LESA — Children's Privacy Policy

For Parents and Legal Guardians

Effective Date: 14 August 2026 | Last Updated: 23 July 2026 | Version 1.0 (App)

At a glance

LESA is an educational reading and language-learning service designed for children. We have built it to be safe and simple, and we have written this Privacy Policy in plain English so you can understand what we do with your child's information. The points below are the headlines — the rest of this document explains them in detail.

We collect only what we need to make the Service work and to help your child read better.

We do not sell your child's data. Ever. To anyone.
We do not run third-party advertising in LESA, and we do not track your child across other apps or websites.
We do not use the child's personal data to train AI models. Our story-creation engine, LESA Stories, uses AI to draft stories, and human editors review every story before it reaches your child. We do look at aggregated reading and feedback data — for example, comprehension scores and enjoyment ratings averaged across many children — so our editors can spot stories that aren't working well and improve or replace them. This is done on aggregated patterns, never on individual children.
You are in control. You can review, correct, or delete the child's data at any time, from inside the app or by writing to privacy@lesa.app. We respond within 30 days.
We host data securely in the European Economic Area — on Google Cloud's EU region — encrypt it in transit and at rest, and limit who can access it.
The child's username and the parent name shown to the child don't have to be real. They're only used to personalise the experience — we never require the child's legal name or an email address for the child.

Plain-language guides

Alongside this Privacy Policy we publish two short, visual guides that show — screen by screen — what LESA collects and why:

For parents and guardians: What LESA collects, and why
For children: What LESA collects, and why — for young readers — the same guide in simple language written for children.

These guides were prepared following our discussions with the Icelandic Data Protection Authority (Persónuvernd). They summarise this Privacy Policy in plain language; if anything differs between a guide and this Privacy Policy, this Privacy Policy prevails.

1. Who We Are and How to Reach Us

LESA is operated by LESA ehf., an Icelandic private limited company with its registered office at Borgartún 29, 105 Reykjavík, Iceland ("LESA," "we," "us," "our"). For the purposes of EU and UK GDPR, LESA ehf. is the controller of the personal data described in this Privacy Policy.

You can contact us about this Privacy Policy or any data-protection matter at:

LESA ehf. Borgartún 29, 105 Reykjavík, Iceland Privacy and data protection: privacy@lesa.app General support: support@lesa.app Website: https://www.lesa.app

We have appointed a privacy lead within the company who reviews requests sent to privacy@lesa.app. As LESA expands into additional EU/EEA markets, we will appoint or designate any further representatives or data protection officers required by law and update this section accordingly.

2. What This Policy Covers

This Privacy Policy describes how LESA handles personal data across all parts of the Service:

the LESA mobile application for iOS and Android, used by children;

the Parent dashboard, used by parents and legal guardians;
the LESA website at https://www.lesa.app and any related marketing pages;
the LESA Stories engine back-end and other systems we operate to deliver the Service.

This Privacy Policy is incorporated by reference into the LESA Terms & Conditions and must be read together with them. Capitalised terms not defined here have the meanings given in the Terms.

3. Who Agrees to This Policy

LESA is intended for children, but the agreement is between LESA and the adult who authorises the child's access — the child's parent or legal guardian. Children do not enter into this Privacy Policy themselves.

Throughout this document, "you" means that authorising adult. Where we describe what we do with "the child's" data, we mean the child whose use you are authorising.

4. What Information We Collect

We collect the smallest amount of personal information that lets us run a safe and useful Service. The categories below cover everything we currently collect or may collect in the near term. If we ever start collecting a new category, we will update this Privacy Policy and, where the law requires, ask you for fresh consent.

5. Where the Information Comes From

We get information about you and the child from two places:

Directly from you — when you create the Parent account, set up a child profile, configure parental controls, or contact our support team.
From the child’s use of the Service — when the child reads a story, answers a comprehension question, rates a story, or unlocks a reward.

