Privacy Policy — WhiteKnight Academy

Effective date: 2026-07-02 Language: English (master). Polish and French (Quebec) translations required per Law 25 and consumer-protection practice — to be produced from this master after lawyer sign-off.

§ 0. Short summary (plain-language, non-binding)

This summary is provided for readability. The full terms in §§ 1–19 govern our obligations.

• We are TheBroda sp. z o.o., a Polish company. We run WhiteKnight Academy across our public site https://whiteknight.academy and the learning platform https://analytics.whiteknight.academy — a chess-education platform used by children aged 6–14 with their parents'/guardians' consent.
• We collect (i) account data, (ii) chess-performance data, (iii) messages between coaches and students, (iv) billing data (for paid plans), (v) basic usage telemetry, and (vi) lesson recordings only when a participant explicitly starts a recording (§ 7.3). We do not sell your or your child's data, and we never use children's data for advertising. On our public marketing site we use analytics and advertising cookies only if you consent (§ 3.6); a logged-in child's session blocks all such tags entirely. Where an adult reaches us by clicking one of our advertisements, we also record the advertising platform's click identifier so we can tell which campaign brought them and report the sale back to that platform — never for anyone under 18, and erased after 120 days (§ 3.6, § 8).
• A parent or guardian creates the child's account, consents on the child's behalf, and can delete the account or export data at any time.
• We use sub-contractors ("subprocessors") listed in § 9. Your data may be stored or processed outside your country, with safeguards described in § 9.
• You have rights to access, correct, delete, export, and object to processing of your data. See § 10 for the list by jurisdiction, and § 11 for how to exercise them.
• Contact for any privacy question: privacy@whiteknight.academy.

§ 1. Who we are

Data controller: TheBroda sp. z o.o. ul. Wierna 12, 03-890 Warszawa, Poland KRS: 0000677402 NIP / VAT: 5242831345 (PL5242831345) REGON: 367267919 Email: privacy@whiteknight.academy General contact: contact@whiteknight.academy

The company is the controller of personal data processed via the Service within the meaning of GDPR Art 4(7). For data subjects in the United States we are the "business" within the meaning of CCPA §1798.140(d) and the "operator" within the meaning of COPPA 16 CFR §312.2. For Canadian data subjects we are the "organization" within the meaning of PIPEDA s.2(1) and the "enterprise" within the meaning of Quebec Law 25.

Privacy contact: We have not formally designated a Data Protection Officer under GDPR Art 37, as our core activities do not meet the thresholds of Art 37(1)(b)–(c) at beta scale. All privacy correspondence is handled by the general privacy mailbox privacy@whiteknight.academy; we will revisit DPO designation when operating at scale or if special-category processing is introduced.

Representative in the EU: TheBroda sp. z o.o. is itself established in the EU (Poland) — no Art 27 representative needed.

§ 2. Scope of this Policy

This Policy applies to:

• use of the websites at https://whiteknight.academy (our public marketing and information site) and https://analytics.whiteknight.academy (the learning platform) (together, the "Site"),
• use of any connected application, chess-board interface, live lesson room, puzzle/homework interface, or coach dashboard (collectively, the "Service"),
• related email, support, and billing communications.

It does not apply to:

• Chess.com or Lichess websites or services, which we only connect to in read-only mode using the public username you supply;
• third-party websites linked from the Service.

§ 3. Categories of personal data we collect

We collect only the categories listed below. We do not collect special-category data within the meaning of GDPR Art 9 (e.g., health, biometrics, religion) and we do not knowingly collect data beyond what the Service needs.

3.1. Account and identity data

3.2. Coach profile data (coaches only, age ≥18)

3.3. Chess-performance data

3.4. Communications and lesson content

Audio and video of live lessons are recorded only when a participant clicks "Start recording" and only for accounts whose parental consent covers recording. See § 7.3 for the full recording policy, retention, and access controls.

3.5. Payment data (paid plans only)

We do not store card numbers, CVV, or bank-account details. Full payment-method data is held by Stripe, our PCI-DSS Level 1 payment processor. We receive only a token and limited metadata.

3.6. Product telemetry

IP address is not stored in our internal telemetry table. We do record an IP address separately, once per account, for fraud prevention — see § 3.7.

