Last updated: 6 June 2026 (v2.36.1: added AI model training consent section) · Private beta · Republic of Ireland
AIKA Academy ("AIKA", "we", "us") is an AI-literacy academy designed for children aged 8–15, used under parental supervision. This policy explains what we collect, why, how we protect it, and the rights you and your child have. We have written it to comply with the EU/Irish GDPR and the Irish Data Protection Act 2018, and the US COPPA 2.0 (Children's Online Privacy Protection Act).
The data controller is AIKA Tech LTD (a private company being incorporated in the Republic of Ireland), trading as AIKA Academy. Until incorporation completes, the service is operated by its founder in Ireland as the responsible controller. For any privacy question, data-subject request, or to reach our data-protection contact, email hello@aika.social. We will appoint a formal Data Protection Officer (DPO) if and when our scale requires one under GDPR Article 37; until then, all data-protection queries are handled directly via this address.
In Ireland, processing a child's personal data online requires parental consent for children under 16. Access to AIKA is invitation-only: invite codes are issued directly to a parent/guardian, and at sign-up the parent confirms they consent to their child using AIKA. That parental consent is our lawful basis for processing. Where a parent provides an email, we also rely on legitimate interest to send account/progress updates, which you can opt out of at any time.
AIKA complies with the US Children's Online Privacy Protection Act (COPPA 2.0) (effective April 22, 2026). We require verifiable parental consent (VPC) for all users under 13. Our VPC process:
Access to AIKA is by invitation only, and invite codes are sent directly to parents/guardians. We do not knowingly collect information from children without verified parental consent. If you believe a child under 13 has registered without parental consent, contact hello@aika.social immediately and we will delete the account and all associated data within 24 hours.
All progress, notes, neurons, and conversation history belong to the child and their parent/guardian. Parents may, at any time:
We never share your child's data with any third party. Ever.
We keep a child's data only for as long as the account is active, applying data-minimisation by design (GDPR Art. 5(1)(c) & (e), COPPA 2.0 minimisation). Specifically:
To generate the tutor's replies, a child's chat message is sent to an AI language model. AIKA uses a primary model first, then a fallback chain only if the primary is unavailable, so on any given request one of the following models processes the message text:
| Processor | Role | Data involved |
|---|---|---|
| AIKA server (EU-based, Ireland region) | Hosts the platform & all accounts | All account & progress data |
| MiniMax (model "M2.7") | Primary tutor model — runs on our own private EU infrastructure during the beta | The child's chat message text, to produce a reply. Processed in the EU; not used for advertising or to train third-party models. |
| OpenRouter (AI gateway) | Routes a request to a fallback model if the primary is unavailable | Passes the child's chat message text through to the selected fallback model. Not used for advertising or model training. |
| Google (Gemini 2.5 Flash) — fallback | 1st fallback model, via OpenRouter | Receives the child's chat message text to generate a reply when the primary is down. |
| Anthropic (Claude 3 Haiku) — fallback | 2nd fallback model, via OpenRouter | Receives the child's chat message text to generate a reply. |
| Mistral AI (Mistral Small) — fallback | 3rd fallback model, via OpenRouter | Receives the child's chat message text to generate a reply. |
| DeepSeek (DeepSeek V3) — last resort | Final fallback model, via OpenRouter | Receives the child's chat message text to generate a reply. Not retained for advertising; not used to train models on a child's data. |
| HuggingFace (private backup repo) | Encrypted off-site backup of platform data | Private repository only. Child private journal/memory data is excluded from backup. |
We send the AI model only the message text needed to produce a reply — not the child's password, parent email, or account identifiers. All processors are bound (by their terms and our configuration) to use the data only to provide their service to AIKA, never for advertising or resale. We disable model-training on submitted content where the provider offers that control.
Our primary tutor model and your child's account data are processed within the EU (Ireland). However, the fallback AI models above (Google, Anthropic, Mistral, DeepSeek, via OpenRouter) may process the chat message text on infrastructure outside the European Economic Area, including the United States. Where that happens, the transfer is protected by appropriate safeguards under GDPR Chapter V — such as the EU Standard Contractual Clauses and/or the providers' adherence to the EU–US Data Privacy Framework. Only the chat message text is transferred for the sole purpose of generating a reply; no account identifiers are sent. You may contact us for more detail on the safeguards in place.
AIKA uses a single session cookie (aika_session) to keep a user logged in.
It is HttpOnly, SameSite=Lax, and (in production) Secure. We use no tracking, analytics,
or advertising cookies. Because the only cookie is strictly necessary for login, no separate cookie-tracking
consent is required; we still show a brief notice for transparency.
AIKA's tutor is an artificial-intelligence system, not a human. Children and parents are told this clearly in the interface. The AI is used only to teach and converse with your child about AI literacy. We do not use the AI to make any automated decision that produces legal or similarly significant effects about your child (GDPR Article 22). Parents can view the full conversation history at any time in the Parent dashboard.
AIKA is a constantly improving tutor. To make it better at teaching children, we collect anonymised interaction data — specifically, the chat exchanges, lesson completion events, and quiz/boss-battle outcomes that occur when your child uses AIKA. This section explains exactly what we collect, how we protect it, and your rights.
What is never collected for training: names, email addresses, phone numbers, or any other contact details. Free-text PII (e.g. "my name is…") is automatically scrubbed from conversation text before it is stored.
The child's username is replaced with a one-way cryptographic hash (HMAC-SHA256) using a secret key known only to AIKA, before any record is written to the training corpus. This hash cannot be reversed to recover the original username. It is pseudonymisation under GDPR (not full anonymisation), and we treat the corpus as in-scope personal data accordingly.
The lawful basis for this processing is GDPR Article 6(1)(f) — legitimate interests: improving the educational outcomes of children using AIKA, where those improvements directly benefit the very children whose data is used. We have conducted a Legitimate Interests Assessment (LIA) and are satisfied that our interests do not override the rights and interests of data subjects, given the strong safeguards (pseudonymisation, no sharing, child-appropriate purpose, bounded retention) applied to the corpus.
Training data is stored only on AIKA's own servers and is never shared with, sold to, or provided to any third party — including the AI model providers listed in section 7.
We also generate fully synthetic tutoring examples using our own AI infrastructure. These contain no real user data and are used alongside the anonymised corpus to improve model quality.
Anonymised training data is retained for up to 3 years for the purpose of model improvement. If you delete your child's account, their pseudonymised records will also be deleted from the training corpus within 30 days.
You have the right to object to the use of your child's data for AI model training. To do so, email hello@aika.social with your child's username and the subject line "Training data opt-out". We will exclude your child's records from the training corpus and delete any already stored within 30 days.
Under EU/Irish GDPR, you and your child have the following rights:
| Right | How to exercise it |
|---|---|
| Access (Art. 15) | Email hello@aika.social — we respond within 30 days |
| Erasure / Right to be forgotten (Art. 17) | Use the Delete Account button in the Parent Dashboard (instant) or email us |
| Data Portability (Art. 20) | Use the Export My Data button in the Parent Dashboard (instant JSON export) |
| Rectification (Art. 16) | Email hello@aika.social |
| Object / Restrict (Art. 21–22) | Email hello@aika.social |
| Withdraw consent | Delete the account at any time via Parent Dashboard |
You also have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie).
We protect your child's data with measures appropriate to its sensitivity (GDPR Art. 32):
If we make material changes we will update the "Last updated" date above and, where appropriate, notify parents by email.
Questions about your data or this policy? Email hello@aika.social.