Mighty Nest AI Privacy Policy

1. Scope & Key Points

• The Services are designed for parents, guardians, and other caregivers of children ages 2‑13—not for direct use by children.
• We collect information you provide (e.g., child profiles, uploaded photos, IEPs or other reports), automatic usage data (e.g., cookies, device IDs), and limited third‑party data (e.g., authentication via Clerk, payments via Stripe).
• Data are used to personalize educational activities, create cartoon play‑sheets from photos, adapt lesson/activity plans from uploaded documents, operate the platform, improve our AI models, and (with consent) send you updates.
• You may invite therapists, teachers, babysitters, or other caregivers to view or modify your child's profile; all sharing is entirely at your discretion and revocable at any time.
• We never sell personal data. We share it only with trusted service providers or if required by law.
• Some advanced or premium features may require payment or be subject to usage limits; any pricing or limits will be clearly disclosed before you incur charges.
• You can access, correct, delete, or export your data at any time.
• California residents have additional CCPA/CPRA rights; EU/UK residents have GDPR rights.
• Questions? Email info@mightynest.ai.

2. Information We Collect

We do not knowingly collect government‑issued IDs, precise geolocation, or biometric identifiers.

3. How We Use Your Information

1. Provide & personalize the Services – generate adaptive lesson/activity plans, cartoon play‑sheets, and progress summaries based on your inputs and uploads.
2. Generate personalized content – Uploaded photos and documents are processed solely to create the requested materials or insights.
3. Improve and train our AI models – we use only aggregated, de‑identified data; uploaded photos and documents are never used for model training.
4. Communicate with you about updates, security alerts, or new features.
5. Process payments and manage subscriptions.
6. Detect, prevent, and address fraud or misuse.
7. Comply with legal obligations and enforce our Terms of Use.

4. Legal Bases for Processing (GDPR/UK GDPR)

We process personal data on the following bases: contractual necessity, legitimate interests (e.g., product improvement), consent (for marketing emails, optional photo/document uploads, and caregiver invitations), and legal obligation.

5. How We Share Information

• Service Providers – e.g., Supabase (databases & edge functions), Clerk (auth), Resend (email), Stripe (payments), OpenAI (language generation), and image‑generation vendors strictly bound by confidentiality.
• Business Transfers – if we merge, acquire, or sell assets, data may transfer with the business.
• Legal & Safety – if required by law or to protect rights, safety, or property.
• With Your Consent – e.g., sharing plans or reports with a therapist, teacher, or babysitter you invite.

We do not sell or rent personal information.

6. Cookies & Tracking Technologies

We use first‑party and third‑party cookies to keep you signed in, understand how you use the Services (analytics via Vercel & Plausible), and remember preferences. You can disable cookies in your browser, but some features may not work.

7. Data Retention

• Uploaded images & documents – stored in encrypted buckets and automatically deleted 30 days after the associated content is generated, unless you explicitly save them to your library.
• Other personal data – retained only as long as necessary for the purposes described above, unless a longer period is required by law.
• Deletion requests are honored within 30 days.

8. Security Measures

• Encryption in transit (HTTPS/TLS) and at rest (AES‑256 via Supabase).
• Separate, access‑controlled storage for uploaded images and documents.
• Role‑based access controls, audit logging, and regular penetration testing.

No system is 100% secure, but we work hard to protect your information.

9. Children's Privacy (COPPA)

Mighty Nest AI is intended for use by adults on behalf of children. We do not knowingly collect personal information directly from children under 13. If we learn that we have done so, we will delete it promptly. Parents or legal guardians may review or delete their child's data—including uploaded photos and documents—at any time.

10. Your Choices & Rights

• Access / Portability – Download your data (including images and documents) in a portable format.
• Correction – Edit profile or child info from your dashboard.
• Deletion – Permanently delete your account and associated content.
• Marketing Opt‑Out – Unsubscribe via email footer.
• California – Right to know, delete, correct, and opt‑out of "sharing" (we don't share for cross‑context advertising).
• EU/UK – Right to object, restrict processing, lodge a complaint with a supervisory authority.

11. International Data Transfers

We are based in the United States. When we transfer data from other regions, we rely on standard contractual clauses (SCCs) or other approved safeguards.

12. Third‑Party Links & Integrations

Our Services may link to external sites (e.g., YouTube). We have no control over, and are not responsible for, the privacy practices of those sites.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will notify you by email or in‑app notice at least **14 days** before they take effect. The "Last updated" date at the top will also change.

14. Contact Us

✉️ info@mightynest.ai