Privacy Policy

My V.I.P. Academy ("we", "us", "our") operates the website at www.myvipacademy.com (the "Platform"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our Platform.

By creating an account or using our Platform, you agree to the collection and use of information in accordance with this Policy. If you do not agree, please discontinue use of the Platform.

This policy applies to all users of the Platform, including students, instructors, and visitors. References to "you" and "your" refer to you as a user of the Platform regardless of your role.

We collect the following categories of personal data:

a. Account Information (provided by you)

• Students: Full name, email address, phone number, timezone, profile photo (optional)
• Instructors: Full name, email address, phone number, professional bio, subjects taught, qualifications, hourly rate, availability schedule, profile photo
• Both: Username, password (stored as a hashed value — we never store plain-text passwords)

b. Session & Booking Data

• Booking details: subject, date, time, duration, session type (intro or paid)
• Payment status and transaction reference numbers (we do not store full card details)
• Session chat logs (saved to support session review and dispute resolution)
• Session recordings (video files stored on Bunny.net CDN)
• Session notes created by instructors or students during a session
• Post-session ratings and reviews submitted by students

c. Instructor Application Data

• Proof of identity: an image or PDF of your national ID, driver's licence or passport
• Qualification certificates (images or PDFs)
• An official police record, for applicants who will teach elementary-age children
• Your demo lesson video file
• Educational background, subjects, teaching experience and your reasons for applying (text)
• Application status, interview and review notes

These files are uploaded straight to private storage buckets on Supabase. They are never public: only administrators with the applications permission can open them, through links that expire within minutes, and every review action is logged. We do not keep copies on Bunny.net or any other provider.

d. Technical Data (collected automatically)

• IP address and device type
• Browser type and version
• Pages visited and actions taken on the Platform
• Date and time of access
• Authentication tokens (via Supabase Auth — session cookies)

e. Classroom Practice Data

The Classroom (free skill practice) can be used with or without an account. Free practice comes in allowances of questions that refill during the day, and we keep only what we need to count them fairly:

• Signed-in learners: your score on each lesson, how many questions you have answered, and how many free questions you have used in the current allowance.
• Visitors without an account: a random practice identifier stored in a cookie, plus two further identifiers that let us count free questions when that cookie is cleared or a private window is used. One is made from your IP address together with your browser type, the other from your IP address alone. Both are turned into scrambled codes with a one-way keyed hash (HMAC-SHA-256) before they are stored, so we never store your IP address for this purpose and the codes cannot be turned back into it. We store them with the number of questions used and when.
• Kept only on your device: a visitor's lesson scores, which questions have been seen, and the Classroom sound and volume settings are kept in your browser's local storage and are never sent to us.

We do not ask for a name, email address or any other personal details to practise without an account.

f. Communication Data

• Emails sent to and from our support team
• Conduct reports submitted through the Platform
• In-session chat messages

g. Practice Exam Answers

• Your answers to practice exam questions, with their marks and feedback
• Handwriting photos (optional): on PEP practice exams, a student can photograph a handwritten answer to a writing question instead of typing it, up to 3 photos per question. Typing is always available.

Each photo is re-encoded on our server before it is stored, which removes hidden details such as location and device information. Photos are kept in a private storage bucket, filed under ID numbers only (never names), and only our server can open them. The photo screen asks children not to write their name on the page.

h. Edu AI Hub: how your content is used

• When you use Quiz, Flashcards, Study Guide, Lesson Plan, Curriculum or Homework Help, the text you type and any files you upload (PDFs, photos, Word files) are sent to Google's Gemini API to create your result. Google processes them for us as a service provider.
• We never send your name, email address or account ID with these requests. Anything personal you put in the content itself (for example a student's name in a lesson plan) is sent with it, so please leave it out.
• Uploaded files are used for that one request and are not kept. What the tool creates (quizzes, flashcards, guides, plans, homework chats) and any syllabus text you give the Curriculum tool are saved to your account until you delete them.
• Some tools draw pictures with Gemini (flashcard and homework images). These are stored by us so they can be shown to you. They are kept in private storage and shown only through links that expire within 12 hours, including to people you share an item with.
• When you delete an item, it is permanently removed from the platform straight away, together with its pictures, any results from people who used your share link, and the list of people you shared it with. The share link stops working at once. Copies kept for backup and testing are covered in Section 7.
• Classroom read-aloud uses Google Cloud Text-to-Speech on our own lesson text only, never on what you type.

i. Shop purchases

• What you buy in the Shop (workbooks, printables and bundles), what you paid, any sale or discount code used, and the email address you checked out with.
• The items in your cart while you are signed in, so the cart follows you to another device.
• If you leave items in your cart while signed in, we may email you up to two reminders about it (never more than two a week). Every reminder has a link to stop them, and you can switch them off in Settings → Notifications.
• When you download a printable, a record of which item and when, with a scrambled version of your network address (it cannot be turned back into the address). We use it only to spot download links being shared outside a family, and delete it after 90 days.

