Children's Online Privacy Notice

A note for parents and schools

LUCA is an intelligent reading specialist used by children ages 5 to 14, including children with dyslexia and other reading difficulties. Many of our users are under 13, so the federal Children's Online Privacy Protection Act ("COPPA") applies. This Notice is written in plain language to help a parent, legal guardian, or school staff member quickly understand what happens with a child's information when that child uses LUCA.

This Notice is a summary. It does not create new commitments beyond those already set out in our Privacy Policy, our Terms of Service, and the Student Data Privacy Agreement we sign with schools and districts. If you want the full legal detail, please read those documents. Where this Notice and a binding agreement (such as the Privacy Policy or a signed Student Data Privacy Agreement) differ, the binding agreement controls.

If you have questions after reading this Notice, contact us at privacy@luca.ai.

1. Who this Notice is for

This Notice is for:

• Parents and legal guardians of a child using LUCA at home
• Teachers, reading specialists, school administrators, and district staff who set up LUCA for students
• Children themselves (with help from a trusted adult), to the extent they want to know what happens with their reading sessions

2. Quick summary

If you read nothing else, please read this:

• LUCA is a reading specialist for children. We collect only what we need to teach reading.
• We do not sell children's information.
• We do not show advertising to children inside LUCA.
• We do not use children's information to target advertising to families.
• We do not use a child's reading recordings or reading data for any purpose other than teaching that child reading, supporting the school's instruction of that child, security, legal compliance, and the limited de-identified analytics described in our Privacy Policy and Student Data Privacy Agreement.
• A parent, legal guardian, or school can review the information we have about a child, ask us to correct it, or ask us to delete it. Instructions are in Section 8 below.

3. How a child gets access to LUCA

A child may use LUCA in one of two ways:

Through a school or district. If LUCA is provided through a school or district, the school acts as the parents' agent and provides consent for educational use under the Family Educational Rights and Privacy Act (FERPA) and the COPPA "school authorization" framework recognized by the Federal Trade Commission. The school is responsible for telling parents that LUCA is being used and for providing any additional notice required by state law. Parents who want to opt their child out should contact the school first; the school can request that we stop collecting further information from that child or delete information we already have.

Through a parent or legal guardian directly. If a parent or legal guardian signs a child up at home, we ask the adult to confirm the child's age and to provide verifiable parental consent before the child uses LUCA. Verifiable parental consent is described in our Terms of Service and may include returning a signed consent form or confirming through a combination of email and a second verification step.

In either case, an adult is the one creating the account, agreeing to our Terms of Service, and consenting on behalf of the child.

4. What information LUCA collects from a child

We try to collect as little as we need to help the child read. The categories below match the categories in Section 1 of our Privacy Policy.

• Account identifiers. A child's first name (or a nickname chosen by the parent or school), grade level, and a username and password. If a school provides a roster, the school may also provide a student ID or class assignment so the child's progress reaches the right teacher.
• Reading information. Books or passages assigned, items completed, responses to reading tasks, and progress through a reading path.
• Voice and audio data. Audio recordings of the child reading aloud during a reading session, and the phoneme-level features our automatic speech recognition systems derive from those recordings to assess reading mastery.
• Technical and usage information. IP address, device and browser information, time stamps, and how the child interacts with reading activities. This helps us keep the service running, fix bugs, and protect the account.

We do not ask a child for a home address, phone number, photograph, video, biometric identifier, or government identifier. We do not ask a child for social media information. We do not allow children to chat with strangers or post profile content publicly inside LUCA.

If a child accidentally provides information we did not ask for (for example, by saying their full name during a reading session), we treat that information as part of the reading recording and apply the same protections described in Section 5.

5. How LUCA uses the information

We use a child's information only for the purposes already described in our Privacy Policy and, for school accounts, our Student Data Privacy Agreement. In plain language, those purposes are:

• To teach reading: deliver reading activities, score pronunciation, identify which sounds and words are giving the child trouble, and recommend the next step.
• To report progress to the child's teacher, reading specialist, parent, or guardian, so that human adults can see how the child is doing.
• To keep the service running, fix problems, prevent misuse, and protect accounts.
• To comply with applicable law and respond to lawful requests.
• To produce de-identified analytics and aggregate research so we can improve the service, as described in Section 4 of our Privacy Policy and Section 7 of our Student Data Privacy Agreement.

