隐私政策
本政策说明 Baby PhD 在提供 CASI 快速评估、CASI 深度评估、数字报告、邮件找回、课程兴趣登记和相关支持时如何处理信息。CASI 主要面向父母、监护人和负责照护儿童的成年人，不面向儿童独立创建账户。
1. 我们可能处理的信息
- 家长或监护人主动填写的联系邮箱、国家/地区、城市及课程兴趣信息。
- CASI 快速评估或 CASI 深度评估中的年龄段、家庭科技使用情况、行为与边界选择、报告分析结果。
- 家长/监护人同意记录，包括同意版本、身份角色声明和时间。
- 支付状态、订单关联标识、退款/撤权状态。完整卡号或 PayPal/支付宝账户凭据由支付服务商处理，Baby PhD 不直接保存完整支付凭据。
- 为保障网站安全而产生的必要技术日志、访问时间、限流与错误记录。
2. 使用目的与处理原则
- 生成并交付 CASI 评估结果和数字报告。
- 验证购买权限、恢复报告访问、发送必要的服务邮件。
- 处理退款、支付争议、安全事件和客户支持。
- 在去标识化或聚合层面改进评估质量、数据质量和研究判断。
我们遵循数据最小化、目的限制、访问控制和隐私默认保护原则。未经额外合法依据，不将可识别个人信息用于公开研究结论或跨情境行为广告。
3. 儿童与未成年人
CASI 设计为由家长、监护人或获授权的负责成年人填写。我们不要求儿童自行创建账户，也不主动要求提交儿童姓名、照片、语音、学校或精确住址。新的 CASI 深度评估在开始前要求家长/监护人完成身份声明与儿童相关信息处理同意。更多内容见《儿童个人信息保护说明》。
4. 美国儿童隐私
本服务当前面向家长和监护人，而不是供13岁以下儿童独立提交个人信息。我们不会把当前的家长/监护人声明机制表述为适用于所有 COPPA 场景的“可验证家长同意”。如果未来上线直接面向13岁以下儿童、并收集其个人信息的功能，我们将在收集前增加适用的直接家长告知与可验证家长同意流程。
5. 保存与安全
我们采用服务器端权限验证、签名会话、数据环境隔离、限流、加密或散列、安全响应头等合理措施减少未经授权访问。信息仅在实现服务、履行法律义务、处理争议和安全需要所必需的期限内保存。
6. 第三方服务与国际数据传输
服务可能使用 Netlify（托管与函数）、Supabase（数据服务）、Resend（邮件）、PayPal 与支付宝（支付）等供应商。根据用户所在地和供应商基础设施，数据可能在用户所在国家/地区之外处理。我们会在适用法律要求下评估跨境传输依据、合同保护、告知或同意义务。第三方在其职责范围内适用其自身条款和隐私规则。
7. EEA / 欧盟与英国用户
在 GDPR 或 UK GDPR 适用时，我们会根据具体处理目的使用适用的合法基础，并遵循数据保护设计与默认保护原则。你可能拥有访问、更正、删除、限制、可携带、反对、撤回同意及向监管机构投诉等权利。详情见《数据权利与隐私请求》。
8. 美国州隐私
在适用州法范围内，你可能拥有知情、访问、删除、更正、获取副本及选择退出某些出售或共享的权利。Baby PhD 当前不出售个人信息，也不将 CASI 可识别个人信息用于跨情境行为广告。
9. Cookie 与本地存储
当前网站不启用 Google Analytics、Meta Pixel 等广告追踪工具，但使用必要的浏览器本地存储维持购买会话、报告恢复和评估状态；主动使用第三方支付组件时，支付服务商可能使用其必要 Cookie。详见《Cookie 与本地存储说明》。
10. 你的权利
你可以联系我们申请查询、更正、删除、限制或反对适用的处理，或撤回基于同意的处理。部分记录可能因财务、反欺诈、争议处理、安全或法律义务继续保存。
11. 联系方式
隐私与数据请求：privacy@babyphdsafety.com
本政策提供当前产品的一般隐私说明。具体司法辖区可能要求额外告知、合同安排、代表指定或监管登记；Baby PhD 会根据正式运营地区继续补充。
Privacy Policy
This policy explains how Baby PhD handles information when providing CASI Quick Assessments and CASI In-Depth Assessments, digital reports, report recovery, course-interest forms, and related support. CASI is primarily designed for parents, guardians, and responsible adults caring for children, not for children to create accounts independently.