Card details are entered on Dime's payment page, never on ours.

j. Interactive workbooks

• Children in your account: you can add up to 4 children, and one workbook purchase covers all of them. For each child we keep only a first name, a school grade and a colour you pick. We never ask for a surname, a photo, a birthday or a school. Each child's progress is kept separately: Classroom lessons, Reading Lab stories and words, practice-exam attempts and workbook answers. When you add your first child, we ask once whether the learning already on your account was done by that child; if you say yes, that progress moves to the child. If you pick one of these children when you start a free child assessment, the result is kept with that child and shown in My VIP Academy App's grown-ups' area.
• “The student is under 18”: if you tick this on sign-up or in My Profile, we keep that one yes/no answer on your account. Only the tutors you book see it, as a “Minor” label on your lessons, so they know they are teaching someone under 18. You can untick it at any time.
• My VIP Academy App and the parent PIN: the app keeps a few things only on your device: the grade a guest picked, the last activity each child opened (for “Continue”), and which child is learning. Your 4-number parent PIN is stored only in a scrambled form we can't read back. After five wrong tries it stays locked until you sign in again, and “Forgot the PIN?” works only after you sign in again. When you enter it, the app opens the grown-ups' area for 10 minutes and keeps that permission only in memory, never saved on the device. Once an account has a PIN, the website asks for the same PIN before a child is removed or your own progress is moved to a child, with the same lock; the website keeps that permission only in memory too and keeps no copy of the PIN in your browser.
• Progress: each answer your child gives (the question's number, whether it was right, whether a hint was used and the kind of slip), and a score per skill, so the workbook can adapt and you can see a progress report. Answers are kept on this device until they reach our servers.
• Work on each page: the questions on each practice page with your child's first answer, and the number they last chose on a lesson page, so the downloadable PDF of the workbook shows their own work on any device.
• Offline downloads: when a grown-up downloads a workbook, a PDF, the Reading Lab, a Classroom grade or a practice-exam paper in My VIP Academy App, a copy is kept on that device: the workbook's content, Vee's recorded voice, the PDF, the Reading Lab's stories with their pictures and Miss Joy's recordings, a Classroom grade's lessons with their answers and pictures (and, if chosen, the recorded question voice), a practice-exam paper with its answers, explanations and pictures, and each child's latest progress in them, so they open with no internet. Answers and reading done offline wait on the device and reach our servers when it is back online; a paper sat offline is kept on the device until it is sent; photos of a child's handwriting taken with no internet stay on the device until they are sent, then are deleted from it (on our servers they are kept 3 days, like any photo of handwriting); the marked paper of a sitting done offline is kept on that device; and we record which papers each account has downloaded, and when it last confirmed it may keep them (for the monthly download limit, and so a paper sat offline is accepted), for as long as the account exists. So that the grown-ups' corner opens offline, the device also keeps a scrambled copy of the parent PIN (we can't read it back), plus a small cookie listing which items it holds, so the app can offer to download them again if the device clears them. Removing a download, signing out, another account signing in on the device, or a refund deletes the copy.
• The parent corner settings (focus skills, number range, reading speed) and the last page your child was on.
• Read-aloud: Vee reads the workbook's own words in a recorded voice (made with Google's text-to-speech from the workbook text only). Your child's name and answers are never sent to it, and no recording of your child is ever made. The PDF is made on your own device.

We use your personal data only for the following purposes:

We process your personal data on the following legal grounds:

We do not sell your data. We share it only with the following trusted service providers who help us operate the Platform, under strict contractual obligations:

We may also disclose your data if required by law, to enforce our Terms and Conditions, or to protect the rights, safety, or property of My V.I.P. Academy or its users.