In addition to our internal telemetry, we use Google Analytics 4 ("GA4", measurement ID G-X7TK9CHRJ5) on the public marketing pages of our Site and on adult-authenticated dashboards. GA4 processes an anonymised IP address, page URLs and referrer, device/OS/browser family, session events, and a GA4-generated client identifier. Retention is set to 2 months. We enforce consent-mode v2 with region-appropriate defaults (amended 2026-07-16; pending counsel review):

• EEA, United Kingdom, Switzerland and Quebec (opt-in jurisdictions): analytics and advertising tags stay off until consent is given. Consent may be given (i) through the cookie banner or the Cookie Preferences page, or (ii) by an adult expressly accepting our Terms and this Privacy Policy at account registration or checkout, where the acceptance text discloses first-party analytics and marketing measurement. A refusal previously recorded in the banner or preferences always prevails over (ii). Consent can be withdrawn at any time via Cookie Preferences (GDPR Art 7(3)).
• United States, Canada outside Quebec, and other notice-and-opt-out jurisdictions: these tags are active by default on the basis of our legitimate interest in measuring and improving the Service and our marketing, with notice given here and in the Cookie Policy (CCPA/CPRA notice-at-collection; PIPEDA implied-consent guidance for non-sensitive analytics). The cookie banner and the Cookie Preferences page provide an opt-out at any time.

We also run advertising and remarketing pixels for our paid-acquisition campaigns on Google Ads, Meta (Facebook / Instagram), TikTok, and X. These pixels measure campaign effectiveness (conversion tracking) and may build audience-similarity segments for our own campaigns on those platforms. TikTok, Meta and X purchase measurement also use their server-side APIs (TikTok Events API, Meta Conversions API, X Conversions API) after Stripe confirms payment; when marketing consent permits, we send a conversion event ID, package/value/currency, coarse page URL, the platform's own identifiers when available (_ttp/ttclid for TikTok; _fbp/_fbc for Meta; twclid for X — X events are sent only for visitors who arrived from an X ad), the payer's IP address and browser user-agent, and a SHA-256 hash of the adult payer's normalised email. Sending happens only for adults (a server-side check drops it for every under-18 account) and each event carries the same ID as the browser event so the platform de-duplicates the two. We never send Child account, lesson, chess, message, or payment-card data to TikTok, Meta or X. These tools follow the same region-appropriate model as GA4 above: in opt-in jurisdictions they fire only after consent (banner, preferences, or an adult's express acceptance at registration/checkout); in notice-and-opt-out jurisdictions they are active by default with an opt-out always available.

All of the above — GA4 and the advertising pixels — are loaded through Google Tag Manager (container ID GTM-5TF7QK4N), which does not itself set tracking cookies. Full details on cookie names, expiries, and retention are in the Cookie Policy §§ 3.3–3.4.

First-party campaign attribution (including advertising click identifiers) (added 2026-07-20; pending counsel review). Separately from the third-party tags above, we record in our own database how a visitor first reached us, so that we can tell which marketing activity actually produces customers. For an account this consists of: the campaign labels in the link that was followed (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the host name only of the referring website (never the full referring URL), the landing page path, and — where the visit came from a paid advertisement — the click identifier appended by the advertising platform (gclid, gbraid, wbraid from Google Ads; fbclid from Meta; ttclid from TikTok; msclkid from Microsoft Advertising).

A click identifier is a random string identifying one ad click. We use it for two purposes: (i) to attribute a subscription to the campaign that produced it in our internal reporting, and (ii) to report the fact of a conversion back to the advertising platform that issued the identifier, so that the platform can measure and price our campaigns correctly. Purpose (ii) discloses to that platform only the click identifier it already issued, together with the time, value and currency of the conversion; it does not disclose your name, email address, account contents, or any chess, lesson, message or payment-card data.

The following limits apply and are enforced in our database rather than only in the browser:

• Adults only. Click identifiers are stored only for account holders confirmed to be 18 or over. For a Child (under 16), an adolescent (16–17), or any account whose date of birth we do not yet hold, the click identifier is discarded at the point of collection and never written to storage. This is a server-side rule and applies regardless of any cookie-consent state or client-side setting. It gives effect to our commitment that children's data is never used for advertising (§ 6.4; California AADC §22675; COPPA §312.2; CCPA/CPRA §1798.120).
• Consent. In opt-in jurisdictions, nothing in this paragraph is recorded until analytics/marketing consent is given under the region model described above; in notice-and-opt-out jurisdictions it operates on the legitimate-interest basis stated above, with an opt-out always available via Cookie Preferences.
• Retention. Click identifiers are automatically erased 120 days after the visit they relate to (§ 8). The campaign labels beside them are not personal identifiers and are retained for historical channel reporting.
• No onward disclosure. Click identifiers are never sold, shared for anyone else's advertising, or disclosed to any recipient other than the advertising platform that issued the identifier.

The legal basis is Art 6(1)(a) consent in opt-in jurisdictions and Art 6(1)(f) legitimate interest (measuring the effectiveness of our own marketing spend) elsewhere — see purpose P10 in § 5.

AI-assisted features (coach chat, weakness summaries, insights) call the OpenAI API directly from our backend. We send aggregated chess-performance statistics and chat-session content; we do not send your name, email, date of birth, or payment data. Under OpenAI's API terms, content submitted via the API is not retained or used to train their models. We do not use any other LLM provider (OpenRouter, Anthropic, DeepSeek, etc.).

