Last updated 25 July 2026
Crayonie is operated by a sole trader established in Portugal (the "data controller", "Crayonie", "we", "us", "our"). We do not have a separate registered company, a VAT identification number to publish, or a dedicated Data Protection Officer; for any privacy question, request, or concern, contact us directly at support@crayonie.com. This Privacy Policy explains what personal data we collect through the Crayonie website and application (the "Service"), why we collect it, and the rights you have over it.
The data we collect depends on whether you use Crayonie as a teacher, a student, or a parent.
Teachers. When a teacher registers, we collect their name and email address. Their profile may also include country, school name, curriculum, the grades and subjects they teach, a language preference, and an optional school logo they upload. We also store their plan tier and monthly usage counts (such as packs generated) so we can enforce plan limits.
Students. Students are enrolled by a teacher using a class code; students do not self-register. We store a student's first and last name, age, the classes they belong to, and their quiz submissions and scores. What else we store depends on the student's age. Students aged 13 or over provide and we store a real personal email address and a password, used to log in directly. Under-13 students do not have and are not asked for a personal email address; instead, we issue a system-generated student ID and a PIN used to log in, and the system generates a synthetic identifier of the form {studentId}@students.crayonie.app that exists only as an internal login handle — it is not a real mailbox, it is not used to contact the child, and it is not shared outside the Service.
Parents. When a parent registers, we collect their name and email address, and a link to the child (or children) they are connected to, so they can view relevant summaries of their child's work.
School administrators. When a school administrator registers, we collect their full name, email address, password, job title, school name, country, city, an optional school logo they upload, and the curricula their school offers. We also generate a school code for their school. If an administrator invites teachers to join Crayonie, we collect the email addresses they enter for those teachers so we can send the invitations.
We use the personal data described above to:
Where the UK/EU General Data Protection Regulation applies, we rely on the following legal bases, depending on the purpose:
Crayonie is used by schoolteachers to manage classes that include children under the age of 13, so we take this section particularly seriously.
When a teacher generates a pack, we send the teacher's inputs — the lesson topic, grade level, subject, and curriculum — to Anthropic, our AI content-generation provider, so it can produce the lesson content.
Student names and student identifiers are not included in generation prompts. The content of a pack is generated from the topic and curriculum a teacher supplies, not from any individual child's personal data, so no student-identifying information is disclosed to our AI provider as part of that process.
We use a small number of third-party service providers ("sub-processors") to run Crayonie. Each is engaged only for the purpose below and is bound by contract to protect the data it processes on our behalf.
We keep account data (teacher, student, and parent profiles, class membership, and quiz results) for as long as the associated account remains active, so the Service continues to work as expected.
On the Free plan, generated packs carry an expiry date 30 days after creation and are removed once that date passes. On paid plans, generated packs have no automatic expiry and are kept for as long as the associated account remains active, in the same way as the other account data described above.
Where a parent, school, or teacher requests deletion of an account or of a child's data, we will delete it without undue delay, except to the extent we are required to keep particular records to comply with a legal obligation (for example, tax or accounting law).
Some of our sub-processors operate infrastructure outside the European Economic Area. Where personal data is transferred outside the EEA, we rely on appropriate safeguards recognised under GDPR, such as the European Commission's Standard Contractual Clauses, or on a provider's participation in a recognised adequacy or certification framework, to ensure the data continues to receive an equivalent level of protection.
Subject to applicable law, you have the right to:
For a child's account, these rights are exercised by the parent or school that manages the account on the child's behalf. To exercise any of these rights, contact support@crayonie.com.
We use encryption in transit and access controls that restrict data to the accounts and roles that need it, to help protect the personal data in our care. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not hold any security certifications (such as ISO 27001 or SOC 2), and we do not claim to. Crayonie never stores card or other payment details; those are handled directly by Paddle, our payment provider.
We may update this Privacy Policy from time to time, for example as the Service changes or as legal requirements evolve. If we make material changes, we will notify you by reasonable means, such as an in-app notice or an email to the address on your account, before the changes take effect. The date at the top of this page reflects the version currently in effect.
Questions about this Privacy Policy, or requests concerning your data, can be sent to support@crayonie.com.