Learn with Zola · Beta privacy notice · 2026-09-18-insights

Your family’s information

Learn with Zola is a UAE-based learning service for children aged 10–12, set up and controlled by a parent or carer. For privacy questions or requests, email hello@learnwithzola.com.

Read the short explanation for children or open your parent data controls.

What we collect and why

• Your email address, sign-in information, plan choice and dated acknowledgements, to operate and protect your account.
• Your child’s first name or nickname, age band, learning preferences, school year and curriculum choices, to make the learning experience relevant. Please use a nickname if you prefer.
• Messages, session notes, homework photos and submitted drawings, to provide guided help and screen for inappropriate content or safety concerns.
• Learning summaries, reflections, answers, progress and saved flashcards, including pictures on saved cards, so learning can continue across visits.
• Minimal safety records: event type, severity, time and review status. These are separate from the temporary conversation.
• Limited product events and operational records, to understand whether features work, prevent misuse and diagnose faults. Product analytics do not contain chat text or homework photos. These events include topics chosen, features shown and used, session milestones, broad screen-width categories, response times, errors and optional helpfulness feedback. Restricted founder reports help us improve the beta; they do not display children’s names or conversations.

We use this information to provide the service you request, protect children and accounts, and operate the beta. We ask separately before introducing optional uses that need your permission. We do not sell family information or use it for advertising.

We also ask which country your child usually uses Zola in, to support safety guidance. We do not collect a precise location for this purpose.

What parents and the Zola team can see

Parents can see learning summaries, reflections, progress and safety alerts. Their data download includes saved cards and the learning records described below. The parent dashboard does not provide a full chat transcript. Authorised support or safety review may require access to retained information; we restrict access to what is needed for that work.

Zola is an AI learning guide, not a confidential counselling or emergency service. If a safety concern is detected, the app may record an event and notify the parent after a safe-contact review. Concerns are initially restricted to the authorised reviewer. Review is best effort, with no guaranteed response time or continuous monitoring. Automated screening can miss things or get them wrong. In immediate danger, contact local emergency services or a trusted adult.

How long we keep it

• Session messages, homework photos, drawings and opening notes: removed from the active database when the session finishes. Unfinished sessions expire 7 days after they start; daily cleanup removes their temporary content.
• Summaries, reflections, saved cards and learning progress: kept while the profile exists, unless you clear its learning history sooner.
• Product analytics: removed after 90 days by daily cleanup, or when the child profile is deleted.
• Safety records: reviewed after 90 days. Resolved records are removed by cleanup; unresolved concerns need review. A documented, time-limited safety hold can delay deletion of a profile or account.
• Account and acknowledgement records: kept while your account exists. A minimal deletion reference is kept for 30 days after completion to manage retries and prevent stale sign-ins.

Daily cleanup is not instantaneous and retries after failures. Copies may remain in restricted provider logs, delivered email or backups until their retention periods end. Deleting an account does not recall email already delivered to an inbox. We do not promise immediate erasure from every backup; contact us for a request covering provider-held information.

Services that help us run Zola

• Vercel: website hosting and operational request logs.
• Neon: our application database, including profiles, learning records and stored image files.
• Supabase: parent sign-in, password recovery and authentication records.
• OpenAI and Anthropic: AI processing when selected for learning, screening or related generation. Relevant messages, learning context and images may be sent to the selected provider.
• Resend: transactional email, including password recovery and parent notifications. Resend’s retention information describes its email and log storage.
• Microsoft 365: correspondence you send to our support inbox.

Being UAE-based does not mean all information stays in the UAE. Our hosting, database, authentication, AI and email services may process information outside the UAE. Provider processing and retention depend on the service and account configuration; we review these as part of operating the beta.

Voice, cookies and this device

Optional voice input uses your browser’s speech recognition. Your browser or device provider may process microphone audio; Zola receives the recognised text. Zola does not store a voice recording for that feature. Read-aloud may send approved text to a speech provider.

We use cookies to keep you signed in, protect parent controls and remember which child is learning. Device storage also remembers display, voice and daily-fact preferences. Unsent working-board drafts live in the open app’s memory and disappear when it closes or reloads. We do not use advertising cookies.

Your choices and requests

In Privacy & data, unlock parent controls and re-enter your account password to download your retained learning records, clear a child’s learning history, delete a profile or request deletion of the family account. Pausing a profile stops new learning sessions; it does not delete its records.

The routine download includes account details, acknowledgements, profiles, summaries, reflections, progress, quiz attempts, saved card text, safety-event metadata and product analytics. It excludes temporary chat, homework uploads, image files and restricted safeguarding material. For a fuller access request, correction, withdrawal of a permission, objection or complaint, email us. We verify authority and consider the child’s privacy and other people’s information before disclosing sensitive records. Already-deleted content cannot be recovered for an export.

Account deletion first disables family access and queues removal of the login identity and active application records. Failed steps are retried. A safety hold or provider problem can delay completion; use the request reference to contact us. You can raise concerns about our handling of a request with the relevant data-protection authority.

Changes to this notice

We date and version this notice and record which version a parent acknowledged. We will explain material changes and request a new acknowledgement or permission where appropriate.