Privacy Policy

1. Data Controller

SimpleRead is the data controller responsible for processing your personal data under this Privacy Policy.

• SimpleRead (simpleread.foundation)
• Contact: contact@simpleread.foundation

2. Personal Data We Collect

We collect the following categories of personal data:

• Identity data: full name, email address, profile picture
• Authentication data: hashed password, OAuth tokens (when using Google login)
• Educational data: classroom enrollments, assigned reading materials, role (student/teacher)
• Preferences: visual and reading accessibility settings
• Technical data: session tokens, IP address, browser type via our hosting provider
• Usage data: page visits and interactions (only with your consent to analytics)
• Contact data (optional): a guardian's WhatsApp phone number, collected only if you opt in to receive weekly reading reports, and verified with a one-time code
• Payment data (Brazil only, from the paying guardian): a Brazilian tax ID (CPF), collected only when a Brazil-billed guardian chooses to pay by Pix, because their bank requires identifying the account holder to authorise the recurring charge; paying by card does not require it, and this does not apply to EU billing, which is not yet available
• Photos sent from a phone (optional): if you use the QR code on the photo upload screen, the photos taken on the phone pass temporarily through our storage and are deleted within the times described in section 15

3. Legal Basis for Processing

We process your personal data under the following legal bases (GDPR Article 6 / LGPD Article 7):

• Contract performance (Art. 6(1)(b)): processing necessary to provide the educational platform services you signed up for
• Consent (Art. 6(1)(a)): analytics cookies and tracking (Microsoft Clarity, Vercel Analytics) - only if you accept in the cookie banner
• Legal obligation (Art. 6(1)(c)): retaining data required by applicable law
• Legitimate interests (Art. 6(1)(f)): platform security, fraud prevention, and service improvement

4. How We Use Your Data

We use your data to:

• Provide, operate, and maintain the educational platform
• Authenticate users and manage sessions
• Send transactional emails (email verification, exam notifications)
• Personalize the reading experience based on your accessibility preferences
• Analyze platform usage and performance (only with analytics consent)

5. Third-Party Data Processors

We share data with the following sub-processors to operate the platform. All processors are bound by data processing agreements (DPA):

Analytics services (Vercel Analytics and Microsoft Clarity) are only loaded after you explicitly accept analytics cookies.

6. Cookies & Local Storage

We use minimal local storage technologies:

• Necessary: session authentication cookies (required for login to work)
• Necessary: login preference (localStorage key 'simpleread_remember') - stores whether you selected 'Remember Me'
• Analytics (opt-in): Microsoft Clarity and Vercel Analytics cookies - only set after you accept in the cookie consent banner
• Necessary: photo capture drafts (IndexedDB database 'simpleread-photo-drafts') - photos from a capture in progress are kept on your device so the capture is not lost, are never sent anywhere until you confirm the upload, are erased once sent, and are automatically discarded after 7 days if abandoned

You can manage your cookie preferences at any time using the cookie banner or your browser settings.

7. Data Retention

We retain personal data for the following periods:

• Account data: retained for as long as your account is active; deleted within 30 days of account deletion request
• Session tokens: expire after 30 days of inactivity or when you sign out
• Email verification codes: expire automatically after 15 minutes
• Analytics data: as configured with the analytics provider (Microsoft Clarity default: 12 months)
• Photos sent from a phone by QR code: deleted as soon as the computer receives them; if that does not happen, the link expires after 15 minutes without new photos or 60 minutes in total, and an hourly cleanup job deletes what is left (section 15)

8. Learning Analytics Data

We collect learning interaction data to improve the educational experience. This data is collected only for students and only when analytics consent has been granted.

Data we collect:

• Reading session duration
• Page navigation patterns
• Dictionary word lookups
• Audio playback usage
• Text completion progress
• Reading preferences used

Purpose:

Improve educational outcomes, help teachers identify students who need support, and provide personalized reading insights.

Legal basis: Consent (analytics consent via cookie banner) and Legitimate educational interest (GDPR Art. 6(1)(f) / LGPD Art. 7, IX).

Retention: Learning analytics data is retained for the duration of the student's enrollment plus 1 year.

Children's protections: For students under 12 (LGPD Art. 14), parental consent is required before collecting learning analytics data.

Only student behavior is tracked. Teachers and administrators are not subject to behavioral monitoring.

Students can disable learning analytics at any time via the cookie consent settings. Disabling analytics does not affect access to the platform.

