Readily — Privacy Policy

1. About this policy

Readily Ltd (“Readily”, “we”, “us”, “our”) operates the Readily platform, which includes two products for children's literacy: Readily Reader (AI-generated personalised phonics storybooks) and the Readily Writer (AI writing feedback). This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and what rights you and your child have.

We take privacy seriously because our end users are children. This policy is written to comply with:

• The New Zealand Privacy Act 2020
• The Australian Privacy Act 1988 and the Australian Privacy Principles (APPs)
• The forthcoming Australian Children's Online Privacy Code (to be registered by 10 December 2026), which we have designed to in advance

We act as the “agency” under NZ law and the “APP entity” under Australian law responsible for the personal information you and your child provide. See also our Terms of Service.

2. Who we are and how to contact us

If you have a question, complaint, or request about your personal information, please email our privacy contact. We aim to respond to all privacy requests within 20 working days.

3. Who this policy applies to

Readily is used by two categories of people:

• Parents and guardians— who create and hold the Readily account, pay for the subscription, and are legally responsible for their child's use of the platform. Parents must be 18 or older.
• Children— who use the platform under their parent's account. Most Readily users are aged 5–12, though the platform may be used by children up to 17.

This policy explains how we handle information about both.

4. What information we collect

4.1 Information you give us

Parent account information:

• Name
• Email address
• Password (stored only as an encrypted hash — we cannot see your password)
• Billing information (processed by Stripe — we do not store card numbers)
• Country and time zone

Child profile information (added by the parent):

• Child's first name or display name (a nickname is fine)
• Age or school year
• Reading level
• School (optional)

Content generated during use:

• Stories generated for your child
• Writing submissions your child creates in the Writing App
• Dictation audio (if used) and its transcript
• Quiz answers
• Reading progress and streak activity
• Book favourites and preferences

4.2 Information we collect automatically

• Basic device and browser information (type, operating system, screen size)
• IP address (used to determine general region and prevent abuse)
• Session activity (pages visited, features used, timestamps)
• Error logs

4.3 Information we do not collect

We do not collect a child's:

• Email address
• Phone number
• Home address
• Photos or videos of the child
• Precise location (we use IP for general region only)
• Biometric data
• Financial information

We do not use behavioural advertising cookies, we do not build advertising profiles of parents or children, and we do not sell personal information to anyone.

5. Why we collect this information

We only collect information we need for a specific purpose. For each field listed above:

6. Children's privacy — how we protect our youngest users

Children are Readily's primary end users, so protecting their information is central to how we designed the platform.

6.1 Parental consent

An adult (18+) must create the account, agree to this policy, and set up each child profile. By creating a profile for a child, the parent or guardian provides verifiable parental consent for that child's use of Readily.

6.2 Age-appropriate transparency

• Children under 16 use Readily under parental consent. In-app language and prompts are child-friendly and explain, at a level they can understand, what Readily does with their stories and writing.
• Children 16 to 17are given an age-appropriate transparency notice inside the app when they first sign in, in addition to their parent's consent.
• We provide a plain-language, illustrated child-facing privacy summary at [readily.co.nz/kids-privacy].

6.3 What we never do with children's information

• We never sell or share children's information with advertisers.
• We never build advertising profiles or serve behavioural advertisements.
• We never use children's stories, writing, or voice to train AI models — ours or anyone else's (see Section 7).
• We never allow children to communicate publicly, message strangers, or share personal information with other users. Readily has no public feed and no social features.

6.4 Information collected about your child

Most personal information about your child is provided to us by you — their parent or guardian — rather than directly by the child. This includes their name, age, school year, and reading level. Under the New Zealand Privacy Act 2020 (Information Privacy Principle 3A, in force 1 May 2026), we are required to take reasonable steps to ensure your child is aware that this information has been collected, the purpose for which it has been collected, and their rights to access and correct it.

We meet this obligation through age-appropriate in-app transparency (Section 6.2) and through the child-facing privacy summary at readily.co.nz/kids-privacy. Content generated during use — stories, writing submissions, quiz answers — is created by or for the child directly within the app, and we treat that content with the same care as information provided by a parent.

6.5 “Best interests of the child” principle

In line with the forthcoming Australian Children's Online Privacy Code, we make product decisions with children's best interests as the primary consideration. Default settings for child profiles minimise data collection, and any new feature that would collect additional information about children will be reviewed against this principle before release.

7. How we use AI, and what happens to your child's data

Readily uses artificial intelligence to generate stories, illustrations, quizzes, writing feedback, read-aloud narration, and dictation transcription. To do this, some of the information you or your child provides is sent to specialist AI service providers who process it on our behalf.

