Legal

Privacy Policy

Last updated: May 8, 2026

1. Who we are

Caricula is an exam preparation platform built in Jamaica 🇯🇲 for students across CARICOM countries. We help families prepare for PEP, CSEC, and CAPE examinations. This policy explains how we handle the personal information of students, parents, schools, and teachers who use Caricula.

Data controller: Caricula (operating in Jamaica). Contact: hello@caricula.com.

2. What we collect

When you create an account or use Caricula, we collect:

Account info — full name, email, country, program (PEP/CSEC/CAPE), grade level. For students under 13, this is provided by a parent or school.
Authentication data — Google account email if you sign in with Google; otherwise a password we hash and never store in plaintext.
Learning activity — practice question answers, mock exam results, AI tutor conversations, time spent on lessons. This drives your progress dashboard and predicted grades.
Device + technical data — browser type, IP address (truncated for analytics), device type. Used for security and to keep the app fast on Caribbean mobile networks.
Payment metadata — if you subscribe, we store the plan and billing cycle. We never store credit card numbers; payments are handled by Stripe and WiPay.

3. How we use it

To provide the core service — past papers, AI tutor, progress tracking, lesson library.
To send a weekly progress email to parents (you can turn this off in settings).
To improve the platform — anonymous, aggregated stats only.
To detect abuse, fraud, and protect student safety.
To respond when you contact support.

We do not sell your data, share it with advertisers, or use it to train third-party AI models on personally identifying content.

4. Children & student data (under 13)

Caricula serves students as young as Grade 4 (PEP). For users under 13, an account must be created by a parent, guardian, or school. We follow child-safety best practices aligned with COPPA (United States), the UK Children's Code, and Jamaica's Data Protection Act 2020:

No advertising. Ever.
No third-party tracking pixels in student-facing surfaces.
Parents can request a copy of their child's data or full deletion at any time.
AI tutor conversations are reviewed by safety filters before being shown.
We do not use student-generated content to train external AI models.

5. AI tutor & third-party processors

Our AI tutor is powered by Anthropic's Claude models. When you send a question, the message is forwarded to Anthropic to generate a response. Anthropic does not train its public models on this content (Anthropic's commercial API terms apply).

Other processors we use:

Supabase — database & authentication (US/EU regions).
Vercel — hosting & CDN.
Stripe — international card payments.
WiPay — Caribbean local payments (JMD, TTD, etc.).
Resend — transactional email delivery.

6. Where your data lives

Caricula stores data on Supabase's infrastructure. Backups are encrypted at rest. We are working toward Caribbean data residency for school customers; until then, primary storage is in the US East region.

7. Your rights

You can, at any time:

Access a copy of your account data.
Correct anything that's wrong.
Delete your account and all associated data permanently.
Export your progress data in a portable format.
Withdraw consent for non-essential email.

To exercise any of these rights, email hello@caricula.com from the address on your Caricula account. We respond within 30 days.

8. Cookies

We use a small number of essential cookies for authentication and to remember your country/program selection. We do not use advertising cookies or cross-site tracking.

9. Security

All traffic is HTTPS. Passwords are hashed (bcrypt). Database row-level security enforces that students can only see their own data, parents can only see their children's data, and schools can only see their enrolled students. We follow industry best practices and maintain an internal incident response plan.

10. Changes to this policy

We'll update this page when policies change. Material changes (anything affecting how we use your data) will be communicated via email at least 14 days in advance.

11. Contact

Questions, complaints, or data requests: hello@caricula.com.