8. Your Rights

Under GDPR and LGPD, you have the following rights regarding your personal data:

• Right to Confirmation of Processing (Art. 15 GDPR) — Confirm whether we process your personal data. Contact our DPO at contact@simpleread.foundation.
• Right of Access (Art. 15 GDPR) — Request a copy of all personal data we hold about you. Use the 'Export My Data' feature in your profile settings.
• Right to Rectification (Art. 16 GDPR) — Correct inaccurate personal data. Update your name and profile picture directly in your profile settings.
• Right to Erasure (Art. 17 GDPR) — Request deletion of your account and personal data using the 'Delete Account' option in your profile settings.
• Right to Data Portability (Art. 20 GDPR) — Receive your personal data in a structured, machine-readable format. Use 'Export My Data' in your profile settings.
• Right to Erasure of Consent-Based Data (Art. 17 GDPR) — If you withdraw analytics consent, data collection by Microsoft Clarity and Vercel Analytics stops immediately. Revoke via Profile > Privacy & Data > Cookies.
• Right to Know Recipients (Art. 15.1.c GDPR) — See Section 5 of this policy ('Third-Party Processors') for the full list of organisations with whom your data is shared.
• Right to Object to Processing (Art. 21 GDPR) — Analytics consent is optional - the platform works without it. You can also object to legitimate-interest processing by contacting our DPO.
• Right to Withdraw Consent (Art. 7.3 GDPR) — Withdraw consent for analytics at any time in Profile > Privacy & Data, or via the cookie banner. Withdrawal does not affect prior lawful processing.

To exercise your rights, contact us at contact@simpleread.foundation. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority (UK: ICO; Germany: BfDI; France: CNIL; Italy: Garante).

9. Children's Data

SimpleRead is an educational platform used in school environments and may process data of users under 18. Students are enrolled by their school or teacher. If you are a parent or guardian and believe your child's data has been collected without appropriate consent, please contact us immediately at contact@simpleread.foundation.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including password hashing (bcrypt), HTTPS encryption in transit, session token expiry, and access controls. No system is completely secure; in the event of a data breach affecting your rights, we will notify you and relevant authorities as required by law.

11. International Data Transfers

Some of our processors are located in the USA. Transfers outside the EEA are protected by Standard Contractual Clauses (SCCs) or equivalent safeguards provided by each processor. For details, refer to each provider's privacy policy. Exception: the WhatsApp report delivery described in the Section 5 table is not covered by contractual clauses with Meta; it relies on the guardian's explicit consent, given also on the child's behalf, as the transfer derogation (GDPR Art. 49(1)(a)).

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on our platform. The date at the top of this page always reflects the latest version.

13. Payment Data (Subscription)

For subscriptions billed in Brazil, we process the following additional data. This section does not apply to EU billing, which is not yet available.

CPF: we collect a Brazilian tax ID (CPF) only from the guardian who pays the subscription, and only when they choose to pay by Pix. This is required because the payer's own bank needs to identify the account holder to authorise the recurring charge - without it, automatic Pix payments cannot work. Guardians who pay by card are never asked for a CPF. We never ask a child, a dependent, or a school user for a CPF.

Legal basis: performance of a contract (LGPD Art. 7 V) - identifying the payer is part of fulfilling the subscription - and legal obligation (LGPD Art. 7 II), for Pix identification rules and the foundation's own fiscal duties. We do not rely on consent for this: consent must be freely revocable, and a payer cannot revoke their CPF and keep paying by Pix.

What we do with the CPF: it is sent to Asaas, our Brazilian payment processor, to create the payer's customer record. We do not store the CPF in our own database - we keep only the customer identifier Asaas returns, which is enough for every operation we need.

Credit card data never passes through our systems: card payments happen on a page hosted by Asaas itself. To spare you retyping them, we send that page your account's name and e-mail; never your CPF or phone number.

14. Assisted Access: when support enters your account

In some cases, someone from our team can temporarily enter your account to help fix a problem — without you ever giving out your password. We call this Assisted Access. This section explains exactly when that happens, what that person can and cannot do, and how it gets logged.

Who can do this, and on which accounts

• Only a SimpleRead administrator can open an Assisted Access session. No other teacher, coordinator or guardian can enter your account this way.
• This is only possible on teacher, coordinator or guardian accounts. Student and dependent accounts (a child's profile inside a family) are out of scope for this phase: we do not yet have the specific legal basis GDPR requires (Art. 8) for this kind of support on a minor's own account. That decision is with our DPO and is tracked as an open item before the feature is extended to those accounts.
• An administrator cannot open a session on another administrator's account, and an assisted session can never open another one from inside itself.

How long it lasts

Each session lasts at most 1 hour and expires on its own, even if nobody ends it first. An administrator can only have one assisted session open at a time.

How you know it's happening

When a session is opened on your account, you get an email saying that it happened, when, and how to reach us — without the internal reason and without the name of the person who opened it. While the session is active, a fixed banner appears at the top of every screen of the person using the access, reminding them that it is someone else's account, with a button to end it at any time.