6. How We Use Information

We use the information we collect for the following purposes, and only for these purposes:

To run the Service — to log you in, show the right stories at the right level, save progress, sync between devices, deliver push notifications you have allowed, and provide customer support.
To keep children safe — the app does not let children enter free text or contact anyone, so there is no child-generated content to moderate; the stories children read are screened by automated safety checks and banned-word filtering and human editorial review before publication (see Section 8), and we detect and investigate abuse and security incidents.
To improve the Service — to fix bugs, understand which stories work well, refine difficulty levels, and develop new features. Where we use educational data for this purpose, we use it in aggregated and de-identified form wherever possible.
To communicate with you — to send transactional messages (security alerts and account changes) and the activity-based service emails described in Section 16.2: a weekly reading report and reminders when the child has not read for a while.
To meet legal and regulatory requirements — to comply with tax, accounting, child-safety, and data-protection laws, and to respond to lawful requests from public authorities.

7. Our Lawful Bases for Using Your Child’s Data

In Iceland, the processing of personal data is governed by Act No. 90/2018 on Data Protection and the Processing of Personal Data, which implements the GDPR (Regulation (EU) 2016/679). Every processing operation needs a lawful basis under Article 6 GDPR (Article 9 of Act No. 90/2018), and different operations may rely on different bases. Where you live in another EU/EEA state or the UK, the GDPR or UK GDPR applies together with your national implementing law.

We rely on the following bases:

Consent of the holder of parental responsibility (Articles 6(1)(a) and 8 GDPR; Article 10 of Act No. 90/2018) — our primary basis for processing the child’s personal data. You give informed consent when you set up the child’s profile, and the consent record is kept for as long as Section 12 describes. The age of digital consent varies by Member State (13 in Iceland, Norway, Denmark, Sweden, and Estonia; 16 in Poland and the Netherlands), and we apply the threshold of the country where the child lives. You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Performance of a contract (Article 6(1)(b)) — for the processing that is objectively necessary to deliver the Service you have signed up for: account management, saving progress, syncing between devices, and support. We apply this basis narrowly, in line with EDPB Guidelines 2/2019, and do not stretch it to cover optional features.
Legitimate interests (Article 6(1)(f)) — for keeping the Service secure, preventing fraud and abuse, fixing bugs, and producing aggregated and anonymised insights. Before relying on this basis we carry out and document a balancing test between our interests and the rights and freedoms of you and the child, giving particular weight to the child’s interests as EDPB Guidelines 1/2024 (section 5.1) require. We do not rely on legitimate interests where the processing could have a negative effect on the child, and you can object at any time (Section 13).
Legal obligation (Article 6(1)(c)) — to comply with our duties under tax, accounting, consumer-protection, and data-protection law.
Consent for optional features (Article 6(1)(a)) — for any future feature that would process special-category data (for example, the optional voice feature described in Section 16.3).

Whatever the basis, all processing must comply with the six principles of Article 5 GDPR (Article 8 of Act No. 90/2018) — lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; and integrity and confidentiality — and we are accountable for demonstrating that it does.

8. How We Create Stories and Illustrations

8.1 What LESA Stories Is

LESA Stories is the LESA system that produces the stories your child reads. It combines artificial intelligence with editorial review by qualified educators.

Our editorial team writes a curriculum-aligned brief for each story (vocabulary, phonics, sentence length, age range, theme).
AI language models, supplied by trusted partners under written contracts, draft the story from that brief.
Automated quality checks screen for length, age-appropriateness, factual accuracy, banned words, and adherence to our editorial guidelines. Stories that fail are rewritten or rejected.
A human editor reviews and approves the story before it is added to the LESA library.

8.2 We Do Not Use the Child’s Data to Train AI Models

The child’s personal data is never used to train or fine-tune AI or machine-learning models, ours or anyone else’s. The AI partners that draft stories process only the editorial briefs we provide, on contractual terms that prohibit them from using any data for their own purposes; they receive no personal data at all.

8.3 Improving Stories Based on Aggregated Reading Data

Once a story is published, we look at how children read and respond to it — for example, how often the story is finished, the average comprehension scores it produces, and the average reading-enjoyment rating it receives. Where a story consistently scores poorly across many readers, our editorial team reviews it and decides whether to revise the wording, simplify it, replace it, or retire it. Some of those revisions may be drafted with AI assistance through the same LESA Stories pipeline (Section 8.1), and every revised story goes through the same human editorial review before it is republished.

