Last updated: April 1, 2026 · ~12 min read
We don't sell your data. We don't run ads.
Your learning data is used only to generate your personalized lessons. It is never used to train AI models.
| What we collect | Why | Who processes it |
|---|---|---|
| Email and password | Account creation and authentication | Our authentication provider |
| Billing information | Payment processing | Stripe |
| Onboarding answers and learning goals | Personalizing your learning paths | Droplet Learn, our AI content provider |
| Learning interactions (views, saves, skips, completions) | Generating relevant content and tracking progress | Droplet Learn |
| Reflections and experiment notes | Personalizing lessons and enabling your journaling | Droplet Learn, our AI content provider |
| User preferences | Customizing your experience | Droplet Learn |
| Device and usage data | Maintaining security and improving the service | Our hosting and infrastructure providers |
In plain language: We collect only what we need to run Droplet Learn. We don't sell your data. We don't run ads. Your learning data is sent to an AI provider (Anthropic) to generate your personalized lessons, but it is never used to train AI models.
Droplet Learn is operated by Maple Spark Labs Inc., a limited liability company registered in Ontario, Canada, with its principal place of business in Toronto, Ontario, Canada. Full mailing address is available upon request for formal legal correspondence.
For privacy matters, you can reach our designated Privacy Officer at:
Throughout this policy, "Droplet Learn," "we," "us," and "our" refer to Maple Spark Labs Inc. "You" and "your" refer to you, the individual using our service.
We collect personal information in three ways: directly from you, automatically when you use the service, and from third-party service providers.
When you create an account and use Droplet Learn, you voluntarily provide:
When you use Droplet Learn, we automatically collect:
We do not purchase data about you from data brokers or other third-party sources.
We use your personal information for the following specific purposes:
In plain language: We use your data to make Droplet Learn work for you — to create your personalized lessons, track your progress, and handle payments. We analyze anonymized patterns to improve the product. We never use your personal data for advertising or sell it to anyone.
This section explains exactly how your data interacts with artificial intelligence. We believe you deserve full transparency about this process.
Droplet Learn uses the Anthropic Claude API to generate personalized educational content. Here is precisely what occurs:
Under our commercial API agreement with Anthropic, your data submitted through Droplet Learn is never used to train Anthropic's AI models. Anthropic's Commercial Terms of Service explicitly state: "Anthropic may not train models on Customer Content from Services." This is a firm contractual commitment, not a policy that can be quietly changed.
Our AI provider retains processing logs for a limited period as required for safety and abuse prevention, after which they are deleted. Their current retention practices are described in their published privacy documentation.
When you write reflections or experiment notes, this text is stored in our database. If your reflections are used as context for generating future lessons, they follow the same AI processing pipeline described above. You can delete your reflections at any time.
In plain language: Your learning goals and progress get sent to our AI provider to create your lessons. They keep this data briefly for safety checks, then delete it. They never use it to train their AI. We never send your email, name, or payment info to the AI.
Droplet Learn is operated from Canada, but several of our service providers are based in the United States. This means your personal information is transferred to, stored in, and processed in the United States.
What this means for you: The United States has different privacy laws than Canada. Under US law, including the USA PATRIOT Act and the Foreign Intelligence Surveillance Act (FISA), US government authorities may access data held by US companies under certain circumstances. While we cannot prevent such access, we take the following steps to protect your data:
Under PIPEDA, we remain fully accountable for your personal information even when it is processed by a third party in another country.
In plain language: Your data is stored and processed on servers in the United States by our service providers. US privacy laws differ from Canadian ones. We protect your data through encryption and strict contracts with these providers.
We retain your personal information only as long as necessary to fulfill the purposes described in this policy or as required by law.
| Data type | Retention period | Reason |
|---|---|---|
| Account information | Until you delete your account | Required to provide the service |
| Learning paths, interaction history, reflections | Until you delete your account (or delete individual items) | Required to personalize your experience |
| Onboarding responses | Until you delete your account | Required for curriculum personalization |
| Billing records | 7 years after the transaction | Canadian tax law (Income Tax Act) requires retention of financial records |
| Server logs | Limited period, typically no more than 90 days | Security monitoring and debugging |
| AI processing logs | Limited period per provider's safety requirements | AI provider's trust and safety requirements |
| Support communications | Reasonable period for quality assurance | Quality assurance and dispute resolution |
| De-identified, aggregated analytics | Indefinitely | Product improvement (no longer personal information) |
When you delete your account: We delete or anonymize your personal information within 30 days of your deletion request, except for data we are legally required to retain (such as billing records for tax purposes). Data held by third-party processors will be deleted according to our agreements with them and their published retention schedules.
We implement technical, organizational, and administrative safeguards to protect your personal information:
No system is perfectly secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security. If you become aware of a security vulnerability, please contact us immediately at info@maplesparklabs.com.
Depending on where you live, you have specific rights regarding your personal information. We honor these rights for all users, regardless of location.
To exercise any of these rights, contact us at info@maplesparklabs.com. We will verify your identity before processing your request and respond within 30 days, or notify you if additional time is needed.
If you are located in the EEA or UK, you also have the right to:
Legal basis for processing (GDPR): Where GDPR applies, we process your personal information on the following bases:
International transfers: Data transferred from the EEA to the United States is protected by our data processing agreements with service providers. Canada has received an adequacy decision from the European Commission for PIPEDA-covered commercial activities, facilitating data transfers between the EU and Canada.
While Droplet Learn is a Canadian company and may not meet the CCPA/CPRA applicability thresholds, we extend the following rights to California residents as a matter of good practice:
We do not sell personal information. We do not share personal information for cross-context behavioral advertising. Because we do not sell or share personal information, a "Do Not Sell or Share" opt-out is not applicable.
In the past 12 months, we have collected the following categories of personal information as defined by the CCPA: Identifiers (email, IP address), Commercial information (subscription and transaction records), Internet or electronic network activity (usage data, interaction logs), and Inferences (learning preferences derived from your interactions).
Droplet Learn is not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information as quickly as possible.
If you are a parent or guardian and believe your child has provided personal information to Droplet Learn, please contact us at info@maplesparklabs.com, and we will delete the account and associated data.
In accordance with the Office of the Privacy Commissioner of Canada's guidance, we treat children's personal information as particularly sensitive and requiring heightened protection.
In the event of a data breach involving your personal information that creates a real risk of significant harm, we will:
We maintain records of all security incidents for a minimum of 24 months, as required by PIPEDA.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.
Your continued use of Droplet Learn after a change takes effect constitutes your acceptance of the revised policy. If you do not agree with a material change, you may delete your account before the change takes effect.
We will maintain a link to the previous version of this policy for your reference.
If you have questions about this Privacy Policy, want to exercise your privacy rights, or have a concern about how we handle your data:
Maple Spark Labs Inc.
Toronto, Ontario, Canada
Email: info@maplesparklabs.com
Full mailing address available upon request.
Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec K1A 1H3
www.priv.gc.ca
1-800-282-1376
Your first path is free. 5 minutes from now, you'll have your first drop of knowledge — personalized to your goals.
Get My First Drop — Free14-day Pro trial included. No credit card required.