Children's accounts are excluded from every analytics and advertising tag, in every region, irrespective of any default or stored consent -- enforced both at the consent-mode layer and in the application itself. When a user is logged in as a Child (under 16), no analytics or advertising pixel is loaded on any page of the session, irrespective of consent state — a tag-manager-level safeguard aligned with California AADC §22675 and ICO Children's Code. AI-assisted features for Child accounts run only when the parent has given consent during sign-up; OpenAI API requests for a Child account carry no user identifiers (no name, email, DOB, payment).

We do not use session-replay or behaviour-watching services (no Hotjar, Clarity, FullStory, LogRocket, etc.) and do not currently use the advanced product-analytics class of tools (Amplitude, Mixpanel, PostHog, etc.). Any future addition will be disclosed here, in § 9, and in the Subprocessor List, and will require consent where law requires.

3.7. Security and fraud-prevention logs

We keep a small amount of network data to protect accounts and to stop automated abuse. It is never used for advertising, profiling, or personalisation, and it is not combined with the behavioural telemetry in § 3.6.

Why we do this. Sign-in attempt records exist so we can tell whether an account is being attacked; without them a password-guessing attack against your account would be invisible to us, and we automatically slow down an account after twenty failed attempts in fifteen minutes. Our lawful basis is our legitimate interest in preventing fraud and abuse of the Service (GDPR Art 6(1)(f); Recital 47 states that processing strictly necessary for preventing fraud constitutes a legitimate interest). In September 2026 our sign-up form was targeted by automated account creation, and without this data we could not tell whether the attempts came from one source or many. For the parental-consent IP the purpose is different and narrower: it is evidence that a real person gave the consent, which COPPA and GDPR Art 8 require us to be able to demonstrate.

What we do not do. We do not use these addresses to locate you beyond the coarse country level, we do not sell or share them, and we do not use them to build advertising audiences.

Your rights. You can ask what we hold, ask us to delete it, or object to this processing on grounds relating to your particular situation, using the contacts in § 12. Where you object, we will stop unless we can show compelling legitimate grounds — in practice, an open investigation into abuse of your account or of the Service.

(§ 3.7 rewritten 2026-09-01. The previous version stated that no IP was persisted for non-admin users. That was inaccurate: parental-consent IPs had been recorded since the consent flow launched. The table above states what is actually collected.)

3.8. Cookies and local browser storage

See § 12 below. Short version: only strictly-necessary cookies (Supabase authentication session) are set prior to consent; UI-state items (sidebar collapse, page filters, cached chart data) are written to localStorage on the user's own device and are not transmitted to us as tracking cookies.

3.10. Country selection on the adult first-month campaign

To suggest a payment currency and choose the cookie notice, the parent registration page makes one background request to our existing Cloudflare provider. Cloudflare sees the connection IP address and normal request metadata; we use only the returned country code. We do not send names, emails, child details, or the campaign URL in this request, do not request precise device location, and do not save the response or IP to your account. The country result stays in page memory only. A VPN can change the detected country; currency remains manually adjustable. An unavailable lookup never prevents registration or payment.

For this parent campaign, unknown locations stay opt-in. US and Canadian country results use a visible measurement notice and Privacy choices / Opt out link instead of a blocking banner. The Canadian advertising campaign excludes Quebec; the country lookup does not identify a province. Previous privacy choices and browser opt-out signals take precedence; child sessions remain excluded from analytics and advertising. Country detection is for presentation and consent routing, not proof of residence.

3.11. App-store age signals (iOS and Android apps only)

Read only where the app store tells our app that an app-store age law applies to the store account on the device; see § 7.2b.

§ 4. Sources of personal data

• Directly from you: sign-up form, profile edits, parental-consent form (for child accounts), coach application, homework submissions, messages, billing forms.
• From your actions on the platform: telemetry events, chess-performance data generated as you use the Service, authentication session data.
• From third parties with your authorisation:
  • Chess.com public API — only the usernames you provide; we retrieve your public profile and game archive.
  • Lichess public API — same as above.
  • Google OAuth (if you use "Sign in with Google") — we receive your Google email, name, and profile picture URL under the email + profile scopes.
• From app stores (our iOS and Android apps only): where an app-store age law applies, Apple and Google, as operators of their own stores, tell the app the store account's age range and parental-approval status, and Apple tells us when a parent withdraws consent for our app (§ 3.11, § 7.2b).
• Automatically: device/browser family via user-agent string; HTTP/app errors from the runtime.

We do not acquire personal data from data brokers or marketing lists.

