent anywhere, whichever way the switch is set.

One third party, and only in some browsers.Speech-to-text is the browser’s own service, not ours. In Google Chrome and Microsoft Edge that service runs remotely, so the spoken audio leaves the device and is processed by the browser vendor to be transcribed; we neither receive nor keep it. Safari transcribes on the device itself. If you would rather no audio left the device at all, leave talking switched off — typing works everywhere and never uses a microphone.

We limit collection to what the platform genuinely needs:

• Account data — name, email and role for adult members, parents, teachers and administrators.
• Learning activity — chapters and sections read, quiz scores, reflections and certificates earned.
• Payment data — handled entirely by Stripe. NLA Academy never stores card numbers.
• Technical data — basic device and browser information used to keep the service secure and reliable.
• Voice — not collected. See “Talking to the Story Characters” above: nothing is recorded, and no transcript is stored.
• Questions a child types to a character — not stored. Where “Richer answers” is switched on they are sent to Google’s Gemini service to be answered and are not retained by us.

Authentication is handled by Firebase Authentication, with records stored in Firestore behind granular, role-aware security rules. Data is encrypted in transit (TLS) and at rest.

Payments are processed directly by Stripe, a PCI-DSS Level 1 certified provider. Card details never reach NLA Academy servers.

The AI Study Companion is scoped to educational context and age-appropriate responses. Prompts are used to answer the learner in the moment and to keep the assistant safe.

AI conversations are never sold to third parties and are not used to build advertising profiles. Children’s prompts are subject to additional content filtering.

Depending on where you live — including under GDPR (EU/UK) and the CCPA/CPRA (California) — you may have the right to access, correct, export, restrict or delete your personal information, and to withdraw consent at any time.

NLA Academy does not sell or share personal information for cross-context behavioral advertising. To exercise any right, contact us through the contact page.

We keep account and learning records for as long as an account is active, so members retain access to their progress and certificates. When an account is deleted, personal data is removed within 30 days, except where we must retain limited records to meet legal, tax or accounting obligations.

We may update this policy as the platform evolves. Material changes are announced on this page with a revised “last updated” date, and — where the change is significant — by email to registered members.