SafeSurfIQ COPPA Compliance Statement

SafeSurf IQ is a paid educational platform that allows users aged 13 and above. Users under 13 are permitted only with verified parental or guardian consent through a parent-managed account.

We follow strict data minimization principles and only collect the following:

• Account credentials: username and password
• Course progress data: learning activity and completion status
• IP address: may be processed and stored by our payment provider (DodoPayments) during subscription transactions

We do not collect:

• Email addresses
• Phone numbers
• Names
• Location data
• Behavioral tracking data
• Advertising identifiers

SafeSurf IQ uses a verifiable parental consent (VPC) model:

• A parent or guardian creates a master account
• During child account creation, the parent is shown a COPPA consent notice dialog
• The parent explicitly confirms consent before a child account is created
• Parents create child accounts using a username and password system
• The child receives credentials directly from parent/guardian and logs in after initial setup

This process serves as the official parental consent mechanism under COPPA.

Parents or guardians have full control over child accounts, including:

• Viewing child learning progress
• Managing child accounts
• Deleting child accounts at any time

When a parent deletes their master account, all associated child accounts and data are automatically deleted.

We use collected information solely to:

• Provide access to SafeSurf IQ learning content
• Track educational progress
• Manage authentication and user sessions
• Process subscription payments via DodoPayments

We do not use any data for:

• Advertising
• Profiling
• Behavioral targeting
• Data monetization

• Data is stored securely using Neon database, with encryption at rest
• The application is hosted on Vercel
• Vercel may provide error reporting for system stability
• We do not maintain custom logging or user tracking systems

We use the following service providers:

• DodoPayments — handles payment processing and may independently collect payment-related data such as IP address and billing details during transactions
• Neon — secure database storage
• Vercel — hosting and error reporting

These providers operate under their own privacy and security policies.

We retain user account data and course progress only for as long as the account remains active.

Data is permanently deleted when:

• A parent deletes a child account
• A parent deletes their master account

SafeSurf IQ does not knowingly collect personal information directly from children without parental involvement.

All child accounts:

• Are created by a parent or guardian
• Require explicit parental consent before activation
• Are fully controlled by the parent account

SafeSurf IQ is designed to comply with COPPA by:

• Limiting data collection to the minimum necessary for educational functionality
• Requiring verified parental consent before any child account is created
• Providing parents full control over their child's data
• Avoiding advertising, profiling, and behavioral tracking
• Using secure, industry-standard infrastructure providers