§ 5. Purposes of processing and legal bases

The table below is the GDPR Art 13(1)(c)–(d) / Art 14(1)(c)–(d) disclosure. For CCPA/CPRA compliance, the "purpose" column doubles as the "business or commercial purpose" under §1798.100(a)(2); we list retention in § 8. For PIPEDA compliance, purposes are stated expressly per Principle 2 (Identifying Purposes).

We do not process your data for:

• advertising profiling or targeting that uses a child's personal data — a logged-in child's session blocks all analytics and advertising tags at the tag-management layer (see § 6 and Cookie Policy § 3.5),
• selling or sharing personal data for a third party's own advertising within the meaning of CCPA/CPRA §1798.120,
• automated decisions with legal or similarly significant effects under GDPR Art 22 (see § 14).

On our public marketing pages only, and only with your consent, we use analytics (GA4) and advertising/remarketing cookies to measure and improve our paid-acquisition campaigns — see § 3.6 and purpose P10 below.

§ 6. Children's data — how we handle it

This section is in addition to the rest of the Policy. For a plain-language version specifically for parents and children, see our separate Children's Privacy Notice at https://whiteknight.academy/legal/children.

6.1. Our age model

• Under age 16 ("Children"): account may be created only by a parent or legal guardian. The parent is the party agreeing to our Terms and providing consent. The child is the user, but not the contracting party.
• Ages 16–17: may register themselves, but we treat their data with the same safeguards as Children's data and recommend parental involvement.
• Age 18 and over: may register themselves. Only users aged 18+ may register as Coaches.

We chose 16 as the single threshold because:

• it is the highest digital-consent age permitted by GDPR Art 8 and the figure set by Poland under ustawa o ochronie danych osobowych of 10 May 2018 (Art 5), the member state of our establishment;
• it maintains compliance with COPPA (16 CFR §312) for all US under-13 users — who are subject to COPPA regardless of threshold choice, because our Service is "directed to children under 13" within the meaning of §312.2 (target audience 6–14, chess puzzles, XP/badges, child-oriented visuals);
• it yields a single, uniform consent flow rather than country-specific branching, reducing the risk of misapplied consent.

6.2. Parental consent — how we obtain it

We obtain Verifiable Parental Consent ("VPC") before we collect, use, or disclose personal information from a Child, as required by 16 CFR §312.5 (COPPA) and GDPR Art 8.

For the free beta period we rely on the "email-plus" method authorised by 16 CFR §312.5(c)(2), because:

• we do not disclose personal information to third parties for the third party's own purposes — our subprocessors (§ 9) are contractually limited to processing on our instructions;
• consent use is confined to providing the Service and sending notices to the parent about the child's account.

The email-plus flow:

1. Parent fills the consent form, supplying their own email, relationship to the child, and the child's date of birth.
2. Parent confirms consent via a link sent to their email.
3. We send a follow-up confirmation email to the same address at least 24 hours later to the same parent address, providing an option to withdraw consent.
4. We store a consent record containing: timestamp, parent email, parent IP at consent, consent-text version, child reference.

For paid accounts (Phase 2), we will upgrade to a VPC method meeting §312.5(b)(2)(ii) — card-verification consent (paired with the payment transaction), per U.S. FTC guidance.

6.3. What parents can do

A parent or guardian who has provided consent may at any time:

• review the Child's personal information (COPPA §312.6(a)(1)),
• refuse to permit further collection (§312.6(a)(2)),
• request deletion of the Child's personal information (§312.6(a)(3)).

Requests can be submitted via privacy@whiteknight.academy or via the in-app DSAR portal (§ 11). We will verify the parent's identity via the email on file for the child's account and complete the request within 10 business days (COPPA FTC guidance) and in any case within 30 days (GDPR Art 12(3), PIPEDA Principle 9).

6.4. What we do NOT do with children's data

• We do not condition participation in an activity on disclosure of more personal information than reasonably necessary (COPPA §312.7).
• We do not use children's data for behavioural advertising, profiling to predict/influence behaviour, or cross-context ad tracking (California AADC §22675 — high-privacy default).
• We do not sell or share children's personal information for cross-context behavioural advertising under CCPA/CPRA §1798.120, §1798.121.
• We do not use "dark patterns" to obtain consent (California AADC §22677; CPRA §1798.140(l)).
• We do not apply automated decision-making that produces legal or similarly significant effects on a child (GDPR Art 22(1); Quebec Law 25, art. 12.1).

6.5. Data Protection Impact Assessment (AADC)

As required by California AADC §22676, we conduct and maintain a Data Protection Impact Assessment for each feature accessible to children. The current DPIA is held internally (see legal/internal/dpia.v1.md); we will make it available to the California Attorney General on written request.

§ 7. Specific processing activities

7.1. Chess-performance analysis

We run positional analysis on imported games using the Stockfish chess engine:

• lightly (single positions) in the user's browser via WebAssembly;
• more deeply (full-game batch) on our Hostinger VPS server (§ 9).