We use this data in aggregated form. We do not look at one child’s behaviour to tailor stories for that child, and we do not adjust stories based on a single child’s feedback.
We use the aggregated data to improve the editorial library, not to train AI models. Editors and reviewers see summary statistics across many children, not individual reading sessions.
This processing relies on our legitimate interest in delivering high-quality educational content. You can object at any time by writing to privacy@lesa.app, and we will then exclude the child’s reading and feedback data from these aggregated editorial reviews.

8.4 Other AI-Supported Features

LESA may also use AI to support features in the future such as text-to-speech narration, automatic difficulty suggestions, optical character recognition for source content during story production, and translation. We will describe each AI-supported feature here as it becomes available, and we will give you in-app controls to limit or turn off optional AI features for your child where this is technically and legally feasible.

8.5 Automated Decisions

LESA measures your child’s reading progress, for example, stories completed, reading time, and comprehension answers, to show you that progress and provide general reading tips. These tips are the same for all children at a similar reading level and are not personalised to your child. LESA does not make automated decisions that produce legal or similarly significant effects on your child within the meaning of Article 22 of the GDPR. Other automated processes we use, such as automatically unlocking cosmetic rewards as your child reads and filtering content against a banned-word list, are designed to support the reading experience and do not replace human judgement.

9. What We Don’t Do

We think it’s as important to tell you what we don’t do with your child’s data as it is to tell you what we do.

We don’t sell, rent, or trade your child’s personal data, in any jurisdiction or under any definition (including the CCPA/CPRA definition of “sell” or “share”).
We don’t run third-party advertising inside LESA. There are no banner ads, interstitial ads, video ads, advergames, or sponsored content.
We don’t profile your child for marketing or use the child’s behaviour to build advertising audiences.
We don’t track your child across other apps or websites. We do not use IDFA, AAID, GAID, or other persistent advertising identifiers in the child’s app.
We don’t use the child’s personal data to train AI models. (See Section 8.2.)
We don’t allow children to contact each other through LESA. There is no friend list, chat, or social discovery.
We don’t share individually identifiable child data with the public.
We don’t make legally significant decisions about a child by automated processing alone. (See Section 8.5.)
We don’t collect geolocation data from the child’s device. We process IP address only for security and abuse prevention, and we truncate it where we can.
We don’t require an email address for the child, and we never ask the child to provide one. The only email address we hold is the parent’s. We also don’t ask for or store the child’s home address.
We don’t create passwords or separate logins for children. The Parent account signs in with Apple or Google; child profiles exist only inside the parent account and have no login of their own. We store no passwords for anyone.
We don’t insist that the child’s username or shown parent name be the real one. Pick whatever you want — the app uses the text you provide to personalise stories, not to verify identity.

10. Service Providers and Sub-Processors

To run LESA, we rely on a small number of carefully chosen service providers that process personal data on our behalf (“sub-processors”). Each is bound by a written data processing agreement that requires them to protect the data, use it only on our instructions, return or delete it when we tell them to, and meet appropriate security standards. We choose providers that, wherever possible, store and process data within the European Economic Area.

The sub-processors we use as of the effective date are:

11. International Data Transfers

LESA is operated from Iceland and stores child and parent data primarily in the European Economic Area (EEA). Because some of our service providers operate globally, personal data may sometimes be transferred to countries outside the EEA, the United Kingdom, or your country of residence. Such transfers are made only in accordance with Chapter V of the GDPR.

Where a transfer happens, we put appropriate safeguards in place, including:

the European Commission’s Standard Contractual Clauses (SCCs), together with the UK Addendum where applicable, when transferring data outside the EEA or UK to a country that does not have an adequacy decision;
supplementary measures (such as encryption, access controls, and careful provider selection) where required by post-Schrems II case law;
reliance on adequacy decisions where they exist (for example, between the EEA and the UK, and where applicable between the EEA and the United States under the EU-US Data Privacy Framework, only with providers that are validly self-certified under it).

You can request a copy of the relevant safeguard for any specific transfer by writing to privacy@lesa.app, with personal or commercially sensitive details redacted as necessary.

