Privacy Policy — BrainLab Kids
**⚠️ Pre-launch draft — pending review by a UAE-qualified legal counsel before the product is marketed to paying customers or opened to children outside a controlled pilot. This policy is published in good faith to support the current validation phase.**
**Effective date:** 20 April 2026
**Last updated:** 20 April 2026
**Data Controller:** New World Education (operating BrainLab Kids), Dubai, United Arab Emirates
**Contact for all privacy matters:** khurram@newworld.education
---
1. Who we are and what this policy covers
BrainLab Kids is a web platform operated by New World Education from Dubai, UAE. We make cognitive-science activities ("Labs") for children aged 7 to 13. This policy explains what information we collect from parents and their children, how we use it, who we share it with, and the rights you have over it.
This policy covers everything at `brainlabkids.spotlightdubai.com` and any related emails we send you. It applies to parents who create an account, children whose profiles sit under those accounts, and visitors who join the waitlist.
2. The principle behind this policy
Children's data is handled to a higher standard than adult data. We collect the minimum we need to make the product work, we don't sell anything to anyone, we don't use children's data to train AI models, and we give parents full visibility and control over what their children do on our platform.
If this policy ever stops being true, we will tell you before we change anything — not after.
3. What we collect
3.1 From parents (account holders)
3.2 From children (as added by parents)
3.3 From children during specific Labs (with explicit permission each time)
Only the numeric score or outcome of these Labs is saved. The raw sensor data never leaves the device.
3.4 From waitlist signups
3.5 What we do not collect
4. Why we collect it (our lawful bases)
We process your data for the following purposes and on the following legal grounds under GDPR / UAE PDPL:
| Purpose | Lawful basis |
|---|---|
| Creating and maintaining your account | Contract (account T&Cs) |
| Saving a child's Lab progress so they can resume across devices | Contract, with parental consent for the child's data |
| Sending you service emails (welcome, password reset, weekly report) | Contract and legitimate interest |
| Sending you marketing about BrainLab Kids | Consent (you can withdraw any time — see Section 11) |
| Responding to Neo AI queries from your child | Contract, with parental consent |
| Improving the product by looking at aggregate Lab completion stats | Legitimate interest |
| Security, fraud prevention, and abuse detection | Legitimate interest |
| Complying with law enforcement or regulatory requests | Legal obligation |
We do not use children's data for profiling, behavioural advertising, or automated decision-making that produces legal or significant effects.
5. COPPA — collecting children's information (US families)
BrainLab Kids is designed for children aged 7 to 13, which means it falls under the US Children's Online Privacy Protection Act (COPPA) for any family using it from the United States.
We comply with COPPA as follows:
**1. Verifiable parental consent before child profile creation.** Before a parent can add a child under 13 as a sub-profile, the parent must affirmatively check a consent box acknowledging they understand what data will be collected from their child and agree to it. The checkbox links directly to this policy.
**2. Parent-only account control.** Children cannot create accounts. They cannot log in independently. They have no password. All child profiles live under a parent account that the parent controls.
**3. Parent access and deletion rights.** A parent can at any time:
- View all data collected about their child (in the Parent Dashboard)
- View every message in every Neo conversation their child has had
- Delete their child's profile and all associated data
- Delete their entire account and all children within it
- Request an export of all their and their children's data by emailing khurram@newworld.education (we will respond within 30 days)
**4. No behavioural advertising.** We do not show ads to children. We do not allow third parties to collect information from children on our platform for advertising.
**5. Limited data minimum.** We collect only what is necessary to make the Labs work and track learning progress. We do not collect children's real names, home addresses, schools, phone numbers, or photographs.
**6. Data retention.** Children's data is retained while their account is active. If an account is inactive for 24 consecutive months, we will email the parent and, absent response, delete the child profile and associated Lab data.
If you are a US parent and have any concern about your child's data on BrainLab Kids, write to khurram@newworld.education. We aim to respond within 48 hours on UAE business days.
6. Neo, our AI guide — how AI conversations are handled
Neo is an AI character that answers questions about neuroscience. When a child sends a message to Neo, the following happens:
1. The message, along with the child's first name, age band, preferred language, and a short summary of the Labs they recently completed, is sent to **Anthropic** (the company that makes the Claude AI model we use). Anthropic processes this request to generate Neo's reply.
2. Anthropic's current policy states it does not train on API customer data by default. We rely on that contractual commitment. Anthropic's own privacy policy is at `anthropic.com/privacy`.
3. The child's message and Neo's reply are saved to our database so the parent can review any conversation in the Parent Dashboard.
4. Neo is limited to 20 messages per child per day.
5. Neo is bound by a strict system prompt that prevents discussion of medical, mental health, sexual, violent, or otherwise inappropriate topics. If a child raises a topic of concern (distress, self-harm, harm at home), Neo redirects them to a trusted adult and flags the conversation for parent attention.