We do not use a child's information to advertise or market to the child or to the child's family. We do not use a child's information to build a profile of the child for any purpose other than teaching reading. We do not sell a child's information.

LUCA's reading recommendations are not made by computer alone. Teachers, reading specialists, parents, guardians, and LUCA staff can review and override the system's suggestions. This is described in Section 15 of our Privacy Policy.

6. Voice and audio data: special protections

Voice recordings of a child reading are among the most sensitive information LUCA processes. Our Privacy Policy (Section 5) and our Student Data Privacy Agreement (Section 7) describe how voice and audio data are handled. The most important points for a parent or school to know:

• Voice and audio data are processed and stored on Microsoft Azure servers in the United States (East US region). Voice data does not leave the United States.
• During the time the child is actively using LUCA, voice data is used to give the child personalized feedback and to track that child's reading progress.
• For school accounts, the school may choose whether teachers and reading specialists have access to identifiable audio recordings for instructional planning. The school may also opt out of that feature, in which case identifiable audio is deleted on a faster timeline. Section 7.7 of our Student Data Privacy Agreement explains this in full.
• Voice samples are not used to train shared or generalized artificial intelligence models unless an adult separately consents to that use during onboarding. That separate consent is optional, is not required to use LUCA, and can be withdrawn at any time.
• Voice recordings are not used for biometric identification or authentication. LUCA does not use voice data to verify "who" a child is.

Retention of voice data is set out in Sections 5 and 17 of the Privacy Policy. Earlier deletion can always be requested by a parent, legal guardian, or school by emailing privacy@luca.ai.

7. Who LUCA shares a child's information with

LUCA does not sell a child's information. We share a child's information only with the categories of recipients already listed in Section 6 of our Privacy Policy and Section 5 of our Student Data Privacy Agreement. Those are:

• The child's school or district, where LUCA is provided through a school or district. The school owns and controls Student Data, and we share the child's reading information with the teachers, specialists, and administrators the school authorizes.
• The child's parent or legal guardian, where LUCA is provided directly to a family or where the school has linked a parent account to a student account.
• Service providers we have contracted to help us run LUCA. Each is bound by a written contract that requires them to protect the information and to use it only to provide services to LUCA. The current list of service providers is published in Section 7 of the Privacy Policy and includes (among others): Microsoft Corporation (Azure) for voice processing and application hosting, Vercel for website hosting, Supabase for application database and authentication, and Google reCAPTCHA for anti-bot protection on forms. The full list, including purposes and locations, is in the Privacy Policy.
• Other recipients only as the Privacy Policy already permits: in connection with a legal obligation; to protect the rights, property, or safety of LUCA, our users, or others; in connection with a corporate transaction such as a merger or acquisition, where any successor will be bound by privacy commitments that are at least as protective; or with the parent's or school's direction.

We do not share a child's information with advertising partners. The advertising partners listed in our Privacy Policy (Meta, LinkedIn, Google Ads, TikTok) receive only website analytics and advertising information from adult marketing-website visitors who have given consent. Data collected from logged-in student sessions is excluded from those advertising partners.

We may share de-identified or aggregate data (information that does not reasonably identify the child) for research and reporting on the effectiveness of LUCA. The standard for de-identification, and the contractual protections we require of any research partner, are set out in Section 4 of our Privacy Policy and Section 7 of our Student Data Privacy Agreement.

8. How a parent or school can review, correct, or delete a child's information

A parent, legal guardian, or school can:

• Review the personal information LUCA has collected about the child.
• Correct information that is inaccurate.
• Refuse to allow LUCA to collect any more information from the child going forward.
• Delete the information LUCA has already collected.

