Your Rights Under PIPEDA

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) gives you the following rights over your personal information:

• Right to know: You have the right to know what personal information we collect, why we collect it, and how it is used
• Right to access: You can request a copy of all personal data we hold about you and your children
• Right to correct: You can ask us to correct any inaccurate or incomplete information
• Right to withdraw consent: You can withdraw your consent for data collection at any time, though this may affect our ability to provide the service
• Right to complain: If you believe your privacy rights have been violated, you can file a complaint with the Office of the Privacy Commissioner of Canada. If your child's profile was created by an Ontario school board, contact the board first, and then the Information and Privacy Commissioner of Ontario

Additional Rights Under GDPR

If you are in the European Economic Area (EEA) or the United Kingdom, you also have:

• Right to erasure: Request the permanent deletion of your personal data
• Right to portability: Receive your data in a structured, machine-readable format
• Right to restrict processing: Ask us to limit how we use your data
• Right to object: Object to processing based on legitimate interests

Additional Rights Under CCPA

If you are a California resident, you have:

• Right to know: What personal information we collect and how it is used
• Right to delete: Request deletion of your personal information
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights
• Right to opt out of sale: VoiceBloom does not sell personal information, so this right is automatically satisfied

How to Exercise Your Rights

Parental Consent

For family accounts, VoiceBloom requires express parental consent before collecting any child data. During onboarding, we ask you to confirm that you are the parent or legal guardian and that you consent to data collection for the purpose of providing the service.

You can withdraw consent for your child's data at any time by deleting the child's profile or your entire account. See our Privacy Policy for full details.

For a student added by an Ontario school board, there is no consent step in VoiceBloom. The board is the institution responsible for that student's information under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), it gives the notice of collection required by section 29(2), and it decides whether consent is sought under its own policies. We act as the board's service provider. Access and correction requests for those students go to the board, and then, if you are not satisfied, to the Information and Privacy Commissioner of Ontario. See students added by an Ontario school board.

How We Protect Your Data

• All data encrypted in transit (TLS 1.2+) and at rest
• Row Level Security on every database table: users can only access their own data
• API keys stored in environment variables, never in client-side code
• Payment data handled entirely by Stripe (PCI DSS Level 1)
• Infrastructure providers hold SOC 2 Type II certifications
• Comprehensive data breach response plan in place

For full technical details, see our Security and Compliance page.

Related Policies

• Privacy Policy: What data we collect and how we use it
• Terms of Service: Rules governing use of VoiceBloom
• Security and Compliance: How we protect your data
• Data Breach Response Plan: Our incident response procedures