Privacy Notice
Version v1.0 · Brinley North · Operated by LumaNavi LLC
Under independent counsel review. The current version governs until revised.
A note to parents
This notice is written for you — the parent or guardian who set up your child’s account. Brinley North was designed to collect as little information about your child as possible, to never use it for advertising or behavioral tracking, and to leave you in control of the account at all times.
Every commitment below is built into how the product works, not only stated here. Your child’s data is not a product.
Who we are
Brinley North is a family routine and growth platform operated by LumaNavi LLC. For any question about this notice, or to exercise your rights as a parent or guardian, contact hello@lumanavi.com.
LumaNavi LLC · 2800 E. Enterprise Ave, STE 333, Appleton, WI 54913
What we collect about your child
- Display name — entered by you when creating the profile, so the app can address your child by name. Stored encrypted.
- Birth year — entered by you, used to show age-appropriate content. Stored encrypted. We do not collect a full date of birth.
- Device access credentials — generated by us when you grant a device access, to authenticate that device.
- Session and activity records — generated during use, to maintain the session and record routine progress.
We do not collect your child’s full name, address, phone number, or email address; photographs; precise geolocation; biometric data; behavioral profiles, interest graphs, or advertising identifiers; or cross-app tracking identifiers.
How we obtain your consent
Before a child profile is created, we obtain verifiable parental consent by email. You receive a confirmation link at the address on your parent account and must click it. The link is single-use and expires 72 hours after it is sent. Only when you confirm is the child profile created, and we record that consent alongside it.
Your child cannot create an account, authorize a device, or consent on their own behalf. Your authorization is required at every step.
How we use it
Only to operate the platform for your family: to show your child’s profile, authenticate their device, record routine progress so you and your child can see it, and keep the service running and secure. We do not use your child’s information for advertising or behavioral analysis, and we do not sell it or share it with advertising networks, data brokers, or third-party analytics platforms.
Who processes it with us
We use infrastructure providers that process data only to operate the platform on our behalf, and not for their own purposes:
- Supabase, on Amazon Web Services (US East, Ohio) — database and authentication
- Vercel — application and API hosting
- Resend — transactional email, including the consent confirmation
- Stripe and RevenueCat — subscription billing. These process your payment information as the parent account holder; they receive no child data.
How long we keep it
- Display name and birth year — until you delete the profile or close the account.
- Child sessions — expire 30 days after issue.
- Device access grants — expire 90 days after issue, or when you revoke them.
- Consent confirmation links — expire 72 hours after being sent, and the staging record is destroyed as soon as consent is confirmed.
- Inactive child profiles — subject to a platform retention period of 365 days.
- Records of consent — retained as the compliance record that permitted collection.
Your rights as a parent
You may review the information we hold about your child, correct it, delete the profile and its associated data, revoke device access, and refuse further collection entirely.
Deleting your child’s profile and revoking a device you can do yourself, from your parent dashboard. Both take effect immediately. Deleting the profile also withdraws your consent and stops all further collection.
To review or correct your child’s information, or to ask us to handle a deletion for you, email hello@lumanavi.com and we will action it and confirm back to you within 30 days.
Children’s privacy laws
United States — COPPA. Brinley North is built to meet the Children’s Online Privacy Protection Act and the FTC’s COPPA Rule (16 C.F.R. Part 312): we collect only what is listed above, use it only as described, and give parents access, correction, and deletion rights.
Where the service is offered. Brinley North is offered in the United States and is not directed to users in the European Union, the EEA, or the United Kingdom. All data is stored and processed in the United States. If we begin offering the service in those regions, we will publish the additional disclosures their law requires before doing so.
Security
Your child’s name and birth year are encrypted at rest. Traffic between the apps and our servers is encrypted in transit. Access controls restrict which systems can read child data, and sessions and device grants expire on the schedule above. No system is perfect — if you believe there has been unauthorized access to your account, contact hello@lumanavi.com immediately.
Changes to this notice
If we make a material change — collecting new types of information, or using existing information differently — we will notify you before it takes effect and obtain fresh parental consent where the law requires it. We will not reduce your rights without your consent.
Already have an account? View your acknowledgment status →