Privacy Policy — WhiteKnight Academy

Effective date: 2026-07-02 Language: English (master). Polish and French (Quebec) translations required per Law 25 and consumer-protection practice — to be produced from this master after lawyer sign-off.

§ 0. Short summary (plain-language, non-binding)

This summary is provided for readability. The full terms in §§ 1–19 govern our obligations.

• We are TheBroda sp. z o.o., a Polish company. We run WhiteKnight Academy across our public site https://whiteknight.academy and the learning platform https://analytics.whiteknight.academy — a chess-education platform used by children aged 6–14 with their parents'/guardians' consent.
• We collect (i) account data, (ii) chess-performance data, (iii) messages between coaches and students, (iv) billing data (for paid plans), (v) basic usage telemetry, and (vi) lesson recordings only when a participant explicitly starts a recording (§ 7.3). We do not sell your or your child's data, and we never use children's data for advertising. On our public marketing site we use analytics and advertising cookies only if you consent (§ 3.6); a logged-in child's session blocks all such tags entirely.
• A parent or guardian creates the child's account, consents on the child's behalf, and can delete the account or export data at any time.
• We use sub-contractors ("subprocessors") listed in § 9. Your data may be stored or processed outside your country, with safeguards described in § 9.
• You have rights to access, correct, delete, export, and object to processing of your data. See § 10 for the list by jurisdiction, and § 11 for how to exercise them.
• Contact for any privacy question: privacy@whiteknight.academy.

§ 1. Who we are

Data controller: TheBroda sp. z o.o. ul. Wierna 12, Warszawa, Poland KRS: 0000677402 NIP / VAT: 5242831345 (PL5242831345) REGON: 367267919 Email: privacy@whiteknight.academy General contact: contact@whiteknight.academy

The company is the controller of personal data processed via the Service within the meaning of GDPR Art 4(7). For data subjects in the United States we are the "business" within the meaning of CCPA §1798.140(d) and the "operator" within the meaning of COPPA 16 CFR §312.2. For Canadian data subjects we are the "organization" within the meaning of PIPEDA s.2(1) and the "enterprise" within the meaning of Quebec Law 25.

Privacy contact: We have not formally designated a Data Protection Officer under GDPR Art 37, as our core activities do not meet the thresholds of Art 37(1)(b)–(c) at beta scale. All privacy correspondence is handled by the general privacy mailbox privacy@whiteknight.academy; we will revisit DPO designation when operating at scale or if special-category processing is introduced.

Representative in the EU: TheBroda sp. z o.o. is itself established in the EU (Poland) — no Art 27 representative needed.

§ 2. Scope of this Policy

This Policy applies to:

• use of the websites at https://whiteknight.academy (our public marketing and information site) and https://analytics.whiteknight.academy (the learning platform) (together, the "Site"),
• use of any connected application, chess-board interface, live lesson room, puzzle/homework interface, or coach dashboard (collectively, the "Service"),
• related email, support, and billing communications.

It does not apply to:

• Chess.com or Lichess websites or services, which we only connect to in read-only mode using the public username you supply;
• third-party websites linked from the Service.

§ 3. Categories of personal data we collect

We collect only the categories listed below. We do not collect special-category data within the meaning of GDPR Art 9 (e.g., health, biometrics, religion) and we do not knowingly collect data beyond what the Service needs.

are required by the beta flow but not yet implemented — must ship before Privacy Policy goes live.]

3.1. Account and identity data

3.2. Coach profile data (coaches only, age ≥18)

3.3. Chess-performance data

3.4. Communications and lesson content

Audio and video of live lessons are recorded only when a participant clicks "Start recording" and only for accounts whose parental consent covers recording. See § 7.3 for the full recording policy, retention, and access controls.

3.5. Payment data (paid plans only)

We do not store card numbers, CVV, or bank-account details. Full payment-method data is held by Stripe, our PCI-DSS Level 1 payment processor. We receive only a token and limited metadata.

3.6. Product telemetry

IP address is not stored in our internal telemetry table.

