Regional Addenda

DRAFT — to be reviewed by a lawyer in each region before launch there. Last updated: 2026-10-24

These addenda add the rights required by local law. Where they conflict with the main documents, the addendum for your country prevails.

Where we offer the service. The service is offered worldwide in our languages. It is not offered in the sanctioned territories or to the persons listed in Terms §1c. It is not directed at the United Kingdom, Switzerland, mainland China, Hong Kong, Macau, Thailand, Peru, Argentina, Uruguay, Nigeria, Turkey, Saudi Arabia, Kenya, Indonesia, Vietnam or Brazil (Terms §1a). For those countries we do not provide local-law addenda beyond the short notes below. Paid plans are available only where our Merchant of Record sells. The basis for international transfers in each region is summarised in Privacy Policy §5. Children's age rules by country: Children and Students.

Where data goes (all regions). Account and lesson data are hosted in the EU (France). If the AI tutor or the help assistant is used, the prompts also go to a provider in the United States. Our company is in the USA and has access to the data (from the EEA only). E-mail and payment providers are listed in Sub-processors with their locations and safeguards. We name a transfer tool as in place only once it is signed; elsewhere we say that we will use it where required.

Whose request is it? For your account and billing data we answer directly. For data your tutor or school entered about you or your child, the tutor or school is the business/controller. Where we are only the processor for that data, we forward the request and help them answer; we do not decide it ourselves. Where a law imposes the duty on us as operator, including COPPA, we act on the parent's request ourselves: we stop collection, disconnect the child, and delete the child's personal information we hold.

United Kingdom

The service is not directed at the United Kingdom: we do not show prices in GBP, do not market it there, and do not send invitation links or marketing to people we know are in the UK. Use from the UK is not prohibited and is at the user's own initiative. If UK GDPR nevertheless applies to you, the rights in the Privacy Policy are available, including access, erasure and a complaint to the Information Commissioner's Office (ico.org.uk). We have not appointed a UK representative under UK GDPR Art. 27 because the service is not directed at the UK. IF we later target the UK: appoint a UK representative (UK GDPR Art. 27) and add the UK International Data Transfer Addendum

United States

• We do not sell or share personal information, and we do not use it for cross-context behavioural advertising. Disclosures to providers will be made only under written terms that prohibit sale, sharing and use for other purposes.
• All US states: residents of states with comprehensive privacy laws may have rights to access, correct, delete and port their data and to appeal our decision; we honour these requests from all US users at PRIVACY_EMAIL. We do not discriminate against you for using them. CHECK: which laws apply — California only above its thresholds (about USD 26.6m revenue or 100,000 consumers); Texas and Nebraska use a small-business test; if California applies, add sources, purposes, retention per category and the sensitive-data note for login credentials
• Minors (state laws): e.g. New York Child Data Protection Act and Maryland Online Data Privacy Act restrict processing of minors' data. CHECK
• Children (COPPA) and FERPA (schools): see Children and Students; for schools we act under the school's direction under a written agreement.

Canada

PIPEDA: access, correction, withdrawal of consent; complaints to the Office of the Privacy Commissioner. Quebec (Law 25): also data portability and information about any decision made exclusively by automated processing (we make none) with the right to comment; consent for a minor under 14 comes from the person with parental authority. Canada does not make adequacy decisions; we remain accountable for data processed abroad (EU hosting; US AI providers when AI features are used). Quebec: Law 25 requires a privacy impact assessment before personal information is communicated outside Quebec. Because hosting is in the EU (and AI features use US providers), use of the service from Quebec already communicates personal information outside Quebec. We have not yet completed that Quebec assessment (our documented transfer impact assessment covers EU transfers only), and we do not claim that this communication meets Law 25 until it is completed; we will give tutors the information they need for theirs. TODO: Quebec Law 25 transfer assessment Person in charge of the protection of personal information: TITLE, PRIVACY_EMAIL. CHECK

Australia and New Zealand

Australian Privacy Principles (Privacy Act 1988) and the NZ Privacy Act 2020: access and correction; complaints to the OAIC (Australia) or the Privacy Commissioner (NZ). Overseas disclosures: EU hosting, our US company, and a US AI provider when AI features are used. Australia: where the Privacy Act applies to us, we will meet APP 8 by contract with each recipient CHECK: small-business exemption (AU$3m turnover) for a foreign operator; from 10 December 2026 privacy policies must disclose automated decisions that could significantly affect rights — we make none (a room AI budget only meters credits); the Children's Online Privacy Code is expected (the OAIC's deadline to register it is 10 December 2026). New Zealand: IPP 12 safeguards for overseas disclosure; since 1 May 2026, IPP 3A requires notice when personal information is collected from someone other than the individual — we give it for information we collect that way (for example the billing country the seller sends us with a purchase; see Privacy Policy §2), and the tutor gives it for student data.