12. How Long We Keep Data

We keep personal data only for as long as we genuinely need it. Specific retention periods are:

Active child profile and learning telemetry: kept while the profile is active. Deleted from active production systems within 30 days after you delete the child profile or close the account, except as noted below.
Parent account data: kept while the account is active and for up to 30 days after closure for active deletion, plus up to 90 days for back-up overwrite in the ordinary course of our back-up cycle.
Customer-support correspondence: kept for up to two years after the matter is closed, unless a longer period is required by law.
Consent and parental-authorisation records: kept for the duration of the account and for up to two years afterwards, to evidence compliance with COPPA, GDPR-K, and similar laws. Email delivery logs and the record of any email opt-out are kept for the same period, as an audit record of what we sent and of when you unsubscribed.
Aggregated and irreversibly de-identified data: may be kept indefinitely, because it can no longer be linked to an identifiable person.

If a particular legal obligation, regulatory requirement, or active investigation requires us to keep specific data for longer, we will keep only that data, and only for as long as needed.

13. Your Rights and How to Use Them

13.1 The Rights

As the parent, legal guardian, or authorising adult, you can exercise the following rights on the child’s behalf, subject to applicable law:

Access — request a copy of the personal data we hold about the child.
Rectification — ask us to correct inaccurate or incomplete data.
Erasure (the right to be forgotten) — ask us to delete the child’s data.
Restriction — ask us to pause the processing of the child’s data while we look into a concern.
Objection — object to processing that we carry out on the basis of legitimate interests.
Portability — receive the child’s data in a structured, commonly used, machine-readable format, or have it sent to another provider where technically feasible.
Withdraw consent — for any processing that relies on consent. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
Refuse a sale or sharing for cross-context advertising — under the CCPA/CPRA and similar US state laws. We do not sell or share child personal data, but you have the right to be told that and to confirm it in writing.
Lodge a complaint — with the Icelandic Data Protection Authority (Persónuvernd, https://personuvernd.is/) or the supervisory authority where you live.

13.2 How to Exercise Your Rights

There are three ways to act on these rights:

From inside LESA. Open the Parent dashboard, go to “Privacy & Safety,” and use the “View my child’s data” or “Delete my child’s data” controls.
By email. Write to privacy@lesa.app with the request and the child’s profile details. We will reply to confirm receipt and to ask for any identification we need to verify your identity.
By post. LESA ehf., Borgartún 29, 105 Reykjavík, Iceland — Attn: Privacy Lead.

We respond to requests within 30 days of receiving them and verifying your identity. In rare, complex cases we may extend that period by up to a further two months and will tell you why. We do not charge for these requests, except where allowed by law for clearly unfounded or excessive requests.

14. How We Protect Data

We apply technical and organisational security measures appropriate to the risks of processing children’s data, including:

encryption in transit (TLS 1.2 or higher) and at rest (AES-256);
role-based access control on the LESA back office, with default deny and an audit log of access to child data;
least-privilege access and regular review of who has access to what;
software development practices that include secure coding standards, code review, and automated security testing;
independent security review by Ambaga and other qualified third parties;
an incident-response plan that meets the 72-hour notification timeframe under Article 33 GDPR for personal-data breaches;
regular sub-processor reviews and DPAs with every provider that handles personal data.

We have carried out a data protection impact assessment (MÁP — mat á áhrifum á persónuvernd) under Article 35 GDPR covering LESA’s processing of children’s data, including the story-generation features described in Section 8. We keep it up to date as the Service evolves, and it is available to Persónuvernd on request.

No system is perfectly secure. If we ever discover a personal-data breach affecting the child, we will notify the relevant supervisory authority and, where required, the parent, in accordance with applicable law.

15. Cookies and Similar Technologies

LESA’s mobile app does not use traditional browser cookies, and does not use third-party advertising trackers, software development kits (SDKs) for ad networks, or social-media tracking pixels. The app uses a small number of strictly necessary technologies (for example, secure local storage to remember the child’s progress and a session token to keep the child signed in).

Our marketing website at https://www.lesa.app uses a limited set of cookies for site operation and, with your consent, for privacy-friendly analytics. You can review and change your cookie choices through the cookie banner on the website. The marketing site is for parents only — it is not part of the child’s app experience.

16. Push Notifications and Email

16.1 Push Notifications

Push notifications inside LESA are off by default. Where you choose to enable them, we use them to send reading reminders and similar transactional messages to the child’s device, at the time and frequency you choose. You can change or turn off notifications at any time from the Parent dashboard or your device settings.

