Privacy Policy
About this policy
This policy applies to personal information handled by Kid's Creative Academy Inc. through our website (kca.bypauls.com), our booking platform (kca.bypauls.com/KCA/app), in-home and online sessions, and our email, phone and messaging contact with you. It is written to meet the Personal Information Protection and Electronic Documents Act (PIPEDA) and its ten fair information principles.
"Personal information" means any information about an identifiable individual. "You" means the parent or legal guardian who deals with us. "Student" means the child you register.
Who we are
Kid's Creative Academy Inc. is a Canadian corporation based in Stittsville, Ottawa, Ontario. We provide in-home and online tutoring, enrichment classes, workshops and camps for children. Our founder, Sampurna D. Paul, is our privacy officer and is accountable for this policy. Contact details are in Section 15.
What we collect
From parents and guardians
- Name, email address and phone number;
- Home address (needed for in-home sessions and invoicing) and time zone;
- Your Google account name, email and profile picture when you sign in with Google. We never see your Google password;
- Booking history, attendance, package balances and payment records. Card numbers are handled by our payment processor and never stored by us;
- Messages you send us and notes from calls;
- The parental consent statement you accepted, with its version and date.
About Students
- First name, last name (optional), date of birth or age, and grade;
- Subjects, learning goals, and any learning needs you choose to share;
- Allergies or medical conditions relevant to a session, only if you tell us;
- Tutor progress notes and attendance;
- Work created in class, kept only where needed for progress tracking.
From tutors and staff
- Contact details, qualifications, references, police record checks with vulnerable-sector screening, availability and payment details.
From website visitors
- Standard server logs (IP address, browser type, pages visited, time), used only for security and to keep the site working. We do not run advertising trackers.
Children's information
We collect information about a Student only with the consent of a parent or guardian, recorded when you accept the parental consent statement. We collect the minimum needed to teach safely and to show you progress. We do not:
- collect a Student's own email, phone number or social media handles;
- publish a Student's name, image or work without separate written permission from you, which you can withdraw at any time;
- use Students' information for marketing or profiling;
- share Students' information with anyone except as set out in Section 7.
You can see and update your child's profile at any time on the platform, and can ask us to delete it under Section 11.
How we use it
| Purpose | Examples |
|---|---|
| Delivering sessions | Matching a tutor, planning lessons for the Student's age and goals, visiting your home, sending joining links. |
| Bookings and payments | Scheduling, reminders, package balances, invoices, refunds. |
| Communication | Answering enquiries, progress notes, cancellation notices, service updates. |
| Safety | Knowing about allergies or conditions relevant to a session, keeping a record of who attended. |
| Running the business | Accounting, tax records, resolving disputes, meeting legal obligations. |
| Improving our services | Understanding which subjects and formats families choose. We use aggregated, de-identified data for this. |
We do not use automated decision-making that has legal or similarly significant effects on you or your child.
Consent
We rely on your consent, given when you register, accept the parental consent statement, book a session or contact us. Consent for sensitive information such as a medical condition is always express and you decide what to share. You may withdraw consent at any time by contacting us, subject to legal or contractual limits; withdrawing consent may mean we can no longer provide sessions.
We may collect, use or disclose information without consent only where PIPEDA allows it, for example to comply with a legal requirement, to respond to an emergency that threatens a person's life or safety, or to protect a child from harm.
Who we share it with
We share personal information only with the service providers below, with tutors who need it to teach, and where the law requires. We do not sell or rent personal information.
| Provider | What they do for us | What they see |
|---|---|---|
| Tutors working for KCA | Teach sessions | Student's first name, age, goals, relevant needs, your contact details and address for their assigned sessions only. |
| Google (Sign-in, Meet) | Account sign-in; online sessions | Your Google account identity; meeting participants. |
| Zoom (where used) | Online sessions | Meeting participants and display names. |
| Payment processor (e.g. Stripe) | Card payments | Payment details, name, email, amount. Card numbers stay with the processor. |
| Email delivery provider | Booking confirmations and reminders | Email address and message content. |
| Cloudflare and our hosting provider | Serving the website and platform securely | Connection data such as IP address; platform data at rest. |
| Accountant / legal advisers | Tax and compliance | Invoice records as required. |
Each provider is bound by contract or by their published terms to protect the information and to use it only to provide their service to us. We may also disclose information when required by law, court order or a lawful request from a public authority, and we will tell you where we are allowed to.
Where it is stored
Our booking platform and its database run on servers we control in Canada. Some providers listed in Section 7, such as Google, Zoom, Stripe and Cloudflare, may process information in the United States or other countries. While information is outside Canada it is subject to the laws of that country, including lawful access by authorities there. We choose providers with strong security and contractual safeguards for this reason.
How long we keep it
| Information | Kept for |
|---|---|
| Account and Student profile | While you have an account, then deleted within 90 days of closure unless a shorter or longer period below applies. |
| Progress notes and attendance | 2 years after the Student's last session, so that returning families keep their history. |
| Consent records | 3 years after the last session, to show consent was obtained. |
| Invoices and payment records | 7 years, as required by Canadian tax law. |
| Session recordings (only if requested) | 90 days. |
| Enquiries from people who never register | 12 months. |
| Server logs | 30 days. |
When information is no longer needed we delete it or de-identify it so it no longer identifies anyone.
Security
We protect personal information with safeguards appropriate to its sensitivity, including encrypted connections (HTTPS) for the website and platform, role-based access so tutors see only their own students, password and Google sign-in for staff, encrypted backups, and a small number of people with access. Tutors are bound by confidentiality obligations. If a breach creates a real risk of significant harm to you or your child, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires.
Your rights
You may, for yourself and for the Students you registered:
- Access the personal information we hold and learn how it has been used and shared;
- Correct anything inaccurate or incomplete, directly on the platform or by asking us;
- Withdraw consent to a use or disclosure, subject to legal and contractual limits;
- Delete your account and Student profiles, except records we must keep by law (Section 9);
- Complain about our handling of personal information (Section 15).
Contact us using Section 15. We respond within 30 days and will not charge for a reasonable request. We may ask you to verify your identity first. If we refuse a request, we will tell you why and how to challenge the decision.
Quebec residents: if you live in Quebec, you also have the rights set out in the Act respecting the protection of personal information in the private sector, including the right to data portability where it applies.
Emails and CASL
We send transactional emails about your bookings (confirmations, reminders, receipts, schedule changes). These are part of the service and cannot be turned off while you have active bookings. We send news about new classes, camps and offers only if you opt in, and every such email includes an unsubscribe link that takes effect within 10 business days, as required by Canada's Anti-Spam Legislation (CASL). We never send marketing to children.
Cookies
The platform uses a strictly necessary session cookie to keep you signed in and a cookie to protect against cross-site request forgery. The marketing website uses no analytics or advertising cookies. Third-party services you are taken to, such as Google sign-in or a video call, set their own cookies under their own policies.
Changes to this policy
We will update this policy when our practices or the law change. Material changes will be announced by email to account holders and on the platform before they take effect. The current version and its effective date are always published at this address.
Contact and complaints
Privacy officer: Sampurna D. Paul
Kid's Creative Academy Inc., Stittsville, Ottawa, Ontario, Canada
- Email: [email protected] (put "Privacy" in the subject line)
- Phone: +1 (437) 261-8578
If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec K1A 1H3, toll-free 1-800-282-1376.
See also our Terms of Service and Services & Policies.