Privacy Policy

The Wonderlio Team operates Wonderlio and is the data controller for the personal data described in this policy. This means we decide what data is collected and why, and we are responsible for looking after it.

You can reach us about anything in this policy at support@wonderlio.app. We reply within two business days.

Wonderlio is a learning app used by a parent or guardian who creates the account and manages child profiles inside it. Children do not create their own accounts. The account holder is responsible for the child profiles they add.

• Account details you provide: email address and, if you sign in with Google, the name on that account.
• Child profiles you create: first name or nickname, chosen avatar, and grade level.
• Learning activity: practice sets played, answers, scores, time spent, and progress per topic.
• Content you create or upload: practice sets, lesson photos, and worksheet files used to generate practice.
• Preferences stored on your device, such as voice, speech speed, and keyboard layout.
• Support messages you send us, including the email address you send them from.
• Subscription records: your plan, its status and expiry date, and the identifiers our payment provider gives us for your customer and subscription. We never receive or store your full card number.
• Basic technical data needed to run and secure the service, such as your IP address and approximate request timing, handled by our hosting provider.

• To provide the service under our contract with you — showing lessons, saving progress, keeping your practice sets available across devices, generating practice material and parent summaries when you use the AI tools, showing parent-facing insights, and managing your plan and usage limits.
• To take payment, on the basis of our contract with you and our legal obligations — processing your payment and access period and refunds, and keeping the tax and accounting records we're required to keep.
• To answer support requests, on the basis of our contract and legitimate interests — replying to you and keeping a record of the issue.
• For security, service reliability and abuse prevention, on the basis of our legitimate interests — protecting accounts, enforcing fair-use limits, and preventing fraud and misuse.
• With your consent, where consent is required — for example optional emails; you can withdraw consent at any time.

We do not sell your data, and we do not show advertising to children in the app.

We share personal data only with the following categories of recipient:

• Payment processing — when subscriptions become available, our payment provider will securely process billing details, invoicing, tax, refunds, and subscription status. We do not receive or store your full card number.
• Hosting and database providers — to store your account, child profiles, content and learning activity, and to run the app.
• AI and audio providers — content you submit for AI generation or spoken audio is sent to those providers only to fulfil your request.
• Email delivery provider — to send account, support and transactional emails.
• Professional advisers — accountants or legal advisers, where needed.
• Authorities — where we are required to disclose data by law.

Some of these providers operate outside the Philippines, so your data may be processed abroad. We only use providers that commit to appropriate contractual safeguards for that transfer.

• Account, child profiles and learning progress — kept while your account is active, and deleted within 30 days of you asking us to delete your account.
• Content you delete in the app — child profiles and practice sets you remove are deleted from our live database immediately and drop out of backups within 30 days.
• Inactive accounts — if an account is unused for 24 months we may delete it and its data after emailing you first.
• Support messages — kept for up to 24 months so we can follow up on related issues.
• Payment and access records — kept for up to 10 years where tax and accounting law requires it, then deleted.
• Security and technical logs — kept for up to 12 months.

When data is no longer needed for these purposes we delete it or irreversibly anonymise it.

We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS) and at rest, database row-level access rules so one account cannot read another account's data, hashed credentials handled by our authentication provider, least-privilege access for administrators, secrets held in a managed secret store rather than in application code, and reputable infrastructure providers with their own security programmes. Full card details are handled by our payment provider and never reach our systems.

No online service can be completely secure. If a breach affects your personal data we will notify you and any relevant authority as required by law.

Subject to applicable law, you can ask us to give you access to your personal data, correct it, delete it, restrict or object to how we use it, provide it in a portable form, or withdraw consent where we rely on it. You can also complain to your local data protection authority — in the Philippines, the National Privacy Commission.

You can review or correct your account email and child profile details in the app, change audio preferences in Settings, and remove child profiles and practice sets at any time. To exercise any other right, email support@wonderlio.app or use Settings → Support. We respond within 30 days.

We use essential cookies and local storage to keep you signed in and to remember your app preferences such as voice and keyboard layout. Our checkout provider sets its own cookies needed to complete a purchase. We do not use advertising cookies, and we do not track children for marketing. You can clear cookies and local storage in your browser settings, though doing so will sign you out.

If we change this policy we'll update the date above, and we'll tell you in the app or by email if the change is significant.

Questions about this policy? Email support@wonderlio.app or use the Contact Support form in the Parent Dashboard Settings tab, and we'll get back to you within two business days.

See also our Terms of Service and Refund Policy.