Brazil (not directed)

The service is not directed at Brazil (Terms §1a); the Portuguese interface is provided for Portugal and Portuguese speakers elsewhere. If the LGPD applies to you anyway, the rights under Art. 18 LGPD (confirmation, access, correction, anonymisation, portability, deletion, information about sharing, withdrawal of consent) are available at PRIVACY_EMAIL, and you may complain to the ANPD. We have not adopted the ANPD standard contractual clauses (Resolution CD/ANPD 19/2024) or appointed a representative in Brazil, and we have not implemented the provider duties of the ECA Digital (Law 15.211/2025); see [Children and Students](children-and-students.md#brazil--eca-digital-not-directed). Consumers who buy from the seller keep the 7-day right of regret (CDC Art. 49).

Latin America (other)

Exercise rights at PRIVACY_EMAIL. For data your tutor or school entered, they are the controller and we help them answer. Transfers: hosting in the EU; our US company; US AI providers only after AI consent (basis per country in Privacy Policy §5).

• Mexico (new LFPDPPP of March 2025): ARCO rights (access, rectification, cancellation, opposition). Authority: the Secretaría Anticorrupción y Buen Gobierno, which replaced INAI CHECK. A transfer to a processor ("remisión") needs no consent; this covers student data we process for the tutor, not account data we control ourselves.
• Argentina (Law 25.326) — not directed (Terms §1a): if the law applies to you anyway, access, rectification, updating and suppression are available at PRIVACY_EMAIL; complaints to the AAIP. We have not registered a database or adopted model clauses for Argentina.
• Colombia (Law 1581 of 2012): know, update and rectify; proof of authorisation; information on use; revocation of authorisation and deletion. Complaints: SIC (Superintendencia de Industria y Comercio). Our DPA serves as the processing agreement ("transmisión") for student data. Transfers to the USA: where required we will use the RIPD clauses or another contract the SIC recognises; we do not rely on a US adequacy decision. CHECK
• Chile: Law 19.628 applies now. Law 21.719 applies from 1 December 2026 (statutory date): access, rectification, deletion, opposition, portability and blocking rights. Authority: the new Personal Data Protection Agency. Breaches involving minors' data must also be notified to the people concerned. CHECK: whether a postponement law has been enacted
• Ecuador (LOPDP and its 2023 Regulation): access, rectification, deletion, opposition, portability, suspension. Authority: Superintendencia de Protección de Datos Personales. A processor notifies the controller of a breach within 2 days. CHECK: database registration
• Uruguay (Law 18.331) — not directed (Terms §1a): if the law applies to you anyway, access, rectification, updating, inclusion and deletion are available at PRIVACY_EMAIL; complaints to the URCDP. We have not registered a database or adopted transfer clauses for Uruguay.
• Peru (Law 29733): the service is not directed at Peru (Terms §1a). If the law applies to you anyway, ARCO rights are available at PRIVACY_EMAIL.

Some countries require registration of databases or specific transfer notices; we complete them before actively marketing in a country where they apply. CHECK per country

Switzerland (not directed)

The service is not directed at Switzerland (Terms §1a). If the revised FADP applies to you anyway, rights similar to those under the GDPR are available at PRIVACY_EMAIL, and you may complain to the FDPIC. Hosting in the EU is covered by Switzerland's adequacy list; for a US recipient we will use Swiss–US Data Privacy Framework certification or SCCs with the Swiss adaptations where required.

India

Digital Personal Data Protection Act 2023 and Rules 2025 (most obligations from 13 May 2027). For data your tutor or school entered, they are the Data Fiduciary and we process it on their behalf. For your account and billing data, we are the Data Fiduciary. Rights: information about processing, correction, completion, updating and erasure, grievance redressal, and nominating a person to exercise your rights in case of death or incapacity. Grievance contact: PRIVACY_EMAIL. We do not use a registered Consent Manager. If we do not resolve your grievance, you may complain to the Data Protection Board of India. Transfers to the EU and the USA are permitted unless the Government restricts a country (none at present). Children under 18: see Children and Students. CHECK

Gulf states

• United Arab Emirates (Federal Decree-Law 45/2021, PDPL): information, access, portability, correction, erasure, restriction and objection. Authority: the UAE Data Office. Transfers: we rely on a statutory exception (performance of the contract or consent) and do not claim an adequacy decision; we will revisit this when the executive regulations are issued CHECK: status of executive regulations. Children: see Children and Students.
• Saudi Arabia (PDPL) — not directed (Terms §1a): if the law applies to you anyway, the rights to be informed, access, a copy of your data, correction and destruction are available at PRIVACY_EMAIL; the authority is SDAIA. We have not registered with SDAIA or adopted SDAIA standard contractual clauses.
• Qatar (Law 13/2016): withdrawal of consent, objection, erasure, correction, being notified of processing and access. Authority: the National Data Privacy Office CHECK: current name. Transfers outside Qatar are made only where Law 13/2016 allows them (adequate protection at the recipient, the individual's consent, or another case stated in the law); we do not describe them as unrestricted.

Contact for all: PRIVACY_EMAIL.

