Privacy Policy

1. About this policy

This Privacy Policy explains how Phlow Academy Limited collects, uses, shares and protects personal data when you use the Phlow Academy website, mobile applications, parent account, learner profile, subscriptions and related support services.

Phlow Academy Limited is the data controller for the personal data described in this policy. We are responsible for deciding why and how that data is processed.

2. Who we are

Data controller

Phlow Academy Limited

Company number

798713

Registered address

Apartment 2, Shamble Street, Castlebar, Co. Mayo, F23 VK09, Ireland

Privacy contact

info@phlow.academy

3. The personal data we process

Depending on how you use Phlow Academy, we may process:

• Parent or account-holder data: name, email address, authentication details, account identifiers and support communications.
• Learner-profile data: learner name or chosen display name, username, linked parent-account identifier and authentication data.
• Learning and progress data: topics, levels, answers, attempts, scores, timings, completion, review status, learning route, recommendations and progress history.
• Subscription and transaction data: plan, purchase status, entitlement, renewal and cancellation information, billing email, transaction identifiers and limited payment records. We do not receive or store complete payment-card details.
• Technical and security data: device and app information, IP address, diagnostic logs, crash information, security events and similar operational data.
• Website and communications data: cookie choices, website interactions, enquiries, feedback and marketing preferences.
• User-submitted content: text, images, audio or other learning material submitted through a feature that expressly requests it.

Please do not submit health information or other special-category personal data unless a Phlow Academy feature specifically requests it and explains why it is needed.

4. How we obtain personal data

We obtain personal data:

• directly from the parent, account holder or learner;
• when the app records learning activity and progress;
• from Stripe, RevenueCat, Apple or Google following a purchase;
• automatically from the website, app or device; and
• from a parent when they create or manage a linked learner profile.

5. Why we use personal data

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

6. Learners and children

Phlow Academy is designed for learners, including people under 18. A subscription and parent account must be created and managed by an adult parent, guardian or authorised account holder. Learners use a linked profile rather than independently purchasing a subscription.

We aim to collect only the learner information needed to provide the learning service. We do not use learner progress data for targeted advertising, sell children's personal data, or ask learners to make decisions about payment. Parents and guardians may contact us about a linked learner's information, but the learner's own data-protection rights and best interests will also be considered.

If you believe a learner profile was created without appropriate authority, contact us at info@phlow.academy.

7. Learning recommendations

Phlow Academy uses learning activity, previous answers, scores, review status and topic progress to recommend a useful next learning experience and adjust the level of support or challenge. These recommendations are intended to support learning and can change as further activity is completed.

They do not make decisions producing legal or similarly significant effects, and they do not determine school grades, examinations, admissions or access to public services. A learner may use the available learning routes and the account holder may contact us with questions about how a recommendation was produced.

8. Service providers and recipients

We use carefully selected providers to operate Phlow Academy. Depending on the feature used, recipients may include:

• Google Firebase: authentication, databases, storage and application services;
• RevenueCat: subscription status, purchases and entitlements;
• Stripe: web checkout, billing and subscription management;
• Apple and Google: app distribution and in-app purchases;
• Cloudinary: storage and delivery of media used by relevant features;
• Airtable: structured content and operational data used to provide the service;
• Vercel: website hosting and delivery;
• Google Analytics and Google Tag Manager: website measurement where enabled and permitted by your cookie choice; and
• Wishpond: marketing communications and campaign management where you have provided the required information or consent.

Providers may process only the information needed for their role and are subject to contractual, confidentiality and security obligations where required. We may also disclose information to professional advisers, regulators, courts, law-enforcement bodies or a purchaser of the business where lawful and necessary.

9. International transfers

Some providers may process personal data outside Ireland or the European Economic Area. Where required, we rely on an adequacy decision, approved Standard Contractual Clauses or another lawful transfer safeguard. You may contact us for further information about the safeguard relevant to a particular provider.

10. Retention

We keep personal data only for as long as it is needed for the purposes described above. Account and learning records are normally kept while an account is active. Following a verified deletion request or account closure, information that is no longer needed is deleted or anonymised, subject to a reasonable period for secure deletion from operational systems and backups.

Transaction, invoice and accounting records may be retained for at least six years where required by Irish tax, accounting or company law. We may retain limited records for longer where necessary to resolve a dispute, prevent fraud, enforce agreements or meet another legal obligation. Support and security records are retained according to their sensitivity, the risk involved and the applicable limitation period.

11. Security

We use technical and organisational measures intended to protect personal data, including authenticated access, access controls, encrypted network connections, provider security controls and restricted administrative access. No internet service can guarantee absolute security. Please use a strong password, keep credentials private and tell us promptly if you suspect unauthorised access.

12. Cookies and analytics

The website may use essential technologies needed for security and basic operation. Non-essential analytics or marketing technologies should be used only in accordance with the cookie choices presented to you. You can change those choices through the website's cookie settings where available. Browser settings may also allow you to delete or block cookies, although this can affect website functionality.

13. Marketing communications

We may send service messages needed to operate an account or subscription. Marketing messages are separate. Where consent is required, we send them only with that consent. You can unsubscribe using the link in a marketing email or by contacting us. Unsubscribing from marketing does not stop necessary account, billing, security or service communications.

We do not use learner progress data to target advertising to children.

14. Your data-protection rights

Subject to applicable law, you may ask us to:

• provide access to your personal data;
• correct inaccurate or incomplete data;
• erase data in appropriate circumstances;
• restrict how data is processed;
• provide certain data in a portable format;
• stop processing based on legitimate interests; or
• withdraw consent where processing relies on consent.

Email info@phlow.academy to exercise a right. We may need to verify your identity and authority over a linked learner account. Rights are not absolute, and we will explain if a lawful exception applies. We normally respond within one month, subject to any extension permitted by law.

15. Complaints

Please contact us first so we can try to resolve your concern. You also have the right to complain to the Irish Data Protection Commission or, where applicable, another supervisory authority in the country where you live or work.

Irish Data Protection Commission:www.dataprotection.ie

16. Other websites and services

Phlow Academy may link to app stores, payment pages or other external services. Their privacy policies apply to the information they control. We encourage you to review those policies before providing information.

17. Changes to this policy

We may update this policy when the service, providers or legal requirements change. The effective date at the top identifies the current version. We will provide additional notice where a material change requires it.