In addition to our internal telemetry, we use Google Analytics 4 ("GA4", measurement ID G-X7TK9CHRJ5) on the public marketing pages of our Site and on adult-authenticated dashboards, subject to your analytics consent through the cookie banner. GA4 processes an anonymised IP address, page URLs and referrer, device/OS/browser family, session events, and a GA4-generated client identifier. Retention is set to 2 months. We enforce consent-mode v2: no identifying data is sent before you grant consent.

We also run advertising and remarketing pixels for our paid-acquisition campaigns on Google Ads, Meta (Facebook / Instagram), TikTok, and X. These pixels measure campaign effectiveness (conversion tracking) and may build audience-similarity segments for our own campaigns on those platforms. They fire only when you grant advertising consent through the cookie banner.

All of the above — GA4 and the advertising pixels — are loaded through Google Tag Manager (container ID GTM-5TF7QK4N), which does not itself set tracking cookies. Full details on cookie names, expiries, and retention are in the Cookie Policy §§ 3.3–3.4.

AI-assisted features (coach chat, weakness summaries, insights) call the OpenAI API directly from our backend. We send aggregated chess-performance statistics and chat-session content; we do not send your name, email, date of birth, or payment data. Under OpenAI's API terms, content submitted via the API is not retained or used to train their models. We do not use any other LLM provider (OpenRouter, Anthropic, DeepSeek, etc.).

Children's accounts are excluded from every analytics and advertising tag. When a user is logged in as a Child (under 16), no analytics or advertising pixel is loaded on any page of the session, irrespective of consent state — a tag-manager-level safeguard aligned with California AADC §22675 and ICO Children's Code. AI-assisted features for Child accounts run only when the parent has given consent during sign-up; OpenAI API requests for a Child account carry no user identifiers (no name, email, DOB, payment).

We do not use session-replay or behaviour-watching services (no Hotjar, Clarity, FullStory, LogRocket, etc.) and do not currently use the advanced product-analytics class of tools (Amplitude, Mixpanel, PostHog, etc.). Any future addition will be disclosed here, in § 9, and in the Subprocessor List, and will require consent where law requires.

3.7. Administrative logs

For users holding the admin role only, admin_audit_log may retain an IP address (admin_audit_log.ip_address) alongside administrative actions, for security and breach-forensics purposes. For non-admin users no IP is persisted by our application.

3.8. Cookies and local browser storage

See § 12 below. Short version: only strictly-necessary cookies (Supabase authentication session) are set prior to consent; UI-state items (sidebar collapse, page filters, cached chart data) are written to localStorage on the user's own device and are not transmitted to us as tracking cookies.

§ 4. Sources of personal data

• Directly from you: sign-up form, profile edits, parental-consent form (for child accounts), coach application, homework submissions, messages, billing forms.
• From your actions on the platform: telemetry events, chess-performance data generated as you use the Service, authentication session data.
• From third parties with your authorisation:
  • Chess.com public API — only the usernames you provide; we retrieve your public profile and game archive.
  • Lichess public API — same as above.
  • Google OAuth (if you use "Sign in with Google") — we receive your Google email, name, and profile picture URL under the email + profile scopes.
• Automatically: device/browser family via user-agent string; HTTP/app errors from the runtime.

We do not acquire personal data from data brokers or marketing lists.

§ 5. Purposes of processing and legal bases

The table below is the GDPR Art 13(1)(c)–(d) / Art 14(1)(c)–(d) disclosure. For CCPA/CPRA compliance, the "purpose" column doubles as the "business or commercial purpose" under §1798.100(a)(2); we list retention in § 8. For PIPEDA compliance, purposes are stated expressly per Principle 2 (Identifying Purposes).

We do not process your data for:

• advertising profiling or targeting that uses a child's personal data — a logged-in child's session blocks all analytics and advertising tags at the tag-management layer (see § 6 and Cookie Policy § 3.5),
• selling or sharing personal data for a third party's own advertising within the meaning of CCPA/CPRA §1798.120,
• automated decisions with legal or similarly significant effects under GDPR Art 22 (see § 14).

On our public marketing pages only, and only with your consent, we use analytics (GA4) and advertising/remarketing cookies to measure and improve our paid-acquisition campaigns — see § 3.6 and purpose P10 below.

