Leo, named in this document: A computer program, not a person. Named for Leonhard Euler.

Privacy Notice for Parents and Legal Guardians

1. Who we are and how to reach us

Swiss eduGLOBE AG is a Swiss company. We run the Euler100 World Junior Mathematics Championship at euler.swiss and the STELLA training platform at stella.academy. Together with the services on them we call these the "Platform". We decide how and why personal data is processed on the Platform, so we are the controller under Swiss law and the responsible party under South African law.

Postal address: Schweizer Bildungsglobus AG (Swiss eduGLOBE AG), c/o Benediktiner Kloster Disentis, Via Claustra 1, 7180 Disentis/Mustér, Switzerland, UID CHE-219.746.858 (correspondence: Leimbachstrasse 153, 8041 Zürich). Privacy contact: [PLACEHOLDER: privacy contact name], privacy@euler.swiss. Information Officer (South Africa): [PLACEHOLDER: Information Officer name], privacy@euler.swiss, registered with the Information Regulator under reference [PLACEHOLDER: registration reference].

[COUNSEL: confirm the Information Officer arrangement and registration before publication (POPIA s. 55–56).]

In this notice "we" and "us" mean Swiss eduGLOBE AG. "You" means the parent or legal guardian who holds the account (the "Account Holder"). "Your child" means the child registered under your account (the "Child"). "Euler ID" or "E-ID" means the permanent code we give every Child. "Faculty Member" means an adult who teaches, contributes problems or tutors on the Platform. "Leo" is the AI tutor. "Eulos" are the points a Child earns on the Platform.

2. Who this notice is for

This notice is written for you, the Account Holder. It describes what we do with your data and with your child's data. Your child has a separate Privacy Notice for Children, written to be read by a child of about eleven. It is shown at the child's login and in the hint panel. Both notices describe the same processing. Where they differ, this notice is the fuller statement.

A parent or legal guardian always opens the account. A child cannot create an account. You act in your own name for your own data, and as your child's legal representative for your child's data. This is the model we apply to every family, in every country, whatever the local age of consent, because the Platform is designed for children under 13.

3. What we collect and why

We collect only what the Platform needs. The table below lists each category, why we process it, whether you have to supply it, and the justification under Swiss law and the basis under POPIA. Under Swiss law private processing does not require a legal basis; it must respect the principles of the Federal Act on Data Protection (FADP) and must not unlawfully breach personality rights. Where we rely on your consent we say so, and you can withdraw it as described in section 15.

3.1 Account Holder data

We do not ask for your legal name, postal address, telephone number or date of birth at registration. We ask for your legal name only where it is genuinely needed: as the cardholder name when you pay (held by the payment provider, not by us) or for nomination and travel to the finale, under rules to be published separately.

3.2 Child data

3.3 Activity data

Activity data is stored in a separate activity store keyed only on the Euler ID. The link between the Euler ID and your account sits in a separately controlled identity store and is read only when you view your own child. We call the activity store pseudonymised for that reason.

3.4 Technical data

We use no analytics service, no advertising technology, no tracking pixels and no third-party scripts, with one exception: to stop automated spam, the public forms (registration, contact, feedback, the school door, the Faculty sign-up, the password-reset request, the waiting list) run a human check by Cloudflare, Inc. (Turnstile), which sees your IP address and browser signals for that moment and nothing you type; it never appears on a child's screen or on a form you fill while logged in. Fonts are served from our own servers. See the Cookie and Local Storage Statement.

3.5 Payment data (not collected until paid plans open)

No payments are taken at launch. No card form exists on the live Platform. When paid plans open, payments will be handled by Stripe. We will then receive the plan you chose, the status of your subscription, a receipt reference and the Euler IDs the plan covers. Stripe will hold the cardholder name and card details; we never see a card number. Paying is also a tier-3 verification event for your account (section 6). This section and the Paid Plans and Refund Policy will be updated before the first sale.

3.6 Faculty data

Adults who join the Euler Faculty have their own account and are addressed in the Faculty Terms, which include a data protection section for Faculty Members. What matters to you: Faculty Members have real names and countries shown publicly, which is right for adults and never applies to a child. When tutoring opens, a tutor you book will see your child's alias and learning record for the lessons booked, and only with your tier-3 consent.

4. What we never collect from a child

We never ask a child for, and have no field to store, any of the following:

• a surname or any real name beyond the first name you give us;
• a full date of birth;
• a photograph, video or voice recording;
• an e-mail address, telephone number, postal address or any contact detail;
• a location, beyond the country you tell us;
• an identity document, or a copy or image of one;
• free-text messages to other users (there is no messaging between users);
• uploads of any kind;
• sensitive data of any kind: health, religion, ethnicity, biometrics.

