Privacy Policy

“Astra AI”, “we”, “us” refers to Le Balcon Ltd. You can reach our privacy team at privacy@astra-ai.app.

Accounts are created and controlled by a parent or guardian, not by a child. Children never sign up on their own and we do not knowingly collect personal information directly from a child. A parent adds a learner “profile” for each child, using only a first name or nickname and an optional age band — no child email, surname, photo, or contact details are required or requested.

We designed the product to comply with the U.S. Children's Online Privacy Protection Act (COPPA) and, for the UK/EU, the GDPR provisions on children's data (GDPR-K) and the UK Age Appropriate Design Code. We rely on verifiable parental consentobtained at sign-up as the basis for processing a child's learning activity.

• Parent account: your name (optional), email address, and a securely hashed password. If you sign in with Google, we receive your name, email, and profile image from Google.
• Child learner profiles: a first name or nickname, an avatar colour, and an optional age band that you set.
• Learning activity: which cases a profile has started or completed, the code a learner writes, and any notes they save — so nobody loses their work.
• Billing: if you subscribe, our payment processor (Stripe) handles your card details. We never see or store full card numbers; we keep a customer/subscription identifier and your plan status.
• Technical basics: the minimum needed to run the service securely (e.g. an authentication session cookie). We do not use advertising trackers or third-party analytics that profile children.

• To provide the service — sign-in, saving progress, and tailoring cases by age band.
• To process subscriptions and send transactional email (receipts, password resets).
• To keep accounts secure and prevent abuse.
• To respond to your requests and support questions.

We do not sell personal information, we do not serve advertising, and we do notuse children's data to build profiles for marketing.

We share the minimum necessary with vetted providers who process data on our behalf:

• Stripe — subscription payments and billing.
• Vercel — application hosting.
• Neon — database hosting.
• Resend (or a comparable provider) — transactional email only.

The in-browser Python runtime (Pyodide) is loaded from a public CDN so lessons run on your device; the code a learner writes runs locally in the browser.

We keep account and learning data while your account is active. When you delete a learner profile or close your account, we delete the associated personal data within a reasonable period, except where we must retain limited records (e.g. billing records) to meet legal obligations.

As a parent or guardian, you can at any time review, correct, or delete your child's information, refuse further collection, and withdraw consent — which will end our processing of that child's activity. Depending on where you live, you may also have rights to access, port, or restrict processing of your own data under GDPR/UK GDPR or rights under U.S. state privacy laws. To exercise any of these, email privacy@astra-ai.app.

Passwords are stored only as salted hashes, traffic is encrypted in transit, and access to data is limited. No system is perfectly secure, but we take reasonable, industry-standard measures to protect your information.

We may process data in countries other than your own. Where we do, we use appropriate safeguards (such as standard contractual clauses) for transfers of personal data.

We may update this policy from time to time. If we make material changes affecting children's data, we will notify the parent account holder. The “last updated” date above always reflects the current version.

Questions or requests? Email privacy@astra-ai.app. See also our Terms of Service and Cookie Notice.