Back to Home

Privacy Policy

Last updated: March 17, 2026

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, subscribe to our service, or contact customer support. This may include:

  • Account Information: Email address, display name
  • Payment Information: Processed by Creem (our Merchant of Record); we do not store credit card details
  • Usage Data: Content you create using our Service (worksheets, exercises)
  • Technical Data: IP address, browser type, device information (collected automatically)

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our Service;
  • Process your transactions via Creem;
  • Send you technical notices and support messages;
  • Monitor and analyze usage patterns to improve user experience;
  • Detect, prevent, and address technical issues.

3. AI Data Processing

Our Service uses AI features powered by third-party language models (Alibaba Cloud / DashScope). When you use AI-powered features:

  • Your input text is sent to the AI service provider for processing.
  • We do not use your input data to train AI models.
  • AI-generated content may be cached temporarily (up to 24 hours) to improve performance.
  • You should not include personal information of students or third parties in AI prompts.

4. Cookies and Tracking

We use the following types of cookies:

  • Essential Cookies: Required for authentication (Supabase session cookies). These cannot be disabled.
  • Analytics Cookies: We use self-hosted analytics for error tracking and performance monitoring. These are activated only with your consent.

You can manage cookie preferences through the cookie consent banner displayed on your first visit.

5. Third-Party Services

We share data with the following third-party services:

  • Supabase: Authentication and data storage (EU/US servers)
  • Creem: Payment processing (Merchant of Record)
  • Alibaba Cloud / DashScope: AI content generation
  • Self-hosted Analytics: Error tracking and usage analytics (all data stays on our servers)

6. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States and China (for AI processing). We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required by applicable law.

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

  • Account data: Retained until you delete your account
  • Generated content: Retained until you delete it or your account
  • AI cache: Automatically deleted after 24 hours
  • Logs: Retained for up to 90 days for security purposes

8. Your Rights (GDPR & CCPA)

Depending on your jurisdiction, you may have the following rights:

  • Right of Access: Request a copy of your personal data
  • Right to Rectification: Request correction of inaccurate data
  • Right to Erasure: Request deletion of your account and all associated data
  • Right to Data Portability: Request your data in a machine-readable format
  • Right to Object: Object to processing of your data for certain purposes
  • Right to Restrict Processing: Request limitation of processing

To exercise any of these rights, please use the account settings page or contact us at support@mandarinlab.studio. We will respond within 30 days.

California Residents (CCPA): We do not sell your personal information. You have the right to know what data we collect and to request its deletion.

9. Children's Privacy (COPPA)

Our Service is designed for educators and is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected information from a child under 16, please contact us immediately and we will delete that information.

10. Data Security

We implement industry-standard security measures to protect your personal information, including encryption in transit (TLS 1.2+), secure authentication via Supabase, and regular security audits. However, no method of transmission over the Internet is 100% secure.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data rights, please contact us at support@mandarinlab.studio.