We implement industry-standard security measures to protect your personal data:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using HTTPS/TLS.
• Encryption at rest: Data stored in Supabase is encrypted at rest using AES-256 encryption.
• Password hashing: Passwords are never stored in plain text. They are hashed using bcrypt via Supabase Auth.
• Row Level Security (RLS): Database policies restrict each user to their own records. Administrators see only what their role permits, and their actions are logged.
• Access controls: Only authorised My V.I.P. Academy administrators can access raw user data, and only when necessary for platform operations.
• Support access to Edu AI Hub: Authorised My V.I.P. Academy staff may view an Edu AI Hub user's dashboard and the content created there, in read-only form, for support and quality review. Staff cannot make changes through this view, and every such access is logged.
• Private files and signed URLs: Session recordings and instructor verification documents live in private storage and are served only through pre-signed links that expire within minutes — never public links. Edu AI Hub pictures are also private, shown through links that expire within 12 hours.
• Session expiry: Authentication sessions expire automatically and refresh tokens are rotated on use.

While we take every reasonable precaution, no method of electronic transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at support@myvipacademy.com.

We retain your personal data only for as long as necessary for the purposes outlined in this Policy:

Upon account deletion, we anonymise or delete your personal data within 30 days, except where retention is required by law. Booking and payment records may be retained in anonymised form for financial audit purposes.

Under the Jamaica Data Protection Act 2020 and applicable privacy principles, you have the following rights regarding your personal data:

To exercise any of these rights, contact us at support@myvipacademy.com. We will respond within 30 days.

We use cookies and similar tracking technologies to operate and improve the Platform. Cookies are small text files stored on your device.

Cookies we use:

When you first visit the Platform, a cookie consent banner will appear. You can choose to accept all cookies or essential cookies only. You can also control cookies through your browser settings — disabling essential cookies will prevent you from logging in. For more information about cookies visit aboutcookies.org.

My V.I.P. Academy is designed for students of all ages in the Caribbean. We take the privacy of young users seriously.

• Users under the age of 18 should have a parent or guardian review this Privacy Policy.
• We recommend that parents or guardians create and manage accounts on behalf of students under 13 years of age.
• We do not knowingly collect personal data from children under 13 without verifiable parental consent. If you believe we have collected such data, please contact us immediately at support@myvipacademy.com.
• Session recordings involving minors are accessible only to the student and their instructor, and authorised staff, for quality and safety reviews.
• Children can practise in the Classroom without an account. We do not ask them for a name, email address or any other personal details; we keep only the scrambled practice identifiers described in Section 2(e), which are deleted automatically after 3 days.
• On PEP practice exams, a child may photograph a handwritten answer instead of typing it. This is optional. The photos are stored privately, read by our AI marking service without any name or contact details, and deleted after 3 days (see Sections 2(g) and 7).
• We do not share the personal data of minors with any third party beyond what is necessary to operate the tutoring service.

My V.I.P. Academy operates under the laws of Jamaica and complies with the Jamaica Data Protection Act 2020 (DPA 2020), which came into force in 2023 and establishes the framework for personal data protection in Jamaica.

Key principles we adhere to under the DPA 2020:

The Jamaica DPA 2020 is administered by the Office of the Information Commissioner (OIC). If you believe your data rights have been violated, you may lodge a complaint with the OIC at oic.gov.jm.

My V.I.P. Academy is based in Jamaica. However, some of our service providers are located in other countries, which means your data may be transferred internationally as part of our service delivery:

• Supabase — Data may be hosted in the United States (AWS infrastructure)
• Daily.co — Video infrastructure hosted in the United States
• Vercel — Hosting platform operates globally (primarily US/EU edge network)
• Brevo — Email delivery infrastructure in the European Union
• Bunny.net — CDN with global edge servers
• Google (Gemini) — AI marking of practice exam answers and Edu AI Hub generation, processed on Google's global cloud infrastructure
• Google Cloud (Text-to-Speech) — Classroom read-aloud of our own lesson text, processed on Google's global cloud infrastructure

Where your data is transferred outside Jamaica, we ensure appropriate safeguards are in place, including standard contractual clauses and data processing agreements with each provider.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of significant changes by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to registered users if the changes are material
• Displaying an in-platform notice for a reasonable period following the update

Your continued use of the Platform after changes are posted constitutes your acceptance of the updated Policy. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a concern about how we handle your data, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Information Commissioner (OIC) Jamaica at oic.gov.jm.