Results are written to game_analysis and shown only to the child, their parent, and coaches linked to the child.

7.2. AI-assisted insights (OpenAI API)

Some features (coach report summaries, personalised tips, weakness detection, the AI-coach chat) call OpenAI's API directly from our Supabase Edge Functions (§ 9). What we send:

• aggregated chess performance statistics (games played, rating trend, opening mix, accuracy percentiles),
• recent game summaries (opening, result, accuracy — no PGN by default),
• the conversation history of the current AI-chat session.

What we do not send:

• the user's name or email,
• the user's date of birth,
• payment information,
• messages from coach-student chat.

Per OpenAI's API terms of use, content submitted via the API is not retained beyond 30 days for abuse monitoring and is not used to train OpenAI's models. We do not use any other LLM provider — no OpenRouter, no Anthropic, no DeepSeek, no Google Gemini. If we later add a provider, we will update this Policy, the Subprocessor List, and the RoPA/DPIA in advance.

7.2a. Messages you send us, and the reply assistant

When a parent or adult learner writes to us — by email to one of our addresses (contact@, lessons@, billing@, legal@, privacy@, safeguarding@, security@whiteknight.academy), through Instagram Direct or Facebook Messenger, or to our Telegram bot — we keep the message so our team can answer it and see the conversation history. For email we keep only letters from people who already have an account with us or have started signing up; other mail is not stored. Email text is deleted automatically 12 months after it was received; attachments are not stored (only their names and sizes). Direct-message conversations are kept while they are useful for handling your enquiry and are deleted on request.

To answer quickly, we use OpenAI's API (§ 7.2, § 9) in two ways:

• Instagram, Messenger and Telegram: an assistant may reply automatically to general questions (how lessons work, prices, available times). A person on our team can take over at any time, and conversations that need a person are handed over.
• Email: a member of our team can ask the assistant for a draft reply. Nothing is sent by the assistant; a person reviews, edits and sends every email.

For this purpose we send OpenAI the conversation itself and a short summary from our records about this family only: the adult's first name and time zone, the children's age bands, their lesson times and coach, plan and billing status, our prices, and the lesson times that are open for booking. Children's names are replaced by placeholders (such as "Child 1") before anything is sent, both in the summary and wherever the names we hold for your children appear in the conversation; our own system puts the name back into the reply afterwards, so OpenAI never receives it. (A name we do not hold on record, for example of a child who is not registered with us, cannot be recognised and may remain in the text of a message.) We do not send dates of birth, payment-card data, other families' data, or recordings. Letters to privacy@ and safeguarding@ are never sent to the assistant. As with § 7.2, content submitted via OpenAI's API is not used to train OpenAI's models.

(Version 1.1, 2026-09-29: added how messages you send us are kept and how the reply assistant works — § 7.2a; children's names are never sent to the AI provider.)

7.2b. App-store age signals (iOS and Android apps)

Some US states require app stores to establish their users' ages and to obtain a parent's consent for minors, and require app developers to use what the store tells them (Texas Business and Commerce Code ch. 121, in force; similar laws in Utah, Louisiana, Alabama and California take effect in 2027). From version 1.11 of our iOS app and version 2.52 of our Android app:

• What the app receives, and from whom. When the app starts and when someone signs in, it asks the app store on that device, Apple (Declared Age Range) or Google (Play Age Signals), whether these rules apply to the store account. We do not work out where you are; the store decides. Only where the rules apply does the store give the app the data listed in § 3.11: an age range (never a date of birth), how the store established it, whether parental controls are on, and whether a parent has approved our latest significant update. On iOS the app also reads the app transaction identifier, a random identifier Apple gives our app on that Apple Account; it says nothing about age. Apple and Google provide these signals as operators of their own stores; they are not our sub-processors.
• What we use it for. Only to apply our age protections and the law:
  • if the store says the device belongs to someone under 18, child protections stay on for everyone who uses the app on that device: no analytics (§ 3.6) and no purchase or offer screens, even when an adult signs in there;
  • if the store says the device belongs to someone under 16, an account that a learner registered for themselves as 16 or older cannot be used on it, because children's accounts are created and managed by a parent (§ 6.1). Parent and coach accounts can still sign in on that device;
  • for the parental approval of significant updates and the withdrawal of consent described below.
• What we do not do. The age range, how it was established and the parental-control status stay in the app's memory while it runs. We do not store them on the device or on our servers, send them to analytics, write them to logs, share them, or use them for advertising or profiling. On the device the app keeps only which update a parent approved and which update notice an adult has seen, so that it does not ask again at every launch. On our servers we keep the app transaction identifier with the accounts that used the app on that Apple Account, for one purpose: to recognise a parent's withdrawal of consent.
• Significant updates. When an update changes what data we collect, our age rating, purchases or advertising, or how the app works in a way a parent would want to know about, we treat it as a significant change. On a minor's device in a region that requires it, the app asks a parent through the store (Apple: a request on the parent's device; Google: Google Play or Family Link) and stays locked until a parent approves. Each request carries a plain-language description of the change. Where the law requires it, adults see a one-time notice of the change.
• Withdrawing consent through the store. A parent can withdraw consent for our app in their Apple or Google family settings. Apple then stops the app from opening on the child's Apple Account and notifies us (App Store Server Notifications); we mark the WhiteKnight accounts used on that Apple Account, and our team contacts the family. Google stops the app for a supervised child whose approval is withdrawn. This does not delete the child's WhiteKnight account or withdraw the consent given to us under § 6.2; to do that, use the options in § 6.3.
• If the store shares nothing. If the rules do not apply, or the store does not share an age range, the app works as before, and our own age gate and parental consent (§ 6.1–6.2) apply, as on the web.