These are standing rules in how we build the Platform, not just promises in a notice. If a feature ever seemed to need one of these, we would stop and reconsider the feature. We do not sell personal data, we do not use it for advertising, and we do not let anyone else do so.

5. The Euler ID and public leaderboards

Every child receives a permanent Euler ID. Public leaderboards on euler.swiss show, left to right: Euler ID (always), alias (only with your separate consent, hidden by default) and country (always), with the child's rank. Nothing else. There are no child profile pages, no real names and no photographs. The school is never shown next to a child on any public surface, in any form. Aggregate school boards show schools in rank order only, and only once a school has at least five participating children, so that no child can be picked out.

Publishing the Euler ID, rank and country is a disclosure to the public. We therefore name it in the tier-1 consent you give at registration, not only here. [COUNSEL: the memo recommends that the tier-1 consent text name the board. This notice assumes that change is made in the consent flow. Confirm whether the board needs a separate tick to be "specific" under POPIA s. 35(1)(a).]

A reader of a board can see that a child in a given country, born in a given year, holds a given rank. They cannot see who the child is. The Euler ID carries the birth year. [COUNSEL: confirm whether the birth-year component of the public E-ID should be reviewed (ARC-22), given the re-identification vector of alias plus birth year plus a school a child mentions elsewhere.]

Alias on the board (tier 2). The alias appears only after you switch on a separate toggle on your dashboard and confirm it by a link sent to your verified e-mail. The toggle reads:

"[Child]'s alias, [alias], will appear next to their Euler ID, country and rank on a public leaderboard. I can withdraw this at any time; withdrawal removes the alias from the board and its history immediately."

The alias must not be your child's real name or a name that identifies them, and it must not be offensive; we screen aliases for both. Withdrawal is one control on the same screen. It takes effect at once and removes the alias from the board and from every past board.

Withholding from boards altogether. You can ask that your child not appear on any public board at all while still playing and still seeing their own Euler Index. The control is on your dashboard. [COUNSEL: the memo recommends that this withhold be exposed to parents (today it is an administrator control, A-09). Confirm whether it is needed for consent to be "voluntary" under POPIA and proportionate under FADP Art. 6 para. 2. The Gap List records it as a platform change.]

6. Verification tiers and what each unlocks

We verify in proportion to what is at stake.

What the school does and does not do. The school confirms that your child is enrolled there. The school does not give consent on your behalf and cannot. The school never receives a list of participating children from us. The person at the school who confirms enrolment acts in their own professional capacity, not for us. [COUNSEL: confirm the school's role under POPIA and whether a short data-sharing letter with each pilot school is advisable.]

7. Leo, the AI tutor

Leo is a computer program that gives hints and, later, coaching. Wherever Leo appears, this label is shown: "A computer program, not a person. Named for Leonhard Euler." Leo appears only in the hint panel after your child asks for help, and, when the family plan exists, when coaching a problem your child missed. Nothing of Leo sits on the problem itself. Where Leo is not yet switched on for your child's path, the panel says so.

What is sent to the model. When your child asks Leo, our server sends to the model provider: the problem, your child's attempt, the correct answer, and a short summary of recent work with every label removed (for example "strong on multiplication patterns, recurring error in place value"). The tone of that summary is warm, but it carries no identity.

What is never sent. No first name, alias, Euler ID, birth year, school, country, parent detail or e-mail address is ever sent to the model. A single function assembles every model call, and an automated test fails the build if any identifier reaches it. For the pilot, your child chooses from set prompts such as "Give me a hint" rather than typing freely. If free text is ever allowed, it will be filtered before it leaves our servers, and the child notice tells your child not to tell Leo their name, school or where they live.

Where the model runs. The model provider is Anthropic, PBC, United States. Because no personal data is in the call, no personal data leaves Switzerland through Leo. We still name Anthropic as a recipient of de-identified content, for transparency. Under our agreement with Anthropic, inputs and outputs are not used to train models and are deleted within 30 days. [COUNSEL: confirm the contractual position, including whether a zero-retention arrangement should be requested.]

A person is always available. Leo is never the only route. A worked solution is shown by default for a missed problem, you see every attempt on your dashboard, and you can write to us or, when tutoring opens, book a Faculty Member.