16.2 Email

We send transactional emails (such as security alerts and account changes) to the parent email address on file. We also send activity-based service emails to the parent: a weekly reading report, and reminder emails if the child has not read for a while (currently after 3, 7, and 14 days of inactivity). These emails are based on the child’s reading activity, are sent only to the parent, and can be turned off at any time from the Parent dashboard or via the link in the email; we keep a record of when you opt out so we can honour it.

16.3 Voice Features

LESA does not record or upload the child’s voice. If we introduce a voice feature in the future (for example, fluency analysis or a voice interface for accessibility), we will design it to run on-device wherever technically feasible and we will obtain separate, specific parental consent before activating it for a particular child. We will describe how any voice feature works in this Privacy Policy before turning it on.

17. Children’s Privacy and Parental Authorisation

LESA is intended for children. We never knowingly let a child create an account without the involvement of a parent or guardian. If we learn that we have collected personal data from a child without the necessary authorisation, we will suspend the relevant profile and delete the data.

If you are based in the United States and your child is under 13, the U.S. Children’s Online Privacy Protection Act (COPPA) applies. We comply with COPPA by:

not collecting more information from the child than is reasonably necessary;
obtaining verifiable parental consent through the adult-only account setup before collecting personal data from the child;
giving you the right to review the personal data we have collected from the child, the right to refuse further collection, and the right to ask us to delete the data;
not conditioning a child’s participation in any activity on the disclosure of more personal data than is reasonably necessary;
not running behavioural advertising, retargeting, or third-party ad-tech in the child’s app.

If your child is between 13 and 16, GDPR-K may still require parental consent in your country (see Section 7). We follow the higher applicable standard for any given user.

18. Notice for U.S. State Residents

This section provides additional information for residents of U.S. states with comprehensive privacy laws, including California, Colorado, Connecticut, Utah, and Virginia, and for any other state with similar laws that comes into force after the date of this Policy.

18.1 California (CCPA/CPRA)

In the past twelve months, LESA has collected the following categories of personal information about California consumers (parents and, with parental authorisation, children): identifiers (account email, profile name); internet or other electronic network activity (in-app activity, device data); and inferences drawn from the above for the limited purpose of recommending stories at an appropriate level. LESA has not sold or shared personal information for cross-context behavioural advertising, and does not sell or share the personal information of consumers under 16.

California residents have the rights to know, access, delete, correct, and limit the use of sensitive personal information, and the right not to be discriminated against for exercising those rights. To exercise any of these rights, write to privacy@lesa.app.

18.2 Other US States

Residents of Colorado, Connecticut, Utah, Virginia, and other states with comprehensive privacy laws have the rights granted by their respective laws, including the rights to access, correct, delete, and obtain a portable copy of their personal information, and to opt out of targeted advertising and the sale of personal information. LESA does not engage in targeted advertising or sale of personal information. To exercise any of these rights, write to privacy@lesa.app.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example to reflect new features, new legal requirements, or new sub-processors. When we make material changes, we will update the “Last Updated” date at the top of this document and give you reasonable advance notice — for example, by email to the parent address on file or a prominent in-app notice. Where the law requires it, we will ask you to renew your consent. We will keep older versions of this Privacy Policy in our archive at https://www.lesa.app/privacy/archive.

20. Glossary

Child — a minor who uses the LESA Service through a profile authorised by a parent or guardian.
Parent — the parent, legal guardian, or other authorising adult who agrees to this Privacy Policy and the Terms & Conditions on the child’s behalf.
Personal data — any information that identifies, or could reasonably identify, a person, directly or indirectly. Has the meaning given in Article 4(1) GDPR.
Processing — anything we do with personal data, including collecting, storing, organising, using, sharing, and deleting it.
Controller, processor, sub-processor — have the meanings given in Article 4 GDPR.
LESA Stories — LESA’s story-creation system, combining AI generation with human editorial review (Section 8).
LESA Playground (Leikvöllurinn) — LESA’s in-app reward system, in which the child automatically unlocks cosmetic items by reading, keeping streaks, and reaching goals; there is no spendable currency. Governed by the Terms & Conditions.

Thank you

Thank you for trusting LESA with your child’s reading journey. If anything in this Privacy Policy is unclear or you would like to discuss it with us, please write to privacy@lesa.app — a real person will reply.