Privacy Policy

Draft for review · Last updated 23 August 2026. This document describes how Aurelia World is designed to work. It is a working draft and should be reviewed by qualified legal counsel before public launch.

1. Who is responsible for your data

Global Solutions Management LLC ("GSM", "we", "us" or "our") operates Aurelia World. Depending on the processing activity, GSM may act as a data controller, business, service provider or processor under applicable privacy law.

Where GSM decides why and how information is used for account security, child safety, fraud prevention, moderation, platform integrity, billing, service administration and legal compliance, GSM generally acts as a controller. Where a school or organisation instructs GSM to process education records solely for that institution's purposes, the institution may be the controller and GSM may act as its processor or service provider. The applicable institutional agreement and Data Processing Addendum describe that split in more detail.

2. The data we may collect

• Account and identity data: name, email, age band, country, verified role, school or organisation relationship and account identifiers.
• Guardian and permission data: guardian relationships, invitations, consent and sharing decisions, and records showing when permissions were requested or changed.
• Creative and learning data: project titles, drafts, descriptions, submissions, feedback, achievements and verification records. Media files are not accepted while the protected scanning/quarantine upload pathway is disabled.
• Institutional data: school, education-group and organisation membership, role and administration records, and information an institution lawfully directs us to process.
• Safety data: reports, moderation decisions, incident records and information reasonably necessary to investigate or respond to a safeguarding or security concern.
• Billing data: plan, billing status, transaction and subscription identifiers. Payment providers process card or bank details under their own secure systems.
• Technical data: IP address, device/browser information, security logs, authentication events and diagnostic information needed to secure and operate the service.
• Contact data: information submitted through enquiry, support or institutional sales forms.

3. Why we use personal data

We use personal data only for defined purposes, including to:

• create, verify and protect accounts and role-based access;
• provide creative, learning, achievement and community features;
• operate guardian approval, school verification and moderation workflows;
• protect children, investigate reports, prevent abuse, fraud and security incidents;
• process subscriptions, institutional contracts and customer support;
• maintain audit records, enforce our Terms and comply with legal obligations; and
• improve reliability and safety using appropriately limited operational information.

We do not sell children's personal data. We do not use children's personal data for behavioural advertising, and we do not build advertising profiles of children.

4. Lawful bases

The lawful basis depends on the activity and jurisdiction. It may include performance of a contract, compliance with legal obligations, legitimate interests in operating and securing the platform, protection of vital interests in an urgent safety context, and consent where consent is legally required. We do not treat a single guardian consent as a blanket legal basis for every use of a child's data.

5. Children and parental authorisation

Children receive higher privacy settings by default. Under-16 accounts are not open self-registration accounts. Guardian or institution-sponsored onboarding, age bands and permission controls are used so that the level of protection can be matched to the user and the jurisdiction.

Where a law requires verifiable parental consent or authorisation, we take reasonable steps appropriate to the risk to verify the adult or institutional authority giving it. In school deployments, a school may be able to authorise specified education-only processing where local law permits, but that does not allow GSM to reuse student data for unrelated commercial purposes.

6. Private child work and guardian visibility

A child's draft is private by default and is not automatically exposed to a guardian, teacher, school or organisation. Guardians receive the information needed to review a sharing request, but sponsorship of an account does not by itself create unrestricted access to the child's private workspace. Wider visibility requires the relevant product permission, safety and moderation steps.

7. Special-category and highly sensitive information

Aurelia World is not designed as a health-record, counselling or special-category-data repository. Users should not add sensitive information unless the feature requires it and they are authorised to do so. A safeguarding report may necessarily contain sensitive information; in that case we restrict access and use it only for legitimate safety, legal and case-management purposes.

8. AI and automated processing

AI-assisted features may help with ideas, structure, spelling, accessibility, safety signals or similar bounded tasks. Aurelia World does not use children's data to target advertising. We do not intend to make decisions producing legal or similarly significant effects on a child solely by automated means. Safety signals can trigger human review rather than automatically publishing a child's work.

9. Who we share data with

We disclose personal data only where there is a legitimate and lawful reason. Recipients may include vetted hosting, database, security, communications, payment and moderation providers; a school or organisation with an authorised oversight role; professional advisers; an acquiring or financing party under appropriate confidentiality; and public authorities where disclosure is legally required or reasonably necessary to protect a person from serious harm.

Service providers are expected to process information only for authorised purposes and under contractual, confidentiality and security obligations appropriate to their role.

10. Public-page translation

Aurelia World may offer an optional third-party translation tool on public marketing and demonstration pages. The translation service is deliberately excluded from authenticated dashboards, sign-in and account creation, private alumni areas, contact enquiries and safeguarding reports. Sensitive form fields and protected brand terms are marked not to be translated. Automated translations are provided for convenience and are not a substitute for an authoritative local-language legal notice where one is required by law.

11. International transfers

GSM is a United States company and Aurelia World is intended for international use. Infrastructure and service providers may process data in more than one country. Where a cross-border transfer requires a specific legal safeguard, GSM will use an applicable mechanism such as an adequacy framework, contractual safeguards, or another transfer mechanism recognised by the relevant law, together with additional security measures where appropriate.

12. Retention and deletion

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide the account, satisfy contractual and legal obligations, resolve disputes, prevent fraud and preserve legitimate safeguarding or security evidence. Different categories have different retention periods. We do not intentionally retain children's personal data indefinitely merely because storage is available.

When an account or project is deleted, removal from active systems may be followed by a limited backup or legal-retention period. Safeguarding, fraud, financial or legal records may be retained for longer where justified and access-restricted.

13. Security

Aurelia World uses role-based access, database-level row security, server-side secrets, verified account roles, audit trails and other technical and organisational controls. No system can guarantee absolute security. We review security risks and may suspend or restrict an account where necessary to protect users or the service.

14. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to or obtain a copy of personal data, withdraw consent, or complain to a privacy regulator. Some jurisdictions also give rights relating to sale, sharing, targeted advertising or automated decision-making. Because Aurelia World does not sell children's data or use it for behavioural advertising, those practices are not part of the child service model.

A guardian may exercise appropriate rights for a child, subject to the child's own rights as they develop and to applicable law. Schools may also submit requests for data they control under an institutional agreement. Requests can be made through our contact page. We may need to verify identity and authority before acting on a request.

15. Regional representatives and regulatory contacts

Where a law requires GSM to appoint a local privacy or digital-services representative, GSM will appoint that representative before relying on the relevant regulated offering and will publish the required contact details. The identity and scope of any such representative must be confirmed for each launch territory rather than assumed from the existence of another GSM-affiliated or partner organisation.

16. Changes to this policy

We may update this notice as the service, providers or law change. If a change materially affects how we use children's or paid-account data, we will provide the notice and choices required by applicable law before the change takes effect where required.

17. Contact and complaints

Privacy requests and questions can be submitted through our contact page. Safety concerns should use the report-a-concern route. You may also have the right to complain to the data-protection authority that applies where you live.