§ 6. Children's data — how we handle it

This section is in addition to the rest of the Policy. For a plain-language version specifically for parents and children, see our separate Children's Privacy Notice at https://whiteknight.academy/legal/children.

6.1. Our age model

• Under age 16 ("Children"): account may be created only by a parent or legal guardian. The parent is the party agreeing to our Terms and providing consent. The child is the user, but not the contracting party.
• Ages 16–17: may register themselves, but we treat their data with the same safeguards as Children's data and recommend parental involvement.
• Age 18 and over: may register themselves. Only users aged 18+ may register as Coaches.

We chose 16 as the single threshold because:

• it is the highest digital-consent age permitted by GDPR Art 8 and the figure set by Poland under ustawa o ochronie danych osobowych of 10 May 2018 (Art 5), the member state of our establishment;
• it maintains compliance with COPPA (16 CFR §312) for all US under-13 users — who are subject to COPPA regardless of threshold choice, because our Service is "directed to children under 13" within the meaning of §312.2 (target audience 6–14, chess puzzles, XP/badges, child-oriented visuals);
• it yields a single, uniform consent flow rather than country-specific branching, reducing the risk of misapplied consent.

6.2. Parental consent — how we obtain it

We obtain Verifiable Parental Consent ("VPC") before we collect, use, or disclose personal information from a Child, as required by 16 CFR §312.5 (COPPA) and GDPR Art 8.

For the free beta period we rely on the "email-plus" method authorised by 16 CFR §312.5(c)(2), because:

• we do not disclose personal information to third parties for the third party's own purposes — our subprocessors (§ 9) are contractually limited to processing on our instructions;
• consent use is confined to providing the Service and sending notices to the parent about the child's account.

The email-plus flow:

1. Parent fills the consent form, supplying their own email, relationship to the child, and the child's date of birth.
2. Parent confirms consent via a link sent to their email.
3. We send a follow-up confirmation email to the same address at least 24 hours later to the same parent address, providing an option to withdraw consent.
4. We store a consent record containing: timestamp, parent email, parent IP at consent, consent-text version, child reference.

For paid accounts (Phase 2), we will upgrade to a VPC method meeting §312.5(b)(2)(ii) — card-verification consent (paired with the payment transaction), per U.S. FTC guidance.

6.3. What parents can do

A parent or guardian who has provided consent may at any time:

• review the Child's personal information (COPPA §312.6(a)(1)),
• refuse to permit further collection (§312.6(a)(2)),
• request deletion of the Child's personal information (§312.6(a)(3)).

Requests can be submitted via privacy@whiteknight.academy or via the in-app DSAR portal (§ 11). We will verify the parent's identity via the email on file for the child's account and complete the request within 10 business days (COPPA FTC guidance) and in any case within 30 days (GDPR Art 12(3), PIPEDA Principle 9).

6.4. What we do NOT do with children's data

• We do not condition participation in an activity on disclosure of more personal information than reasonably necessary (COPPA §312.7).
• We do not use children's data for behavioural advertising, profiling to predict/influence behaviour, or cross-context ad tracking (California AADC §22675 — high-privacy default).
• We do not sell or share children's personal information for cross-context behavioural advertising under CCPA/CPRA §1798.120, §1798.121.
• We do not use "dark patterns" to obtain consent (California AADC §22677; CPRA §1798.140(l)).
• We do not apply automated decision-making that produces legal or similarly significant effects on a child (GDPR Art 22(1); Quebec Law 25, art. 12.1).

6.5. Data Protection Impact Assessment (AADC)

As required by California AADC §22676, we conduct and maintain a Data Protection Impact Assessment for each feature accessible to children. The current DPIA is held internally (see legal/internal/dpia.v1.md); we will make it available to the California Attorney General on written request.

§ 7. Specific processing activities

7.1. Chess-performance analysis

We run positional analysis on imported games using the Stockfish chess engine:

• lightly (single positions) in the user's browser via WebAssembly;
• more deeply (full-game batch) on our Hostinger VPS server (§ 9).

Results are written to game_analysis and shown only to the child, their parent, and coaches linked to the child.