What stays blocked, even during Assisted Access

Whoever is helping you cannot: change your password, touch your linked accounts (such as Google sign-in), delete your account, touch your subscription or payment, change any privacy consent — yours or a child's or dependent's —, reset a child's PIN, add or remove people in your family, register or change your phone number and WhatsApp, start receiving your notifications in their browser, or download all of your data. Any attempt to do any of these is refused automatically by the system.

Outside that list, the person sees and does what your own account already sees and does — for example, if you are a teacher, they see the classrooms and students you already see; if you are a guardian, they see your child's data you already see. Assisted Access does not widen what is visible: it borrows, for up to 1 hour, the view your own account already has.

What gets logged

Every opening and every closing of an assisted session is logged: which administrator, which account was accessed, the reason they wrote, the time, the IP address, and the browser used. Any action that changes data during the session is also logged.

Viewing a screen is also recorded, in summary form: at most one line every 5 minutes for each page or query accessed during the session — the log says what was accessed, not the content that appeared. And the record that a session was opened, by whom, and for how long, always exists, and that is what answers "who entered my account, and when".

Today, this log is read by our internal team — administrators and auditors. If you want to know whether and when your account was accessed this way, beyond the email you receive, ask our DPO directly: contact@simpleread.foundation.

Legal basis: we process this log as part of performing the service you signed up for (Art. 6(1)(b)) and our legitimate interest in keeping the platform secure (Art. 6(1)(f)).

How long we keep this log: we have not yet set a retention period. This is an open item with our DPO, and we will update this page once it is decided.

15. Photos sent from your phone (QR code)

On the screen where you add photos of book pages, someone using a computer can show a QR code. Scanning it with a phone opens a page that only opens the camera and asks for no login: the photos taken on the phone appear on the computer screen. This section explains what happens to those photos and to that link.

What we collect on this path

The photos taken and sent from the phone through that link. They are photos of book pages, but they can accidentally show a child's hand, face or surroundings. While the link exists we also keep a small technical record: which account opened the link, the time, and how many photos were sent. We never keep the link itself, only an unrecognisable version of it (a hash), from which nobody can rebuild the link.

Where the photos go

The phone sends each photo straight to our cloud storage, Google Cloud Storage (section 5 says where it runs and section 11 covers international transfers), into a temporary folder, through an address that works for 10 minutes at most. That is why the phone's IP address also reaches Google and our hosting provider, as in any visit to a website. The computer downloads the photos from that folder. On this path, no other service receives the photos.

How long the photos stay

Each photo is deleted from our storage once the computer confirms it received the photo and placed it on the upload screen. This happens while the computer's screen is open and visible: it asks for new photos every few seconds.

If that confirmation does not happen (for example, you closed the computer first), the link stops working after 15 minutes without a new photo (each photo sent restarts those 15 minutes) or after 60 minutes in total, whichever comes first. An automatic job runs every hour and deletes whatever is left from closed links, along with the technical record. In these cases a photo can stay stored for up to about two hours. If the storage refuses a deletion, the job tries again an hour later, and the time stretches until the deletion succeeds.

When you leave the upload screen, the computer asks us to close the link and delete the photos still there (if that request does not arrive, the times above apply). And if you delete your account, we also delete any photos of this kind that still exist.

Who can send photos and who can see them

The link asks for no login. Anyone who has the link, or who photographs the QR code while it is on screen, can send photos into that session until the link closes, up to 50 photos per link. That person can only send: they cannot see or download any photo. So show the QR code only to people you trust, and check the photos on the screen before you create the content.

The photos are seen by the account that opened the link, after it logs in. Our system has no screen where our team views these photos, and even during Assisted Access (section 14) support cannot open this link or see these photos. Technical access to the storage belongs to whoever administers our cloud account.

Location data in the photos

Before sending, the phone page redraws each photo and saves it again as a JPEG. This leaves out the data hidden inside the photo file, such as the location (GPS). This step happens on your phone; our server does not inspect the contents of the file it receives. The photo itself, of course, still shows what is in the picture.

After the content is created

The photos you choose to use go through the platform's normal path for any photo you upload, described in sections 5, 7 and 11. On its own, this feature keeps no copy of the photos or of the link after the times above: the photos are deleted and the technical record is removed together with the link.

Children and teenagers

Because the photos can show a minor, we treat this path with the care the LGPD requires for children's and teenagers' data (Art. 14): always in their best interest and with the guardian in charge. The link is opened by the guardian's account or by the child's own account, and the latter only if the guardian has allowed the child to send photos. The guardian can change that permission.

For children under 12 (or with no age filled in), a child's upload only goes on to processing after the guardian approves it. From 12 to 17, the upload goes straight through, under the guardian's supervision. If you are a guardian and have questions about this path, write to our DPO: contact@simpleread.foundation.

16. Contact

For any questions or requests regarding this Privacy Policy or your personal data, please contact us:

contact@simpleread.foundation