This Privacy Policy explains how EDUMATH ANALYTICS SpA ("we", "us", "our"), operator of GraphMoves at graphmoves.com (the "Service"), collects, uses, and protects your information. Because many of our users are students under the age of 18, we apply heightened protections and design the Service to be privacy-protective by default.
1. Who we are
EDUMATH ANALYTICS SpA is a company organized under the laws of Chile. For any privacy question or request, contact us at hello@graphmoves.com.
2. What we collect
- Account data: name, email address, and your month and year of birth (used to determine the applicable privacy protections for your age).
- Learning data: practice results, scores, progress, and activity within the Service.
- Technical data: device type, browser, language, and access logs needed to operate and secure the Service.
- Parent/guardian data (for minors): the email address of a parent or guardian, where required to obtain consent.
We do not store payment card details. All payments are processed by our Merchant of Record (see Section 7), who handles card data directly.
3. Children's and minors' privacy
We determine the protections that apply to you based on your age and location:
- Under 13 (or the applicable minimum age in your country): We require Verifiable Parental Consent (VPC) before your account becomes fully active. Until consent is given, the account remains in a restricted, read-only state. We suspend all third-party tracking scripts for these users. This complies with the U.S. Children's Online Privacy Protection Act (COPPA).
- Ages 13-17 (EU consent age varies between 13 and 16 by member state): Accounts are configured with the highest privacy settings by default. We do not perform behavioral profiling, serve profiled advertising, or collect precise geolocation. This is consistent with the EU Digital Services Act (DSA) and applicable US child-privacy regulations (such as the Family Educational Rights and Privacy Act (FERPA)).
- 18 and over: Standard account flow applies.
Parents and guardians may review, request deletion of, or refuse further collection of their child's personal information by contacting hello@graphmoves.com.
4. How we use your data
We use your data only to: provide and personalize the Service; track your learning progress; operate, secure, and improve the Service; and communicate with you about your account. We do not sell personal data, and we do not use minors' data for behavioral advertising.
5. Legal bases (GDPR)
Where the GDPR applies, we process data on the basis of: performance of our contract with you; your consent (or your parent's consent, for minors); and our legitimate interests in operating and securing the Service, balanced against your rights.
6. Where your data is stored
Primary data for users in the European Union/EEA is stored on servers located within the EU (e.g., Frankfurt or Ireland). Data is encrypted in transit (TLS) and at rest (AES-256). We require a Data Processing Agreement (DPA) with our database provider.
7. Service providers (sub-processors)
We share data only with providers necessary to run the Service:
- Lemon Squeezy - payment processing and subscription billing, as our Merchant of Record. They are the seller of record for your transaction and process your payment information under their own privacy terms.
- Supabase - authentication and data storage.
- Desmos Studio PBC - provides the embedded calculator. Mathematical expressions you enter may be processed by Desmos to render the calculator.
- Cookieless analytics - privacy-friendly, cookieless web analytics that does not store personal data or persistent IP addresses.
- Buttondown - transactional and marketing email delivery.
8. Cookies and analytics
We use privacy-friendly analytics that do not set tracking cookies or store persistent identifiers. We do not deploy advertising or retargeting pixels (e.g., Meta Pixel, Google Analytics, TikTok) on accounts belonging to users under 18.
9. Data retention and deletion
We keep personal data only as long as needed to provide the Service. When you cancel your account or request deletion, we perform a permanent deletion of associated records within 30 days, and backups are purged on their standard automated retention cycle, consistent with the GDPR right to erasure.
10. Your rights
Depending on your location, you may have the right to access, correct, delete, export, or restrict the processing of your data, and to withdraw consent. To exercise any right, contact hello@graphmoves.com. You also have the right to lodge a complaint with your local data protection authority.
11. International transfers
Where data is transferred across borders, we rely on appropriate safeguards such as Standard Contractual Clauses and DPAs with our providers.
12. Changes to this Policy
We may update this Policy to reflect changes in law or our Service. Material changes will be posted here with an updated date.
13. Contact
EDUMATH ANALYTICS SpA - hello@graphmoves.com - Chile