7.2. AI-assisted insights (OpenAI API)

Some features (coach report summaries, personalised tips, weakness detection, the AI-coach chat) call OpenAI's API directly from our Supabase Edge Functions (§ 9). What we send:

• aggregated chess performance statistics (games played, rating trend, opening mix, accuracy percentiles),
• recent game summaries (opening, result, accuracy — no PGN by default),
• the conversation history of the current AI-chat session.

What we do not send:

• the user's name or email,
• the user's date of birth,
• payment information,
• messages from coach-student chat.

Per OpenAI's API terms of use, content submitted via the API is not retained beyond 30 days for abuse monitoring and is not used to train OpenAI's models. We do not use any other LLM provider — no OpenRouter, no Anthropic, no DeepSeek, no Google Gemini. If we later add a provider, we will update this Policy, the Subprocessor List, and the RoPA/DPIA in advance.

7.3. Live video lessons and recordings

Live lessons are provided via Daily.co (§ 9). When a lesson starts:

• we create a room on Daily.co with an opaque random identifier;
• no name, email, or child metadata is sent to Daily.co at room creation;
• the room is set to expire 4 hours after creation.

Recording is disabled by default. A recording only begins if a participant with appropriate role (coach, or the student themselves) explicitly clicks "Start recording" during the session. When a recording is active:

• a visible "REC" indicator is shown to every participant throughout the session;
• if the session involves a Child account whose parent has not ticked the "allow lesson recording" box at account creation (§ 6.2), our client blocks the recording action and displays a message explaining that parental consent for recording was not granted;
• the audio+video stream is stored in Daily.co cloud recording storage (United States);
• we store in our database only the recording metadata (lesson_recordings table, planned): recording ID, lesson slot, start/end timestamps, initiator user ID, Daily.co storage URL.

Retention: recordings auto-delete 30 days after the recording end. The auto-deletion is configured on Daily.co (recordings_storage_retention_days: 30) and the metadata row is also purged from our database on the same schedule.

Who can access a recording:

• the student whose lesson was recorded,
• the parent/guardian linked to that child account,
• the coach who led the session (and only that coach),
• our administrative staff, for the limited purpose of safeguarding investigations and abuse-report handling (GDPR Art 6(1)(f) legitimate interest; COPPA §312.5(c)(4)). Every admin access is logged in admin_audit_log with a purpose field and is subject to need-to-know review.

What we do NOT do with recordings:

• train artificial intelligence on them,
• share them with third parties (other than the Daily.co storage subprocessor),
• use them for marketing, advertising, product demos, or any secondary purpose,
• export them outside the authorised access list above.

Parents may withdraw recording consent at any time; from that moment no new recordings can be made on the child's account, and the parent can request deletion of existing recordings via § 11. Under COPPA §312.6(a)(3), the parent may also request deletion before the 30-day window.

7.4. Notifications

We send transactional email via Hostinger SMTP (§ 9) for password reset, homework-assigned notices, lesson reminders, and billing events. We do not send marketing email during the beta period; a separate opt-in will govern any future marketing under CASL s.6, CAN-SPAM, GDPR Art 6(1)(a), and PECR.

§ 8. Retention

Current state (as of effective date): account and related records are retained for the lifetime of the account; we do not currently run automated deletion.

When a retention period ends or a valid deletion request is honoured, we delete the data or irreversibly pseudonymise it such that it cannot be linked to an individual.

§ 9. Sub-processors and international data transfers

We use the following sub-processors to provide the Service. "Data categories" refers to the categories defined in § 3. Our public, always-current subprocessor list is at https://whiteknight.academy/legal/subprocessors; where that list differs from this table, the public list controls.

International transfers, EU/UK data subjects: transfers to the United States and other non-EU jurisdictions are made under Commission Implementing Decision (EU) 2021/914 Standard Contractual Clauses, supplemented where required by Transfer Impact Assessment (TIA) and technical and organisational measures described in § 13. You may request a copy of the SCCs applicable to your data at privacy@whiteknight.academy.

Canadian data subjects: transfers to the United States and Europe are made subject to contractual protections equivalent to the PIPEDA's Accountability Principle. For Quebec residents, we maintain the written Privacy Impact Assessment required by Law 25 art. 17, covering each transfer outside Quebec.

