Privacy Notice

1. Who we are

Hello, Middle School is operated by Sheley Bressler ("we", "us"). We act as the data controller for personal data collected through the Service, which means we decide how and why your data is processed.

2. What we collect and why

• Account data (email, password hash) — to create and secure your account. Legal basis: contract performance.
• Progress data (missions completed, favorites, in-app choices) — to deliver the Service and remember where you left off. Legal basis: contract performance.
• Support messages — to respond to questions. Legal basis: legitimate interests (helping our customers).
• Device and usage data (IP address, browser type, pages visited, basic telemetry) — for security, fraud prevention, and product improvement. Legal basis: legitimate interests.
• Payment-related data — handled by Paddle, our Merchant of Record. We receive limited transaction metadata (order ID, amount, status) but not full card details.

3. Who we share data with

We share personal data only with the categories of recipients below:

• Paddle — our Merchant of Record, for the sale of the Service, payments, subscription management, tax compliance, and invoicing.
• Service providers / subprocessors — hosting, database, analytics, email delivery, and customer support tooling, under appropriate agreements.
• Professional advisers — legal and accounting professionals, when needed.
• Authorities — where required by law or to protect rights and safety.

We do not sell your personal data.

4. How long we keep it

We keep personal data only as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. When no longer needed, we delete or anonymize it.

5. Your rights

Depending on where you live, you may have the right to access, correct, delete, or port your personal data; to restrict or object to processing; and to withdraw consent. For users in the UK/EEA, you also have the right to lodge a complaint with your local data protection authority, and we aim to respond to rights requests within one month. To exercise a right, contact us through the Service.

6. International transfers

Your data may be processed in countries outside your own, including the United States. Where required, we use appropriate safeguards (such as Standard Contractual Clauses or adequacy decisions) to protect your data during international transfers.

7. Security

We use appropriate technical and organizational measures — including encryption in transit, access controls, and secure hosting — to protect personal data. No system is perfectly secure, but we take this seriously.

8. Cookies

We use essential cookies to keep you signed in and to operate the Service. We may use limited analytics cookies to understand how the Service is used. You can manage cookies through your browser settings.

9. Children

The Service is intended for families. Accounts must be created and managed by a parent or guardian for users under 18. If you believe a child has provided us data without appropriate consent, contact us and we'll take steps to remove it.

10. Changes to this notice

We may update this notice from time to time. Material changes will be posted here with a new "last updated" date.

11. Contact

Questions about this notice or your data? Reach out through the Service. For billing data handled by Paddle, visit paddle.net.