We use the following AI providers (see full subprocessor list in Section 8):

7.1 We do not train AI models on your child's data

• Anthropic: By Anthropic's commercial API terms, inputs and outputs are not used to train Anthropic's models. Retention is 30 days for abuse detection, after which data is deleted.
• OpenAI: By OpenAI's API terms, inputs and outputs are not used to train OpenAI's models by default. Retention is 30 days for abuse monitoring, after which data is deleted. This includes dictation audio processed via Whisper — audio is not retained or used for training by OpenAI, and we delete it immediately after transcription on our side (see Section 10).
• Fal.ai: Confirmed in writing by Fal.ai support (July 2026): customer data — including prompts, input images, and generated outputs — is not used to train, fine-tune, or develop any models, whether Fal.ai's own or upstream providers such as Black Forest Labs. Requests to upstream providers are encrypted and anonymised. We have additionally configured our integration to disable request payload storage and set a one-hour expiry on any generated media, minimising retention on Fal.ai's infrastructure. Fal.ai's infrastructure spans the United States, European Union, and Singapore. A Data Processing Agreement is in progress.

7.2 AI outputs are not perfect

The stories, quiz questions, and writing feedback Readily produces are generated by AI. AI can make mistakes, produce unexpected content, or occasionally get facts wrong. We design our prompts and content controls to keep output age-appropriate and curriculum-aligned, and we ask parents to supervise their child's use. If you see something that concerns you, please report it via the feedback button in the app or email readily.admin@gmail.com and we will review.

7.3 AI is not a formal assessment

Writing feedback provided by Readily is a learning aid, not a formal educational assessment. It is not a substitute for a qualified teacher, and it does not diagnose learning difficulties.

8. Third-party service providers (subprocessors)

We use the following third-party services to run Readily. Each has agreed to handle personal information in line with this policy and applicable privacy laws.

Fal.ai note: We have disabled request payload storage and configured a one-hour media expiry on all image generation calls. A Data Processing Agreement is in progress.

We keep this list current. If we add a new subprocessor that changes how personal information is handled, we will update this policy and notify account holders.

9. Where your data is stored

All personal information stored by Readily itself lives in Sydney, Australia. Our primary database (Firestore) is hosted in Google Cloud's australia-southeast1 region. This includes all parent account details, child profiles, generated stories, writing submissions, and progress data.

When data is sent to AI providers or analytics providers for processing, it may be transmitted to servers in the United States, European Union, or Singapore (Fal.ai uses infrastructure across all three regions). We only transmit the minimum data needed for that provider to do its job, and we require each provider to protect that data to a standard comparable to the New Zealand Privacy Act.

For New Zealand users, this cross-border transfer is disclosed to you here as required by Information Privacy Principle 12. For Australian users, we rely on Australian Privacy Principle 8 and the contractual commitments of each provider.

10. How long we keep information

After the retention period ends, we delete the information permanently, except where we are legally required to keep it (for example, billing records for tax purposes) or where we have anonymised it so it can no longer identify anyone.

You can request deletion of your account at any time — see Section 12.

11. How we protect your information

• All data is encrypted in transit using HTTPS.
• All data at rest is encrypted by our infrastructure providers using industry-standard encryption.
• Access to production systems is restricted to authorised personnel, using multi-factor authentication.
• Passwords are stored as one-way encrypted hashes — even we cannot see them.
• Database access is governed by strict server-side rules; child data is only accessible via the parent's authenticated account.
• We regularly review our security practices and update them as threats evolve.

11.1 If something goes wrong (data breach)

If we experience a privacy breach that is likely to cause serious harm, we will notify the New Zealand Office of the Privacy Commissioner and the Australian Office of the Australian Information Commissioner as required by law, and we will notify affected account holders directly and promptly. This is a legal obligation, not an option.

12. Your rights

You and your child have the following rights over your personal information. Requests can be made by emailing readily.admin@gmail.com. We will respond within 20 working days.

Complain— If you're not satisfied with how we've handled a request, you can complain to:

• New Zealand: Office of the Privacy Commissioner — privacy.org.nz
• Australia: Office of the Australian Information Commissioner — oaic.gov.au

13. Cookies and analytics

Readily uses a small number of cookies and similar technologies:

• Essential cookies — for signing you in and keeping you signed in.
• Analytics (PostHog) — to understand how features are used and to fix bugs. Analytics data is hosted in the European Union and is not used for advertising.

We do not use third-party advertising cookies. We do not permit third parties to track our users across the web.

14. Changes to this policy

If we make material changes to this policy (for example, adding a new type of data collection, or a new subprocessor that changes how information is handled), we will:

1. Email account holders at least 30 days in advance.
2. Update the “Last updated” date at the top of this policy.
3. In some cases, ask you to re-accept the updated terms before continuing to use Readily.

Minor changes (formatting, clarifications) may be made without notice, but the change will always be reflected in the “Last updated” date.

15. Governing law

This policy is governed by the laws of New Zealand. Australian users retain all rights under Australian privacy law regardless.