Changes to sub-processors: we post new subprocessors to https://whiteknight.academy/legal/subprocessors at least 30 days before they begin processing personal data, giving data subjects and coach-contractors time to object.

§ 10. Your rights

This section lists your rights. See § 11 for how to exercise them.

10.1. Data subjects in the EU / EEA (GDPR Arts 15–22)

10.2. Data subjects in Poland (GDPR + Polish ustawa o ochronie danych osobowych)

In addition to § 10.1, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) — see § 17.

10.3. California residents (CCPA/CPRA)

California consumers under 16: we must obtain opt-in consent to sell or share their personal information under §1798.120(c). Since we do not sell or share, this is stated here for transparency.

10.4. Virginia / Colorado / Connecticut / Utah / Texas etc. (state privacy laws)

Data subjects in states with omnibus privacy laws have rights substantially similar to § 10.3, including access, correction (where applicable), deletion, portability, and opt-out of targeted advertising and sale. We do not engage in targeted advertising or sale. We will honour these rights per the applicable state's requirements.

10.5. Canadian residents (PIPEDA)

10.6. Quebec residents (Law 25)

In addition to § 10.5:

10.7. Children's rights

Rights above apply equally to children. For Children under the age threshold (see § 6.1), rights are exercised by the parent/guardian who consented. A Child who becomes an adult while holding an account may elect to convert their account to adult status.

§ 11. How to exercise your rights

• In-app DSAR portal: https://analytics.whiteknight.academy/dashboard/settings/privacy — export, delete, correct your data with a single click (T4 + T5 in our roadmap; will be live by effective date).
• Email: privacy@whiteknight.academy. Please state which right you are exercising, the account email or child's account email, and the jurisdiction whose law you are invoking.
• Post (if you prefer): TheBroda sp. z o.o., ul. Wierna 12, Warszawa, Poland, attention: "Privacy".

11.1. Verification

For security reasons we verify identity via the account email on file. For child accounts, the parent/guardian on file verifies. If we cannot verify your identity with the information available, we may ask for reasonable additional information (CCPA Regs. §7062; COPPA §312.6(a); PIPEDA s.9(1)).

11.2. Response times

• GDPR: within 1 month of receipt (Art 12(3)); extendable by 2 months for complex requests with notice.
• CCPA/CPRA: within 45 days, extendable by 45 days with notice (§1798.130(a)(2)).
• PIPEDA / Quebec Law 25: within 30 days.
• COPPA parental requests: "reasonably timely" (FTC guidance ≈ 10 business days for straightforward requests).

We will honour the shortest applicable deadline if multiple laws apply to your request.

11.3. Fees

Requests are free. We may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to act, per GDPR Art 12(5), CCPA §1798.145(g)(3), PIPEDA s.9(4).

11.4. Appeals

If we deny your request in whole or in part, you may:

• in the EU: lodge a complaint with your supervisory authority (§ 17),
• in California: appeal to us within 45 days of the denial; we will respond within 45 days (Virginia §59.1-577 and similar states have identical appeal mechanics),
• in Canada: lodge a complaint with the Office of the Privacy Commissioner of Canada (§ 17),
• in Quebec: lodge a complaint with the Commission d'accès à l'information (§ 17).

§ 12. Cookies and similar technologies

See our full Cookie Policy at https://whiteknight.academy/legal/cookies.

Short version:

• Strictly necessary (set without consent — ePrivacy Art 5(3) carve-out, CCPA "service provider" carve-out): Supabase auth-session cookie, CSRF token, consent record.
• Functional (set after consent): language preference, sidebar collapse state (stored in localStorage, not a cookie).
• Analytics (set only after you consent; never on Child pages): Google Analytics 4 (_ga, _ga_*).
• Advertising / remarketing (set only after you consent; never on Child pages): Google Ads, Meta, TikTok and X conversion / retargeting pixels — see Cookie Policy § 3.4 for names and expiries.

Our cookie banner lets you accept, reject, and configure categories, and remembers your choice. You can change your preferences at any time via https://analytics.whiteknight.academy/dashboard/settings/cookies.