Singapore

Personal Data Protection Act 2012: access, correction and withdrawal of consent; complaints to the PDPC. Transfers to the EU and the USA: where required we will bind the recipients by legally enforceable obligations giving comparable protection (s.26) — through our DPA for processors, and through the US AI providers' agreements once they are signed (status in Sub-processors). We do not send marketing messages to Singapore telephone numbers, so the Do Not Call rules do not apply. Contact: PRIVACY_EMAIL.

Malaysia

Personal Data Protection Act 2010 (as amended in 2024). The Act applies to entities established in Malaysia or using equipment there, so it normally applies to your tutor or school rather than to us. Rights: access, correction, withdrawal of consent, preventing processing likely to cause damage or distress, and, once the provision is in force, data portability CHECK: commencement of the portability right. Authority: the Personal Data Protection Commissioner. Transfers: to countries with comparable law or with adequate protection ensured by contract. Contact: PRIVACY_EMAIL.

Philippines

Data Privacy Act of 2012: to be informed, access, objection, erasure or blocking, rectification, data portability and damages. Complaints to the National Privacy Commission. Transfers: we remain accountable for data transferred abroad and will bind recipients by contract where required. Contact: PRIVACY_EMAIL.

Indonesia (not directed)

The service is not directed at Indonesia (Terms §1a). If Personal Data Protection Law 27/2022 applies to you anyway, the rights to information, correction, access, deletion, withdrawal of consent, objection to decisions based solely on automated processing (we make none) and portability are available at PRIVACY_EMAIL. We have not adopted Indonesia-specific transfer safeguards.

Japan

Act on the Protection of Personal Information (APPI): disclosure (including records of provision to third parties), correction, cessation of use, deletion and cessation of provision to third parties. Authority: the Personal Information Protection Commission (PPC). Transfers (Art. 28): we are a US company; your data are hosted in the EU, which Japan recognises as having an equivalent system, and our staff access them only from the EEA. Lesson data are not sent to a US AI provider until that provider is bound by a signed contract to take equivalent measures; no such contract is signed yet, so there are no such measures to describe; once it is signed we will describe them on request. Questions to the help assistant (no lesson data) are sent to the US provider only with your consent under Art. 28(1), given on a one-time consent screen before your first question (Privacy Policy §5). Information on the US system: Privacy Policy §5. Contact: PRIVACY_EMAIL.

South Korea

Personal Information Protection Act (PIPA): access, correction, deletion, suspension of processing and withdrawal of consent. Authority: the Personal Information Protection Commission (PIPC). Overseas transfers (Art. 28-8): hosting in France is necessary for the contract and is disclosed in Privacy Policy §5 (items, countries, timing and method, recipients, purposes, retention and how to refuse). The transfers to US AI providers are not necessary for the contract: for the AI tutor only with AI consent, and for the help assistant (no lesson data) only with your separate consent under Art. 28-8(1), given on a one-time consent screen before your first question that shows the recipient, the country, the purpose, the retention and how to refuse; typing a question is not that consent. The details are in the same section. Not giving AI consent or help-assistant consent leaves the rest of the service available. We do not have a domestic agent; one is required only above revenue or user thresholds. Children under 14 (Art. 22-2): the tutor or school, as controller, must verify the legal representative by a method allowed by the Enforcement Decree; a consent click, and the tutor's own knowledge of the family, are not such a method. We do not provide mobile-phone, card or certificate verification, so our consent page alone does not meet Art. 22-2; verifying the legal representative's consent for lesson data is the tutor's or school's task. When a student opens a link, we are controller of the IP address and browser data in our logs (truncated in web server logs; system logs may hold a full IP, for example of a call connection); we do not use them to identify the child, and they expire within 7 days. CHECK: KR Art. 22-2 for operator technical data Contact: PRIVACY_EMAIL.

Hong Kong (not directed)

The service is not directed at Hong Kong (Terms §1a). We do not block AI there, but the AI providers' terms do not allow use from Hong Kong, so you must not use AI features from there (Terms §1a); the rest of the service works. If the Personal Data (Privacy) Ordinance applies to you, you may request access to and correction of your data at PRIVACY_EMAIL and complain to the PCPD. Section 33 (transfer restriction) is not in force.

South Africa

Protection of Personal Information Act (POPIA). The Act applies to a foreign party only where it uses means in South Africa, so it normally applies to your tutor or school rather than to us. Rights: access, correction or deletion, objection, and complaint to the Information Regulator. Transfers (s.72): where POPIA applies, a transfer needs a binding agreement giving protection substantially similar to POPIA or another ground in s.72; we will put such agreements in place where required (our DPA for processors; the US AI providers' agreements once signed). Children's data (under 18): prior authorisation by the Information Regulator may be needed for a transfer to a country without adequate protection (s.57). Before a tutor or school turns on the AI tutor for a student in South Africa under 18, they must be satisfied that Information Regulator authorisation under s.57 has been obtained or is not required; our DPA alone does not meet that duty. We give the tutor the recipients' names, countries and safeguards on request. CHECK Contact: PRIVACY_EMAIL.