(Version 1.2, 2026-10-08: added app-store age signals in our iOS and Android apps — § 3.11, § 4, purpose P11, § 7.2b, § 8; applies from iOS app 1.11 and Android app 2.52.)

7.3. Live video lessons and recordings

Live lessons are provided via Daily.co (§ 9). When a lesson starts:

• we create a room on Daily.co with an opaque random identifier;
• no name, email, or child metadata is sent to Daily.co at room creation;
• the room is set to expire 4 hours after creation.

Recording is disabled by default. A recording only begins if a participant with appropriate role (coach, or the student themselves) explicitly clicks "Start recording" during the session. When a recording is active:

• a visible "REC" indicator is shown to every participant throughout the session;
• if the session involves a Child account whose parent has not ticked the "allow lesson recording" box at account creation (§ 6.2), our client blocks the recording action and displays a message explaining that parental consent for recording was not granted;
• the audio+video stream is stored in Daily.co cloud recording storage (United States);
• we store in our database only the recording metadata (lesson_recordings table, planned): recording ID, lesson slot, start/end timestamps, initiator user ID, Daily.co storage URL.

Retention: recordings auto-delete 30 days after the recording end. The auto-deletion is configured on Daily.co (recordings_storage_retention_days: 30) and the metadata row is also purged from our database on the same schedule.

Who can access a recording:

• the student whose lesson was recorded,
• the parent/guardian linked to that child account,
• the coach who led the session (and only that coach),
• our administrative staff, for the limited purpose of safeguarding investigations and abuse-report handling (GDPR Art 6(1)(f) legitimate interest; COPPA §312.5(c)(4)). Every admin access is logged in admin_audit_log with a purpose field and is subject to need-to-know review.

What we do NOT do with recordings:

• train artificial intelligence on them,
• share them with third parties (other than the Daily.co storage subprocessor),
• use them for marketing, advertising, product demos, or any secondary purpose,
• export them outside the authorised access list above.

Parents may withdraw recording consent at any time; from that moment no new recordings can be made on the child's account, and the parent can request deletion of existing recordings via § 11. Under COPPA §312.6(a)(3), the parent may also request deletion before the 30-day window.

7.4. Notifications

We send transactional and service email via Hostinger SMTP (§ 9): sign-in codes, password reset, homework-assigned notices, lesson reminders and joining links, and billing events. These are part of operating the Service (GDPR Art 6(1)(b); CASL s.6(6) transactional messages; CAN-SPAM transactional content) and cannot be switched off while an account or a booking is active.

Marketing and follow-up email (amended 2026-09-23; pending counsel review). Where an adult has asked about our lessons — by starting a sign-up, requesting a lesson time, or leaving an e-mail address on one of our forms — we may send a limited number of follow-up messages about that enquiry and about our coaching plans, offers and free lessons, whether or not the sign-up was completed. The legal basis is: in Canada, implied consent arising from an enquiry or application about our services (CASL s.10(9)), which we treat as lasting six months from the enquiry unless renewed by a further enquiry or a purchase; in the United States, the CAN-SPAM Act's notice-and-opt-out regime; in the EEA, the United Kingdom and Switzerland, our legitimate interest in following up an enquiry we received (GDPR Art 6(1)(f), Recital 47), with express opt-in obtained where PECR or national law requires it. Every such message identifies WhiteKnight Academy and TheBroda sp. z o.o. as the sender, carries our postal address, and contains a working unsubscribe link and a reply-to mailbox; an opt-out is honoured within 10 business days and is recorded against the address itself, so it also covers any later sign-up with the same address. We never send marketing email to Children, to a child's account address, or to families who joined through their own coach's invitation; and we do not buy or rent mailing lists. Account holders can also turn off optional reminders under Offers & tips in notification preferences (§ 10.1).