We do not use children's Neo conversations for any purpose other than (a) generating Neo's replies, (b) making those conversations visible to the parent, and (c) improving Neo's safety (de-identified review of flagged conversations only, by New World Education staff).
7. Who we share data with (our processors)
We use the following third-party service providers to run BrainLab Kids. Each is a Data Processor acting on our instructions, bound by contractual data-protection terms:
| Processor | Purpose | Data they see | Location |
|---|---|---|---|
| **Supabase** | Database, authentication | All account and Lab data | Singapore region |
| **Vercel** | Web hosting | Request logs, IP addresses | USA |
| **Anthropic** | Neo AI responses | Neo conversation contents + child context | USA |
| **Resend** | Sending emails | Email address, email content | USA |
| **GoDaddy** | Domain/DNS | None directly | USA |
Some of these processors are located outside the UAE and the EU. Where data is transferred internationally, we rely on the processor's Standard Contractual Clauses, Data Processing Agreements, and equivalent safeguards permitted under GDPR and UAE PDPL.
We do not sell data to anyone. We do not share data with advertisers. We do not share with data brokers.
We may disclose data to law enforcement or regulatory authorities if we are legally required to, or to protect the safety of a child using our platform if we become aware of a serious threat.
8. How long we keep data
- **Active account data** — kept while the account is open.
- **Inactive account data** — after 24 months of no login activity, we email the parent. If we receive no response within 30 days, the account and all child profiles under it are deleted.
- **Waitlist emails** — kept until launch or until you unsubscribe, whichever is earlier.
- **Deleted account data** — removed from production databases within 30 days. Encrypted backups may retain a copy for up to 90 days before being cycled out, after which all traces are gone.
- **Neo conversation logs** — deleted with the child profile. We do not retain conversation data independently of the account.
- **Security logs** (IP addresses, login attempts) — 90 days.
9. Security measures
We take reasonable measures to protect your data:
- All data in transit is encrypted using HTTPS (TLS 1.3 where supported).
- Passwords are hashed using industry-standard algorithms and never stored in plain text.
- Our database enforces row-level security, meaning one parent account technically cannot read another parent account's data even if there were a bug.
- API keys for AI and email services are stored as encrypted environment variables, never in code.
- We operate the principle of least privilege — only the founder has production database access.
- We will notify affected users and relevant authorities within 72 hours of becoming aware of any personal data breach, as required under UAE PDPL and GDPR.
No security system is perfect. If you believe your account has been compromised, write to khurram@newworld.education immediately.
10. Your rights
Depending on where you live, you have some or all of the following rights:
- **Access** — ask us what data we hold about you and your child
- **Correction** — ask us to correct data that is wrong
- **Deletion** — ask us to delete your account and all data within it
- **Portability** — ask us for an export of your data in a common format
- **Restriction** — ask us to pause processing of your data while a dispute is resolved
- **Objection** — object to processing based on legitimate interest
- **Withdraw consent** — for any processing you have consented to
- **Complain to a regulator** — you can complain to the UAE Data Office (if you are in the UAE), the relevant EU supervisory authority (if you are in the EU or UK), or the FTC (if you are in the US)
To exercise any of these rights, email khurram@newworld.education. We will respond within 30 days.
11. Marketing emails and unsubscribing
We will only send you marketing emails (new features, launch announcements, newsletters) if you have opted in by joining our waitlist or creating an account. Every marketing email contains a one-click unsubscribe link at the bottom. Unsubscribing from marketing does not stop service emails like password resets or security alerts.
12. Cookies and similar technologies
The BrainLab Kids website currently uses only strictly necessary cookies — the ones required for login sessions and language preference. We do not currently use analytics cookies, advertising cookies, or third-party tracking. If we add analytics in the future, this policy will be updated and a cookie notice will appear before any non-essential cookie is set.
13. International users
BrainLab Kids is operated from Dubai, UAE. By using the platform, you understand that your data will be processed in the UAE and by our processors in Singapore and the USA as described in Section 7. We rely on Standard Contractual Clauses, Data Processing Agreements, and the UAE PDPL adequacy framework for international transfers.
14. Changes to this policy
If we make material changes to how we handle your data, we will notify you at the email address on your account at least 14 days before the change takes effect. For non-material changes (like correcting a typo or clarifying language), we will update the "Last updated" date at the top of this policy.
15. Questions, requests, complaints
For any question about this policy, your data, your child's data, or to exercise any right described here:
**Email:** khurram@newworld.education
**Response time:** We aim to respond within 48 hours on UAE business days. Formal rights requests are answered within 30 days.
For regulatory complaints:
- **UAE:** UAE Data Office — `uaedataoffice.ae`
- **EU/UK:** Your national Data Protection Authority
- **US:** Federal Trade Commission — `ftc.gov/complaint`
---
*This document is written in plain English deliberately. If any part is unclear, that is our failure and we would like to hear about it. Email khurram@newworld.education.*