1. Information we may process
- Contact email, country/region, city, and course-interest information provided by a parent or guardian.
- Age group, family technology-use patterns, behavior and boundary responses, and report analysis generated through CASI.
- Parent/guardian consent records, including consent version, role attestation, and acceptance time.
- Payment status, order-linked identifiers, refunds, and access-revocation status. Full card details or PayPal/Alipay account credentials are handled by the payment provider and are not stored directly by Baby PhD.
- Necessary technical logs for security, rate limiting, troubleshooting, and service reliability.
2. Purposes and processing principles
- Generate and deliver CASI results and digital reports.
- Verify purchase access, restore report access, and send necessary service emails.
- Handle refunds, disputes, security events, and support requests.
- Improve assessment and data quality using de-identified or aggregate information.
We apply data minimization, purpose limitation, access controls, and privacy-protective defaults. We do not use identifiable personal information for published research findings or cross-context behavioral advertising without an additional lawful basis.
3. Children and minors
CASI is designed to be completed by a parent, guardian, or authorized responsible adult. We do not ask children to create accounts and do not intentionally request a child’s name, photo, voice, school, or precise home address. New CASI In-Depth Assessments require a parent/guardian role attestation and child-related data-processing consent before the assessment starts. See the Children’s Privacy Notice.
4. U.S. children’s privacy
The current service is directed to parents and guardians rather than children under 13 submitting personal information independently. We do not represent the current parent/guardian attestation as a substitute for verifiable parental consent in every COPPA-covered scenario. If we later offer child-directed features that collect personal information directly from a child under 13, we will add applicable direct parental notice and verifiable parental consent before collection.
5. Retention and security
We use server-side authorization, signed sessions, environment separation, rate limiting, encryption or hashing, and browser security headers to reduce unauthorized access. Information is retained only as long as reasonably necessary for service delivery, legal obligations, dispute handling, and security.
6. Service providers and international transfers
The service may use Netlify, Supabase, Resend, PayPal, and Alipay. Depending on your location and provider infrastructure, information may be processed outside your country or region. Where applicable law requires it, we assess transfer mechanisms, contractual safeguards, notices, or consent requirements. Providers also operate under their own applicable terms and privacy responsibilities.
7. EEA / EU and UK users
Where the GDPR or UK GDPR applies, we use an appropriate lawful basis for each processing purpose and apply data protection by design and by default. You may have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority. See Data Rights & Privacy Requests.
8. U.S. state privacy
Where applicable state law grants such rights, you may have rights to notice, access, deletion, correction, a copy of data, and opt out of certain sale or sharing. Baby PhD currently does not sell personal information and does not use identifiable CASI personal information for cross-context behavioral advertising.
9. Cookies and local storage
The site currently does not enable Google Analytics, Meta Pixel, or advertising trackers. Necessary browser storage is used for purchase sessions, report recovery, and assessment state. Third-party payment providers may use necessary cookies when you actively use their components. See the Cookie & Local Storage Notice.
10. Your rights
You may contact us to request access, correction, deletion, restriction, or objection where applicable, or to withdraw consent-based processing. Certain records may need to be retained for financial, anti-fraud, dispute, security, or legal reasons.
11. Contact
Privacy and data requests: privacy@babyphdsafety.com
This policy is a general notice for the current product. Specific jurisdictions may require additional notices, contractual arrangements, representative appointments, or regulatory registrations as operations expand.