Privacy Policy

1. Introduction

Bright Kids AI ("we," "us," or "our") operates the Bright Kids AI platform at bksupporthub.com and related services. This Privacy Policy explains how we collect, use, disclose, and protect information about you and your child when you use our platform.

We are committed to protecting children's privacy and comply with the Children's Online Privacy Protection Act (COPPA), updated April 22, 2026. If you have questions about this policy, contact us at support@brightkidsai.com.

2. Who We Collect Information From

Parents and Guardians (Account Holders): Adults 18 or older who create accounts and manage content on the platform. We collect your name, email address, and payment information (processed by Stripe — we never store raw card numbers).

Children (through Parent Accounts): We do not allow children to create accounts directly. All child data is provided by parents or guardians on behalf of their children and is subject to COPPA protections.

3. Information We Collect About Children

The following child information may be collected when a parent creates a child profile, subject to parental consent obtained before collection:

• Basic profile data: First name, age, reading level, interests, and favorite toy — used to personalize story content.
• Photo (optional): A child's photograph uploaded by the parent, used to create an AI-generated avatar. The original photo is stored securely and processed by Google Gemini Imagen 4.
• Sensitive data (optional): Sensitivities, learning challenges, or neurodiversity-related context provided by the parent. This data is encrypted at rest using AES-256-CBC encryption and is used solely to tailor story themes and avoid triggering content.
• Reading and listening progress: Which stories and songs a child has accessed, completion status, and reading sessions — used to personalize recommendations and show progress to parents.

4. COPPA — Children's Privacy Rights

We comply with COPPA (updated April 22, 2026). Before collecting any information about a child, we obtain verifiable parental consent through our consent gate, which records the consent type, timestamp, parent name (electronic signature), email, and IP address.

As a parent or guardian, you have the right to:

• Review all information we have collected about your child
• Request deletion of your child's data at any time
• Revoke your consent and stop further data collection
• Refuse to allow further use or collection of your child's data

To exercise any of these rights, contact support@brightkidsai.com. We will respond within 30 days. Revoking consent for a child profile will result in deletion of all data associated with that profile.

5. How We Use Information

• Story and song generation: Child profile data is sent to Google Gemini to generate personalized story text and music lyrics, and approved song lyrics are sent to ElevenLabs Music to generate audio. This data is processed in real time.
• Avatar generation: When a photo is uploaded, it is sent to Google Gemini Imagen 4 to create a cartoon-style avatar. The original photo is stored in Supabase Storage accessible only via time-limited signed URLs.
• Platform operation: Account management, authentication, payment processing, and customer support.
• Safety and moderation: Ensuring content is age-appropriate and does not violate our policies.

6. Third-Party Services

We use the following third-party services that may process child data:

• Google Gemini (Alphabet Inc.): Story text generation and image/avatar generation. Data is processed per Google's Cloud Data Processing Addendum.
• ElevenLabs Music: Audio song generation from parent-approved lyrics. Data is processed under ElevenLabs' applicable terms and privacy policy.
• Supabase: Database and file storage hosted in the United States. Child data is stored encrypted at rest.
• Stripe: Payment processing for subscriptions. Stripe is PCI-DSS compliant. We never store raw payment card data.
• Resend: Transactional email (verification emails, account notifications). Only your email address is shared.

We do not sell, rent, or share child data with third parties for advertising, marketing, or any purpose unrelated to delivering the service.

7. Data Security

We use industry-standard security practices to protect your data:

• Child sensitive data (diagnosis, sensitivities, challenges) is encrypted at rest using AES-256-CBC before being stored in the database.
• All data is transmitted over HTTPS (TLS 1.2+).
• Passwords are hashed using bcrypt (cost factor 12) and are never stored in plain text.
• File storage uses time-limited signed URLs — files are not publicly accessible.
• Database sessions are invalidated on logout; there are no long-lived JWT tokens for parent accounts.

8. Data Retention

We retain your data only as long as your account is active or as needed to provide the service. Specifically:

• Child profile data is deleted when you delete the child's profile or close your account.
• Consent records are retained for 7 years after the consent was given or revoked, as required for COPPA audit purposes.
• Payment records are retained as required by financial regulations (typically 7 years).
• Generated stories and songs are retained until you delete them or close your account.

To request deletion of your account and all associated data, email support@brightkidsai.com with the subject line "Account Deletion Request."

9. Cookies and Tracking

We use essential session cookies required for authentication and platform functionality. We do not use advertising cookies, behavioral tracking, or sell data to ad networks. No third-party analytics scripts (e.g., Google Analytics) are embedded on pages that display child data.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by email and by a notice within the platform. If the changes affect how we collect or use child data, we will obtain fresh parental consent before continuing to collect or use such data. The consent version number in our records tracks which version of this policy you agreed to.

11. Contact Us

For privacy-related questions, COPPA requests, or data deletion, contact us at support@brightkidsai.com. We are committed to responding to all privacy inquiries within 30 days.