8. Machine review of problems

Problems in the problem bank are reviewed before any child sees them in a scored set. The first stage is an automated review by the same model provider: the problem is solved twice, checked for ambiguity and duplicates, and its level estimated. The author's name is stripped before the call. No child data is involved. Faculty Members then review by hand; the Faculty Terms describe that process. On your adventure report each problem carries a label showing its review tier, and a one-tap control for you, not your child, to tell us "something is wrong here". Two such flags suspend the problem from scored sets until a person looks at it.

9. Parent reports

After every adventure of ten problems a record is available on your dashboard: the ten problems, your child's answer, the correct answer, right or wrong, and the time taken. This record is included for every family and is never sold back to you. Access to your child's record is your right. Later paid plans may offer delivery (push or e-mail at a rhythm you choose) and interpretation (what the misses have in common, what to practise next), not access. Reports go to you, never to your child directly, and never through a third-party analytics service.

10. E-mail we send and why

We send only transactional e-mail: verification links, consent confirmations, security notices, deletion confirmations, and the short report line ("[Alias] finished Adventure 3, 8 of 10. See the report."). Full questions and answers stay behind your login, never in an inbox. We never send e-mail to a child; a child has no e-mail address on the Platform.

We send no marketing e-mail unless you opt in. The only marketing capture at launch is "tell me when paid plans open", which you may leave on a paid-surface page. If you do, you may stop at any time by the link in each message or by writing to privacy@euler.swiss. Each message identifies us as sender. [COUNSEL: confirm that this capture follows POPIA s. 69 and Regulation 6 (Form 4), and UWG Art. 3 para. 1 lit. o.]

E-mail is sent through Mailpro, a Swiss provider (section 12).

11. Cookies and local storage

The Platform uses only cookies and local storage that are technically necessary: a session identifier, a CSRF token, your language and your child's adventure-in-progress state. There are no analytics or advertising cookies and no third-party cookies. For that reason no cookie banner is shown. The Cookie and Local Storage Statement lists each item, its lifetime, and how to refuse it in your browser, with the consequence that login will not work.

12. Who receives data: our sub-processors

We share personal data only with the service providers below, bound by contract to process it on our instructions. The full Sub-processor List and Records of Processing is published separately and we update it before any change.

We do not share personal data with advertisers, data brokers, schools (beyond the enrolment confirmation the school itself gives), sponsors or any other third party. We disclose data to authorities only where the law requires it and we would tell you unless the law forbids it.

13. Where data is stored, and transfers

All personal data on the Platform is stored and processed in Switzerland. Backups are held in Switzerland.

If you live in South Africa. Your data and your child's data travel from South Africa to our servers in Switzerland when you register and use the Platform. Switzerland has a federal data protection law, the FADP, which provides protection substantially similar to POPIA, and Switzerland is a party to the Council of Europe Convention 108. We ask for your explicit consent to this at registration, and you can withdraw it by deleting the account. [COUNSEL: confirm whether POPIA s. 72 or s. 57(1)(d) applies to a Swiss responsible party collecting directly from South African parents; whether Switzerland is "adequate" on a self-assessment under s. 72(1)(a); whether a precautionary s. 58 notification should be filed; and whether the transfer consent line in the tier-1 flow is the right fallback. This notice assumes the consent line is included.]

Other countries. No personal data leaves Switzerland except as named in section 12: adult payment data to Stripe in Ireland (and its US parent under the Swiss–U.S. Data Privacy Framework) once paid plans open, and de-identified content to Anthropic in the United States. The United States is recognised by the Swiss Federal Council for recipients certified under the Swiss–U.S. Data Privacy Framework; where a recipient is not certified, we rely on standard contractual clauses recognised by the FDPIC.

When your child is in the EU/EEA or the United Kingdom (not at launch). Before any child there registers we will appoint a representative in the Union and in the United Kingdom and update this notice. Switzerland is recognised as adequate by the European Commission and the United Kingdom, so the inbound transfer is permitted.

When your child is in the United States (not at launch). Before any child there registers we will adopt the parental consent methods and direct notice required by the Children's Online Privacy Protection Act and update this notice and the consent flow.

14. How long we keep data

Nothing is kept indefinitely. We review this schedule at least once a year.

15. Security

We protect data with measures appropriate to the risk: encryption in transit and at rest; passwords and PINs stored only as argon2id hashes; server-side sessions; rate limits on login and PIN entry; separation of the identity store from the activity store so that activity records carry no parent key; access to the identity link only when you view your own child; an audit log of every action on a child's record; secrets held outside the build environment; and an automated test that blocks any build in which an identifier could reach the AI model. We do not publish details that would help an attacker.

