Privacy Policy

1. Introduction

WA Chump & Sons Associates Ltd ("we", "us", "our"), trading as Noddle, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data when you use our voice-first adaptive learning platform.

2. Information We Collect

2.1 Information You Provide

• Account registration data (username, email address)
• Learning preferences and goals
• Documents you upload (text extracted only, originals are not stored)
• For wildlife visual search, a metadata-stripped JPEG copy may first be sent privately to SerpApi for Google Lens matching. If that is unavailable or has no validated match, a second copy may be held transiently in our database and shared with Serper/Google through an unguessable public link. The link expires within five minutes and is revoked after lookup or cancellation. Anyone holding it can access the copy while valid. Expired copies are removed by bounded cleanup; backups and provider-side retention may outlast link expiry. The browser-held original is not persistently stored by this feature. Revocation cannot retract copies already fetched by providers.
• Notes, flashcards, and reminders you create

2.2 Voice and Audio Data

Important: Voice recordings are processed entirely within your browser using the Web Speech API. We do not upload, store, or have access to your raw voice recordings. Only the transcribed text of your speech is transmitted to our servers for AI processing.

2.3 Learning Data

• Topics studied and session history
• Conversation transcripts with the AI tutor
• Quiz results and learning progress metrics
• Spaced repetition schedules

2.4 Automatically Collected Data

• Device and browser information
• Session duration and feature usage
• Technical error logs

3. How We Use Your Information

• To provide personalised learning experiences
• To maintain conversation memory across sessions
• To generate adaptive assessments and track progress
• To process voice commands and generate speech responses
• To send you session summaries and reminders (if enabled)
• To improve our service (using anonymised data)

4. Legal Basis for Processing (UK GDPR)

• Contract: Processing necessary to provide the service you've signed up for
• Legitimate Interests: Service improvement, security, fraud prevention
• Consent: Marketing communications, optional features
• Legal Obligation: Where required by law

5. Third-Party Services

5.1 AI Processing

We use Anthropic's Claude AI to generate learning responses. Your conversation data is sent to Anthropic for processing. Anthropic does not use API data to train their models. See Anthropic's Privacy Policy.

5.2 Text-to-Speech

We use ElevenLabs to generate natural-sounding speech. Text content is sent for audio generation but is not stored or used for training.

5.3 Email Services

We use Brevo for transactional emails such as password resets and session summaries.

5.4 Payment Processing

We use Stripe for subscription management and payment processing. Payment card details are handled directly by Stripe and never stored on our servers. See Stripe's Privacy Policy.

5.5 Google Services

When you connect Google Calendar, Drive, or Gmail, we access only the data you authorise via OAuth. Tokens are encrypted at rest. We do not access data beyond the scopes you approve.

5.6 Monday.com

When you connect Monday.com, we access your boards and tasks via OAuth to provide task management features. Tokens are encrypted at rest.

5.7 Database Hosting

Your data is stored on Neon serverless PostgreSQL. Data is encrypted in transit and at rest. See Neon's Privacy Policy.

5.8 Complete Third-Party Data Processor List

5.9 We Do NOT

• Sell your personal data
• Share data with advertisers
• Use your data to train AI models

6. Data Retention

• Account data: Retained while your account is active
• Learning history: Retained while your account is active
• Conversation memory: Retained while your account is active, deleted upon account deletion
• Upon account deletion: All data is permanently deleted within 30 days

7. Your Rights (UK GDPR)

Under UK data protection law, you have the following rights:

• Right of Access (Subject Access Request): Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data in certain circumstances
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for direct marketing
• Rights Related to Automated Decision-Making: Not be subject to decisions based solely on automated processing that significantly affect you

8. Data Security

We implement appropriate technical and organisational measures to protect your data:

• Encryption at rest: All database data is encrypted at rest using AES-256 encryption provided by our database infrastructure (Neon PostgreSQL)
• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.3
• Password security: Passwords are securely hashed using bcrypt with industry-standard work factors
• Session security: Session cookies are signed, httpOnly, and use strict SameSite policy to prevent CSRF attacks
• Account lockout protection: Progressive account lockouts protect against brute force attacks (temporary lockouts after failed login attempts)
• Rate limiting: Authentication and sensitive endpoints are protected against abuse with IP-based rate limiting
• Security headers: HTTP Strict Transport Security (HSTS), Content Security Policy (CSP), and other security headers protect against common web attacks
• Access control: Per-user authorisation ensures you can only access your own data
• Audit logging: Security-relevant events are logged for monitoring and incident response

9. International Data Transfers

Some of our service providers (such as Anthropic) are based in the United States. Where we transfer data outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.

10. Children's Privacy

Noddle is not intended for users under 13 years of age. By registering, you confirm that you are at least 13 years old. If you are between 13 and 16, we recommend parental oversight.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the app. Continued use of the service after changes constitutes acceptance.

12. Contact Us

For privacy queries or to exercise your rights, contact us at:

Email: info@wachump.net
Company: WA Chump & Sons Associates Ltd