§ 8. Retention

Current state (as of effective date): account and related records are retained for the lifetime of the account; we do not currently run automated deletion.

When a retention period ends or a valid deletion request is honoured, we delete the data or irreversibly pseudonymise it such that it cannot be linked to an individual.

§ 9. Sub-processors and international data transfers

We use the following sub-processors to provide the Service. "Data categories" refers to the categories defined in § 3. Our public, always-current subprocessor list is at https://whiteknight.academy/legal/subprocessors; where that list differs from this table, the public list controls.

International transfers, EU/UK data subjects: transfers to the United States and other non-EU jurisdictions are made under Commission Implementing Decision (EU) 2021/914 Standard Contractual Clauses, supplemented where required by Transfer Impact Assessment (TIA) and technical and organisational measures described in § 13. You may request a copy of the SCCs applicable to your data at privacy@whiteknight.academy.

Canadian data subjects: transfers to the United States and Europe are made subject to contractual protections equivalent to the PIPEDA's Accountability Principle. For Quebec residents, we maintain the written Privacy Impact Assessment required by Law 25 art. 17, covering each transfer outside Quebec.

Changes to sub-processors: we post new subprocessors to https://whiteknight.academy/legal/subprocessors at least 30 days before they begin processing personal data, giving data subjects and coach-contractors time to object.

§ 10. Your rights

This section lists your rights. See § 11 for how to exercise them.

10.1. Data subjects in the EU / EEA (GDPR Arts 15–22)

10.2. Data subjects in Poland (GDPR + Polish ustawa o ochronie danych osobowych)

In addition to § 10.1, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) — see § 17.

10.3. California residents (CCPA/CPRA)

California consumers under 16: we must obtain opt-in consent to sell or share their personal information under §1798.120(c). Since we do not sell or share, this is stated here for transparency.

10.4. Virginia / Colorado / Connecticut / Utah / Texas etc. (state privacy laws)

Data subjects in states with omnibus privacy laws have rights substantially similar to § 10.3, including access, correction (where applicable), deletion, portability, and opt-out of targeted advertising and sale. We do not engage in targeted advertising or sale. We will honour these rights per the applicable state's requirements.

10.5. Canadian residents (PIPEDA)

10.6. Quebec residents (Law 25)

In addition to § 10.5:

10.7. Children's rights

Rights above apply equally to children. For Children under the age threshold (see § 6.1), rights are exercised by the parent/guardian who consented. A Child who becomes an adult while holding an account may elect to convert their account to adult status.

§ 11. How to exercise your rights

• In-app DSAR portal: https://analytics.whiteknight.academy/dashboard/settings/privacy — export, delete, correct your data with a single click (T4 + T5 in our roadmap; will be live by effective date).
• Email: privacy@whiteknight.academy. Please state which right you are exercising, the account email or child's account email, and the jurisdiction whose law you are invoking.
• Post (if you prefer): TheBroda sp. z o.o., ul. Wierna 12, 03-890 Warszawa, Poland, attention: "Privacy".

11.1. Verification

For security reasons we verify identity via the account email on file. For child accounts, the parent/guardian on file verifies. If we cannot verify your identity with the information available, we may ask for reasonable additional information (CCPA Regs. §7062; COPPA §312.6(a); PIPEDA s.9(1)).

11.2. Response times

• GDPR: within 1 month of receipt (Art 12(3)); extendable by 2 months for complex requests with notice.
• CCPA/CPRA: within 45 days, extendable by 45 days with notice (§1798.130(a)(2)).
• PIPEDA / Quebec Law 25: within 30 days.
• COPPA parental requests: "reasonably timely" (FTC guidance ≈ 10 business days for straightforward requests).

We will honour the shortest applicable deadline if multiple laws apply to your request.

11.3. Fees

Requests are free. We may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to act, per GDPR Art 12(5), CCPA §1798.145(g)(3), PIPEDA s.9(4).

11.4. Appeals

If we deny your request in whole or in part, you may:

• in the EU: lodge a complaint with your supervisory authority (§ 17),
• in California: appeal to us within 45 days of the denial; we will respond within 45 days (Virginia §59.1-577 and similar states have identical appeal mechanics),
• in Canada: lodge a complaint with the Office of the Privacy Commissioner of Canada (§ 17),
• in Quebec: lodge a complaint with the Commission d'accès à l'information (§ 17).

§ 12. Cookies and similar technologies

See our full Cookie Policy at https://whiteknight.academy/legal/cookies.

