Information Privacy Policy

Brilavo Inc.
322-1470 Rue Peel, Montréal, Québec, H3A 1T1, Canada
info@brilavo.com
Version 1.0 — Effective Date: 2026-10-21

Preamble

At Brilavo Inc. (“Brilavo”), a Canadian company headquartered in Montréal, Québec, we place the utmost importance on protecting the confidentiality of our users' data. Because our educational platform, ExamA+, is designed for students and their families, we hold ourselves to a particularly high standard when handling the personal information of children. This Policy reflects our commitment to privacy and complies with applicable laws.

Scope of the Policy

This Policy applies to the Brilavo website (brilavo.com), the ExamA+ application, and all related services. It takes into account the requirements of the Personal Information Protection and Electronic Documents Act (PIPEDA) and Québec's Act respecting the protection of personal information in the private sector, as amended by Law 25, in coherence with our Personal Information and Security Policy.

Objectives

Our aim is to treat all personal information — especially that of children — with the highest degree of confidentiality and security, as detailed in our Security Policy and Data Erasure Policy.

Information We Collect

We limit our collection to the information necessary to deliver our educational services, including:

• Account information provided by a parent or guardian (name, email address, billing information).
• Basic student profile information (first name, grade level, province of study).
• Learning data generated through use of ExamA+ (exercises completed, scores, progress, practice streaks), including the time spent on each question and on the multiplication tables, and the history of changes in mastery level for each concept. Only time while the app is open and active is counted.
• App usage data, recorded on our own servers: for example a parent viewing a child's dashboard, the subscription page being shown, a notification being sent, or a grade change. It is used to understand how the service is used so we can improve it, is analyzed only in aggregate, and is deleted after 24 months.
• Rewards a parent creates for their child (reward name, emoji, goal) and the dates a reward is earned, seen by the child, and handed over.
• When a free-access code is redeemed on our support site: the email address entered, the code used, and the IP address of the request. The email is kept with the resulting free-access record; the IP address is used to prevent abuse and is erased after 30 days.
• Technical information required to operate and secure the platform (device type, app version, log data).
• Crash reports, when the app closes unexpectedly: device model, operating-system version, app version, and the technical error trace. These reports are used solely to fix faults and contain no name, email address, or answers given by your child.
• Photos of exercises, when a subscribed student uses the "Snap an exercise" feature. The photo is used only to identify the math concept in the exercise so we can suggest practice. Before sending, the app removes the photo's metadata (including location). The ExamA+ app does not keep the photo and our servers do not store it: it is deleted as soon as the analysis is complete. For each analysis we keep only a technical record (outcome, duration, number of suggestions, estimated cost), without the photo or its content, for 24 months.

Children's Privacy and Parental Consent

ExamA+ is intended for use by students under parental supervision. Accounts for students are created and managed by a parent or guardian. In accordance with Québec's Law 25, where a user is under 14 years of age, consent for the collection of personal information is obtained from the person having parental authority.

• We collect only the minimum information necessary to provide the educational service.
• We do not serve behavioural or targeted advertising to children.
• We never sell or rent children's personal information.

Consent

Consent for the collection and use of personal data is obtained transparently and in an informed manner. Data is collected only for the required services and with the consent of the user or, in the case of a minor, of their parent or guardian. Consent may be withdrawn at any time, subject to legal or contractual restrictions.

Information Transmitted via Email or Form

Personal information voluntarily provided to us by email or through a form is treated with the utmost confidentiality and is used only for the needs expressed by the user.

Data Sharing

Brilavo does not sell or rent personal information. Data may be shared only with:

• Service providers essential to operating the platform (such as cloud hosting, payment processing, email delivery, push notifications, crash reporting, and exercise photo analysis), bound by contractual confidentiality and security obligations. Some of these providers, including hosting and email delivery, may process data outside Quebec, including in the United States.
• Google Firebase (Google LLC), for push notifications and crash reporting. This data may be processed outside Quebec, including in the United States. We do not enable any third-party behavioural analytics or advertising tooling: our usage statistics are produced on our own servers, in aggregate, and are never used for advertising.
• Anthropic (Anthropic PBC), provider of the artificial intelligence model that analyzes exercise photos. We send it only the photo and the list of concepts in the student's program, never the student's name or any other identifier; the photo may, however, show whatever is written on the page. Anthropic does not use this data to train its models. It is processed outside Quebec, including in the United States, and may be retained there temporarily under Anthropic's data retention policy before being deleted.
• Parents or guardians, with respect to their own child's learning progress.
• Authorities, where required by applicable law.

All sharing respects legal provisions and our Personal Information and Security Policy.

Information Security

Robust security measures, detailed in our Security Policy, are in place to protect data against any unauthorized access or manipulation.

Within Brilavo, only a small number of authorized team members can view account data, through a password-protected internal dashboard used solely for support and service improvement. Access is limited by role: read-only accounts see neither email addresses nor first names. Every view of an identified family record and every support action is logged.

Incident Declaration

In case of an incident affecting data security, Brilavo commits to informing affected users — and, where required, the Commission d'accès à l'information du Québec and the Office of the Privacy Commissioner of Canada — in accordance with the processes established in our Security Policy.

Your Rights

Users, and parents or guardians acting on behalf of a minor, may request access to, correction of, or deletion of personal information by contacting us. We respond to such requests within 30 days, in accordance with applicable law and our Data Erasure Policy. See Delete your account.

Right to portability: in accordance with Québec's Law 25, you may request that computerized personal information we hold about you (or your child) be provided to you — or, where technically feasible, to another organization you designate — in a structured, commonly used technological format.

Complaints

Any person may file a complaint regarding Brilavo's handling of personal information by writing to the Privacy Officer at privacy@brilavo.com. Complaints are acknowledged promptly, examined by the Privacy Officer, and answered in writing within 30 days. If you are not satisfied with the outcome, you may address the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.

Revision

This Policy is reviewed annually to stay in line with legislative and technological evolutions and our contractual obligations.

Privacy Officer and Contact

The Privacy Officer of Brilavo Inc. is the person responsible for the protection of personal information within the meaning of Québec's Law 25 and oversees compliance with this Policy.

To make a privacy request — including access to, correction of, or deletion of personal information, or withdrawal of consent — or for any question related to this Policy, contact the Privacy Officer at privacy@brilavo.com or by mail at Privacy Officer, Brilavo Inc., 322-1470 Rue Peel, Montréal, Québec, H3A 1T1, Canada. We respond to privacy requests within 30 days.