How to make a request:

• For school accounts (most common case). Contact the child's school or district first. Under FERPA and our Student Data Privacy Agreement, the school controls access to the child's records. The school can review the child's information through LUCA's educator tools, and the school can ask LUCA to correct, delete, or stop collecting information. LUCA will support the school in carrying out the request. Section 6 of our Student Data Privacy Agreement and Section 14 of our Privacy Policy describe how this works.
• For accounts a parent or legal guardian set up at home. Email privacy@luca.ai with the subject line "COPPA Request." Include the parent's or guardian's name, the child's first name and account username, and what you want us to do (review, correct, refuse further collection, delete). For sensitive requests we will verify the requester's identity before acting, in the way described in Section 19 of our Privacy Policy.
• By postal mail. LUCA AI, LLC, 651 N. Broad Street, Suite 201, Middletown, DE 19709, attention: Privacy.

We will acknowledge a request within ten (10) business days and respond on the timelines set out in Section 19 of our Privacy Policy.

If a parent refuses to allow LUCA to collect any more information from the child, the child will not be able to keep using the parts of LUCA that depend on that information. We will tell the parent which features stop working before we end collection.

9. The school's role and the parent's right to override

When a school or district provides LUCA to its students, the school may authorize LUCA to collect information from the child for the school's educational use, in lieu of direct parental consent under COPPA. This authorization is valid only when (1) the information is used solely for the educational purpose the school authorized and never for any commercial purpose, (2) the school has authorized LUCA in writing (typically through our Student Data Privacy Agreement), (3) the school has authority under state law to consent on parents' behalf for that use, and (4) the school provides parents with notice of LUCA's use and their right to review, delete, or refuse further collection. This is the framework the Federal Trade Commission has set out in its COPPA guidance for schools.

Important things to know:

• The school is responsible for telling parents that LUCA is being used and for providing any further notice required by state law. We support schools in meeting that obligation, but the school carries the legal duty.
• A parent who does not want their child to use LUCA at school should contact the school first. The school can ask LUCA to stop collecting information from that child and to delete information already collected.
• LUCA does not use a child's school information to market to the child or the family, and does not sell a child's school information. These commitments are in Section 14 of our Privacy Policy and Section 4 of our Student Data Privacy Agreement.

10. How long LUCA keeps a child's information

We keep a child's information only for as long as we need it to provide LUCA, and we delete or de-identify it when it is no longer needed. The exact retention rules are in Section 17 of our Privacy Policy and Section 9 of our Student Data Privacy Agreement. In summary:

• For school accounts, we follow the timeline in the school's Student Data Privacy Agreement. After the school's agreement ends, or sooner if the school asks, we delete or de-identify the child's information in our active systems within sixty (60) days, subject to legal retention obligations.
• For parent-managed accounts, we delete or de-identify the child's information in our active systems within thirty (30) days of a parent's deletion request, subject to legal retention obligations.
• For voice and audio data, the timelines in Section 5 of the Privacy Policy and Section 7 of the Student Data Privacy Agreement apply. A parent or school can always ask for earlier deletion.
• Limited copies of information may remain in routine system backups for a short period after deletion. These backup copies are overwritten in the ordinary course of business.

11. Security

How LUCA protects information is described in Section 9 of the Privacy Policy and Section 5 of our Student Data Privacy Agreement. We use administrative, technical, and physical safeguards designed to protect personal information from unauthorized access. As the Privacy Policy says, no security measures can guarantee complete security. If we learn of a security incident affecting a child's information, we will follow the notification requirements in Section 9 of the Privacy Policy and Section 8 of our Student Data Privacy Agreement.

12. Changes to this Notice

We may update this Notice from time to time. When we do, we will update the version number and the "Last Updated" date at the top. If a change materially affects what we do with a child's information, we will provide additional notice consistent with Section 20 of our Privacy Policy.

13. Contact LUCA

If you have a question about this Notice or about how LUCA handles a child's information, please contact us:

LUCA AI, LLC 651 N. Broad Street, Suite 201 Middletown, DE 19709

Phone: (412) 346-8872 Email: privacy@luca.ai Support: support@luca.ai

The operator of LUCA, and the entity responsible for this Notice, is LUCA AI, LLC.

---