§ 13. Security

We apply the technical and organisational measures required by GDPR Art 32 and expected under COPPA §312.8. Current measures include:

• encryption in transit (TLS 1.2+) between all clients and all our servers and sub-processors;
• encryption at rest for Supabase-managed databases and Hostinger-managed VPS volumes;
• Row-Level Security on every user-scoped table (so that users cannot access other users' data via the API even if a bug in the app were present);
• principle of least privilege for internal staff access; no routine access by any staff member to live user data;
• separation of the SUPABASE_SERVICE_ROLE_KEY to server-only contexts; frontend code never holds it;
• regular password-rotation policy for administrative accounts; 2FA required for administrative accounts;
• automated security updates on the VPS host;
• logging of administrative actions in admin_audit_log.

No security measure is perfect. Please tell us if you see anything that could be a security issue: security@whiteknight.academy.

§ 14. Automated decision-making and AI

We do not use automated decision-making that produces legal or similarly significant effects on you within the meaning of GDPR Art 22(1), Quebec Law 25 art. 12.1, or California Civil Code §1798.185(a)(16).

We do use AI models for feature P6 (insights and tips). Those outputs are advisory content shown to users; no account access, pricing, or other consequential decision is made automatically by the AI.

When required by law (e.g., Law 25 art. 12.1), we will give the user, on request:

• a description of the personal information used by the decision,
• the reasons and principal factors and parameters leading to the decision,
• the right to submit observations for reconsideration by a natural person.

§ 15. Automated decision logging is disabled for children

Per California AADC §22675(d) and ICO Code "Best interests of the child", we disable any automated profiling of children by default. Children will not receive content recommendations based on inferences about their behaviour unless the parent has expressly configured it.

§ 16. Marketing communications

During the free beta, we do not send marketing communications. Transactional email (account, billing, homework, lesson reminders) is sent as described in § 7.4.

When we introduce marketing (Phase 2), we will:

• obtain express consent under CASL s.6, PECR regulation 22, and GDPR Art 6(1)(a) — or rely on the soft opt-in where its conditions are met (existing customer, similar products, clear opt-out — PECR reg. 22(3));
• provide a working unsubscribe link in every marketing message (CAN-SPAM §7704(a)(3), CASL s.11, PECR reg. 22(2));
• never send marketing communications to known-child accounts.

§ 17. Supervisory authorities / complaint bodies

You may always contact us first (privacy@whiteknight.academy). If you believe our handling of your personal data violates applicable law, you may also file a complaint with the authority competent for your jurisdiction:

• Poland / EU: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, Poland. https://uodo.gov.pl/
• Other EU member states: your national Data Protection Authority (list: https://edpb.europa.eu/about-edpb/about-edpb/members_en ).
• United States federal (COPPA): Federal Trade Commission, Consumer Response Center — https://reportfraud.ftc.gov/
• California: California Privacy Protection Agency — https://cppa.ca.gov/
• Virginia, Colorado, Connecticut, Texas, Utah, etc.: State Attorney General's office.
• Canada federal: Office of the Privacy Commissioner of Canada — https://www.priv.gc.ca/
• Quebec: Commission d'accès à l'information du Québec — https://www.cai.gouv.qc.ca/
• British Columbia / Alberta: respective provincial privacy commissioners.

§ 18. Changes to this Policy

We may update this Policy from time to time. When we make material changes we will:

• post the updated Policy with a new "Effective date";
• notify account holders by email at least 15 days before the change takes effect;
• for changes that materially expand processing of children's data, obtain fresh parental consent (COPPA §312.5(a)(2) — material change).

A full version history is kept at https://whiteknight.academy/legal/privacy/history.

§ 19. Contact

• Privacy contact: privacy@whiteknight.academy
• Security: security@whiteknight.academy
• General: contact@whiteknight.academy
• Post: TheBroda sp. z o.o., ul. Wierna 12, Warszawa, Poland

Annex A — Data categories quick reference (for data-mapping)

(For lawyer cross-reference with RoPA Annex 1 and DPIA §4. To be kept consistent with §§ 3 and 9 of the Policy.)

Annex B — Statute short-form citations