Short version:

• Strictly necessary (set without consent — ePrivacy Art 5(3) carve-out, CCPA "service provider" carve-out): Supabase auth-session cookie, CSRF token, consent record.
• Functional (set after consent): language preference, sidebar collapse state (stored in localStorage, not a cookie).
• Analytics (opt-in jurisdictions: only after you consent; notice-and-opt-out jurisdictions: by default, with opt-out in Cookie Preferences; never on Child pages): Google Analytics 4 (_ga, _ga_*).
• Advertising / remarketing (same region-appropriate model as Analytics; never on Child pages): Google Ads, Meta, TikTok and X conversion / retargeting pixels — see Cookie Policy § 3.4 for names and expiries.

Our cookie banner lets you accept, reject, and configure categories, and remembers your choice. You can change your preferences at any time via https://analytics.whiteknight.academy/dashboard/settings/cookies.

§ 13. Security

We apply the technical and organisational measures required by GDPR Art 32 and expected under COPPA §312.8. Current measures include:

• encryption in transit (TLS 1.2+) between all clients and all our servers and sub-processors;
• encryption at rest for Supabase-managed databases and Hostinger-managed VPS volumes;
• Row-Level Security on every user-scoped table (so that users cannot access other users' data via the API even if a bug in the app were present);
• principle of least privilege for internal staff access; no routine access by any staff member to live user data;
• separation of the SUPABASE_SERVICE_ROLE_KEY to server-only contexts; frontend code never holds it;
• regular password-rotation policy for administrative accounts; 2FA required for administrative accounts;
• automated security updates on the VPS host;
• logging of administrative actions in admin_audit_log.

No security measure is perfect. Please tell us if you see anything that could be a security issue: security@whiteknight.academy.

§ 14. Automated decision-making and AI

We do not use automated decision-making that produces legal or similarly significant effects on you within the meaning of GDPR Art 22(1), Quebec Law 25 art. 12.1, or California Civil Code §1798.185(a)(16).

We do use AI models for feature P6 (insights and tips). Those outputs are advisory content shown to users; no account access, pricing, or other consequential decision is made automatically by the AI.

When required by law (e.g., Law 25 art. 12.1), we will give the user, on request:

• a description of the personal information used by the decision,
• the reasons and principal factors and parameters leading to the decision,
• the right to submit observations for reconsideration by a natural person.

§ 15. Automated decision logging is disabled for children

Per California AADC §22675(d) and ICO Code "Best interests of the child", we disable any automated profiling of children by default. Children will not receive content recommendations based on inferences about their behaviour unless the parent has expressly configured it.

§ 16. Marketing communications

During the free beta, we do not send marketing communications. Transactional email (account, billing, homework, lesson reminders) is sent as described in § 7.4.

When we introduce marketing (Phase 2), we will:

• obtain express consent under CASL s.6, PECR regulation 22, and GDPR Art 6(1)(a) — or rely on the soft opt-in where its conditions are met (existing customer, similar products, clear opt-out — PECR reg. 22(3));
• provide a working unsubscribe link in every marketing message (CAN-SPAM §7704(a)(3), CASL s.11, PECR reg. 22(2));
• never send marketing communications to known-child accounts.

§ 17. Supervisory authorities / complaint bodies

You may always contact us first (privacy@whiteknight.academy). If you believe our handling of your personal data violates applicable law, you may also file a complaint with the authority competent for your jurisdiction:

• Poland / EU: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, Poland. https://uodo.gov.pl/
• Other EU member states: your national Data Protection Authority (list: https://edpb.europa.eu/about-edpb/about-edpb/members_en ).
• United States federal (COPPA): Federal Trade Commission, Consumer Response Center — https://reportfraud.ftc.gov/
• California: California Privacy Protection Agency — https://cppa.ca.gov/
• Virginia, Colorado, Connecticut, Texas, Utah, etc.: State Attorney General's office.
• Canada federal: Office of the Privacy Commissioner of Canada — https://www.priv.gc.ca/
• Quebec: Commission d'accès à l'information du Québec — https://www.cai.gouv.qc.ca/
• British Columbia / Alberta: respective provincial privacy commissioners.

§ 18. Changes to this Policy

We may update this Policy from time to time. When we make material changes we will:

• post the updated Policy with a new "Effective date";
• notify account holders by email at least 15 days before the change takes effect;
• for changes that materially expand processing of children's data, obtain fresh parental consent (COPPA §312.5(a)(2) — material change).

A full version history is kept at https://whiteknight.academy/legal/privacy/history.

§ 19. Contact

• Privacy contact: privacy@whiteknight.academy
• Security: security@whiteknight.academy
• General: contact@whiteknight.academy
• Post: TheBroda sp. z o.o., ul. Wierna 12, 03-890 Warszawa, Poland

Annex A — Data categories quick reference (for data-mapping)

(For lawyer cross-reference with RoPA Annex 1 and DPIA §4. To be kept consistent with §§ 3 and 9 of the Policy.)

Annex B — Statute short-form citations