Privacy Policy

1. Scope of this policy

This Privacy Policy explains how Brainstruct LLC (“Brainstruct,” “we,” “us”) collects, uses, shares, and protects information in connection with our websites, apps, games, and physical Build Box products (together, the “Services”). Brainstruct is made for young children, so accounts are created and managed by a parent or guardian.

It does not cover third-party services that operate under their own privacy policies (for example, an app store or a payment processor). By using the Services, you agree to this policy.

2. Information we collect

Information you give us.

• Parent/guardian account details — name, email address, and sign-in credentials;
• Child profile details set by the parent — a first name or nickname and an age or age range;
• Purchase details for subscriptions and Build Box orders (processed by our payment provider); and
• Anything you send us, such as support messages and preferences.

Information we collect automatically.

• In-app learning progress and activity;
• Device and diagnostic information (device type, app version, crash/error logs) needed to run and improve the Services; and
• Basic, non-advertising technical identifiers required for the app to function.

We do not use advertising identifiers (such as Apple’s IDFA or Google’s Advertising ID) to track children, and we do not build advertising profiles of children.

3. How we use your information

• Provide, personalize, and maintain the Services and a child's learning experience;
• Process payments, subscriptions, and Build Box orders;
• Respond to support requests and send service communications about your account;
• Keep the Services safe, prevent fraud and abuse, and debug problems;
• Understand and improve our games and content using privacy-respecting analytics; and
• Comply with legal obligations and enforce our terms.

4. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we process personal data under one or more of these legal bases: performance of our contract with you; our legitimate interests in operating and improving the Services (balanced against your rights); your consent (which you can withdraw); and compliance with legal obligations. For children, we rely on parental consent where required.

5. Children's Privacy (COPPA)

Brainstruct is directed to children, so we follow the Children’s Online Privacy Protection Act (COPPA) and comparable laws. A parent or guardian creates and manages every account — children do not create accounts.

What we collect from children. Only what a child needs to play: a first name or nickname and age/age range set by the parent, in-app learning progress, and basic device/diagnostic data. Where possible, a child’s profile is stored on the device, and we never ask children for contact information.

Parental consent. Where COPPA requires it, we obtain verifiable parental consent before collecting a child’s personal information, and separate consent before sharing it with any third party.

No advertising to children. We never show children third-party ads, we do not use their data for behavioral or targeted advertising or profiling, and there are no third-party ad networks in the children’s experience.

Parental rights. At any time a parent can review their child’s information, request its deletion, refuse further collection or use, or withdraw consent. Email [email protected] from the account address and we will verify the request.

6. Cookies, analytics & advertising

On our marketing websites we use essential cookies for core functionality, analytics to understand how the site is used, and — because we advertise Brainstruct to parents — measurement and advertising cookies from partners such as Meta and Google to see how our ads perform. You can control non-essential cookies through your browser settings.

The children’s in-app experience contains no ads and no ad-tracking technologies. Any advertising or measurement is for marketing to adults only and never uses children’s information.

7. How we share your information

We share information only in these limited ways:

• Service providers who help us run the Services under contracts that limit their use of the data — for example payment processing (Stripe), hosting and content delivery, and error/analytics tooling.
• Legal and safety — where required by law or to protect the rights and safety of our users.
• Advertising & measurement partners — for our own marketing to parents (for example, to measure how our ads perform), using adult/website data only and never a child’s information.
• Business transfers — if Brainstruct is involved in a merger, acquisition, or sale of assets, information may transfer subject to this policy.

We do not sell your personal information, and we do not share it with data brokers. We never share children’s information with advertising networks or use it for advertising.

8. Payments

Payments are processed by Stripe under the PCI-DSS standard. Card details are provided directly to Stripe; Brainstruct does not receive or store full card numbers, only limited details such as card brand and the last four digits.

9. Data retention & deletion

We keep information only as long as needed to provide the Services or as required for legal, tax, security, or dispute-resolution purposes, after which we delete or anonymize it. You can ask us to delete your account and associated data — including a child’s profile — at any time by emailing [email protected].

10. Security

We protect information with encryption in transit, access controls, and other safeguards. No system is perfectly secure, but we work to keep your data safe and will notify you of a breach where legally required.

11. Your privacy rights & choices

Depending on where you live, you may have the right to access, correct, delete, export, or restrict the use of your personal information, and to object to certain processing or withdraw consent. Parents may exercise these rights on behalf of their children. To make a request, contact [email protected]; we will verify your identity before acting. EEA/UK users may also lodge a complaint with their local data protection authority.

12. U.S. state privacy rights (California & others)

California residents have the right to know what personal information we collect and how we use it, to request access or deletion, and to not be discriminated against for exercising these rights. We do not sell personal information. Where we use advertising and measurement partners for our own marketing to adults, that activity may be considered “sharing” for cross-context behavioral advertising under some state laws; you may opt out by emailing us or using available cookie controls. We never sell or share a child’s information for advertising. Residents of other U.S. states with privacy laws have similar rights. To exercise any right, email [email protected].

13. International data transfers

Brainstruct is operated from the United States, and information may be processed there and by our service providers. Where required for transfers from the EEA, UK, or other regions, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

14. Do Not Track

Some browsers offer a “Do Not Track” signal. Because there is no common industry standard for responding to it, our Services do not currently respond to Do Not Track signals. We do not track users across third-party websites for advertising in any case.

15. Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll notify you by email or within the Services and update the date above. Your continued use after an update means you accept the revised policy.

16. Who we are & how to contact us

Brainstruct LLC is the controller of personal information described in this policy. Questions, requests, or concerns about your data or a child’s data? Email [email protected]. Brainstruct LLC, United States.