If a breach is likely to put you or your child at high risk we will notify the FDPIC as quickly as possible and inform you where that is needed for your protection, and we will inform the Information Regulator and you where POPIA s. 22 requires.

16. Your rights and your child's rights

You have the following rights for your own data and, as legal representative, for your child's data:

• Access. See what we hold. Your dashboard already shows every attempt your child has made; you may also ask for a copy of everything.
• Correction. Have inaccurate data corrected. You can change your child's alias, school and country yourself.
• Deletion. Delete your child's account and data, or your own, at any time from your dashboard. Deletion is complete within 30 days; backups roll off within 90.
• Objection. Object to a processing, and in particular to your child appearing on public boards (section 5).
• Portability. Receive the data you supplied and your child's activity record in a common machine-readable format (FADP Art. 28; GDPR Art. 20 where applicable). [COUNSEL: confirm the scope of portability for a child's record.]
• Withdrawal of consent. Withdraw any consent you have given, at any time, with effect for the future. Withdrawing the alias consent clears the alias at once. Withdrawing the tier-1 consent means deleting the account.
• Complaint. Complain to us and to a supervisory authority (below).

How to exercise them. Use the controls on your dashboard, or write to privacy@euler.swiss from your registered e-mail address. We answer within 30 days. For requests by e-mail we confirm identity by a link to your registered address, and we may ask one further question if a request is unusual. Requests are free. Where the law allows a fee for repeated requests we will tell you in advance and you may withdraw the request. We will never treat you or your child less favourably for exercising a right.

Your child's own rights. We treat every child on the Platform as acting through you, because of the children's ages. A child who becomes capable of forming their own judgement on these matters, and in any case a former participant who has reached the age of 16, may exercise these rights themselves, including deletion of records that were created when they were a child. We will verify such a request with care. [COUNSEL: confirm the treatment of a child's strictly personal rights under Art. 19c ZGB and the age from which we should accept a direct request.]

Complaint routes.

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. [COUNSEL: confirm address.]
• South Africa: the Information Regulator, [PLACEHOLDER: address and complaints e-mail], www.inforegulator.org.za. You have the right to lodge a complaint with the Regulator under POPIA s. 74.
• EU/EEA and United Kingdom (when children there join): the data protection authority of your country of residence, and the Information Commissioner's Office in the United Kingdom.

17. Automated decisions and profiling

No decision with legal effect, or that significantly affects you or your child, is taken by automated means alone.

The Euler Index. The Ei is computed automatically from your child's level, accuracy and speed. It is shown to your child and to you, and it determines rank on boards. It is a measure of maths work on the Platform, not an assessment of your child as a person. It does not influence advertising (there is none), pricing or any other decision. [COUNSEL: confirm that the Ei and ranking are not "high-risk profiling" under FADP Art. 5 lit. g.]

Integrity. If our systems detect a pattern that suggests a breach of the Codes of Conduct, a person reviews it before any suspension. The Terms of Use for Parents describe the review and the appeal to a person.

Leo and machine review. Leo gives hints; it does not grade, rank or decide anything. The machine review of problems decides only whether a problem is returned to its adult author.

No behavioural advertising, no profiling for marketing, ever.

18. Children's rights exercised by the parent

Under Swiss law a child acts through their legal representative. You, as the Account Holder, exercise your child's rights under this notice. If you share parental responsibility with another person, you confirm at registration that you are entitled to act. If we learn that the other holder of parental responsibility objects, we will suspend the account until you resolve the matter between you or a competent authority decides. [COUNSEL: confirm that one parent's registration suffices under Art. 304 para. 2 ZGB and what we must do on notice of a dispute.]

19. Our commitment

We apply the strongest standard that applies to any of our families to all of them. We do not lower protections by country. We will do a data protection impact assessment before any new processing of children's data, and we have done one for the pilot.

20. Changes to this notice

We will tell you by e-mail at least 30 days before any change that affects your child's data, with a plain summary of what changed. Previous versions are kept and can be requested. If you do not accept a change you can delete the account before it takes effect.

21. Governing language

This notice is written in English. German, French and Italian versions will be published once counsel has cleared them. Until then the English text governs. If a translation differs from the English, the English applies, except where the law of your country requires otherwise.

Questions: privacy@euler.swiss.

Related: Impressum · Privacy Notice for Children · Terms of Use for Parents and Legal Guardians · Cookie and Local Storage Statement · Sub-processor List and Records of Processing · Faculty Terms (outline) · Paid Plans and Refund Policy (outline). Questions: privacy@euler.swiss.