Privacy Policy

Effective date: 2026-05-29 · Last updated: 2026-06-05

OYLA Workbook ("OYLA Workbook," "we," "us," or "our") is an online platform, operated by OYLA Magazine Inc., that lets children create work in response to assignments from OYLA magazine, submit photos of that work, and—with a parent's permission—have it published in a public gallery and in the magazine.

This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the OYLA Workbook platform at workbook.oyla.us (the "Service").

We are committed to protecting children's privacy. Because our Service is directed to children under 13 in the United States, we comply with the Children's Online Privacy Protection Act (COPPA). We collect children's information only after we obtain verifiable consent from a parent or legal guardian.

1. Who this policy is for

There are two kinds of people who use OYLA Workbook:

  • Parents and legal guardians("parents") — who create an account, give consent, and manage their child's participation.
  • Children— who create work that a parent submits on their behalf (OYLA Junior, ages 6+) or who participate with a parent's consent (OYLA, ages 12–18).

A child can never use the Service or have any information collected about them until a parent has created an account and provided verifiable parental consent.

2. Information we collect

We practice data minimization: we collect only what is needed for a child to participate.

From the parent

  • Email address — to create the account, verify consent, and send notifications.
  • ZIP / postal code — used as a lightweight sign-in credential.
  • Country — to tailor content to your region (US / UK / AU).

About the child (only after parental consent)

  • First name — to credit the child's work.
  • Age — to place the child in the right program and credit their work.
  • City and country — for regional context (the public credit shows the country, not the city).
  • Photos of the child's work — the core of the Service.
  • Optional text answers — when an assignment asks for a written response (see Section 8 for retention details).

We do notcollect a child's last name, home address, school, phone number, or precise geolocation. We do not use behavioral advertising, third-party advertising trackers, or sell any personal information.

We automatically collect the IP address at the time of a submission for spam and abuse prevention; it is deleted within 90 days of the submission being moderated.

3. How we obtain verifiable parental consent (VPC)

Before we collect any personal information about a child, we use a two-tier consent model that matches the sensitivity of the action:

Tier 1 — Registration and participation (Email Plus)

  1. The parent creates an account and adds a child profile.
  2. We email the parent describing exactly what information we will collect, how it will be used, and the parent's rights.
  3. The parent confirms by clicking a link in that email.
  4. We then apply a waiting period of at least 24 hours, during which the parent can cancel.
  5. After the waiting period, the child profile becomes active and we send a confirmation email.

This consent covers participation in the Service: submitting work and storing it privately.

Tier 2 — Publication (Enhanced consent)

Because publishing a child's work in a public gallery or printed magazine is a materially more sensitive action than participation alone, we apply a higher standard before any work becomes public:

  • For each individual submission the parent wishes to publish, we require explicit per-submission confirmation via a separate action in the account dashboard (not covered by Tier 1 consent).
  • We do not publish any submission automatically or by default.

The two-tier model ensures that a parent who completes registration has not inadvertently consented to public display of their child's work. We keep a record of the consent text shown to the parent and the actions taken at each tier, as proof of consent. If a parent declines or cancels, the child profile is not activated and any associated data is queued for deletion.

Incomplete registrations

If a parent begins registration but does not complete the Tier 1 confirmation (e.g., abandons the process before clicking the verification link), no child profile is created. The parent's email address collected during sign-up is retained for no more than 30 days and then permanently deleted. No child information is collected or retained in this case.

4. How we use the information

  • Operate the Service (create accounts, accept and review submissions).
  • Moderate every submission before it is published — a staff reviewer checks each submission and removes anything that should not be public.
  • Publish a child's work in the public gallery and/or the OYLA magazine only with per-submission parental consent (see Section 5).
  • Send parents transactional emails: consent requests, submission status, and publication notifications.
  • Maintain the safety, security, and integrity of the Service.

We do notuse children's information for marketing, profiling, or advertising.

5. Publication and per-submission consent

Publication is never automatic and never global. For each individual submission, the parent chooses one of:

  • Publish with my child's first name and age (e.g., "Mia, 8");
  • Publish anonymously (work shown without a name); or
  • Do not publish (kept private; used only for participation).

The public gallery and magazine show the child's first name (if consented), age, and country. We never display a child's last name, city or street address, school, or contact information.

6. Parental rights and choices

As a parent, at any time you can:

  • Review all information we have collected about your child, from your account dashboard.
  • Delete your child's account and all associated work, or delete an individual submission, directly from your dashboard.
  • Revoke consent and stop any further collection or use of your child's information.

To exercise these rights, use your account dashboard or contact us at info@oyla.us. When you cancel a child's profile or revoke consent, the child's data and submitted work are permanently deleted within 30 days, subject to the exception for printed magazine issues described in Section 8.

7. How we share information

We do not sell or rent personal information. We share information only with service providers who help us run the Service, and only as needed: an email provider (parent email address), secure file storage (submission photos), a content delivery / security provider (technical traffic data), and server hosting (application data). These providers are bound to use the information only to provide services to us. We may also disclose information if required by law or to protect the rights, safety, or security of children, our users, or the public.

8. Data retention

  • Submission photos and creditsare retained as part of the child's portfolio and, where published, the magazine archive, consistent with the purpose for which they were submitted. A parent may request deletion at any time from the account dashboard; digital copies are permanently deleted within 30 days of the request.
  • Printed magazine issuesare physical objects that cannot be altered after distribution. If a child's work has been published in a printed issue, deletion of consent or the child's profile removes all digital copies and future displays, but does not retroactively modify physical copies already distributed. We will not republish the work in any future issue or digital format after a deletion request is received.
  • Optional text answers are treated the same as submission photos: visible only to staff reviewers until published (if consented), included in deletion when a parent requests it, and not retained beyond the purpose for which they were collected.
  • IP addresses are deleted within 90 days of moderation.
  • Incomplete registration emails (where Tier 1 consent was not completed) are deleted within 30 days (see Section 3).
  • When a parent cancels a child's profile or revokes consent, all digital data and work are deleted within 30 days.
  • When information is no longer needed for the purpose it was collected, we delete or anonymize it.

9. Data security

We use reasonable safeguards: encryption in transit (HTTPS), private storage for photos accessed only via signed, time-limited URLs, restricted access to our database, and minimization of the data we collect. No method of transmission or storage is 100% secure, but we work to protect information appropriately given its sensitivity.

Our servers and database are located in the United States, and information collected through the Service is stored and processed there.

10. Children outside the United States

OYLA Workbook is primarily directed to users in the United States, and all information is stored and processed in the United States (see Section 9). Where we have users in the United Kingdom or Australia, their information is transferred to and processed in the United States, and we also seek to align with the UK Age Appropriate Design Code (Children's Code) and the Australian Privacy Act. Privacy settings default to the most protective option, and geolocation is off by default.

11. Your California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, gives you certain rights regarding your personal information. We extend these rights to the parents who use the Service and to the information we hold about their children:

  • Right to know — request the categories and specific pieces of personal information we have collected, the sources, the purposes, and any parties we disclose it to.
  • Right to delete — request deletion of personal information we have collected.
  • Right to correct — request correction of inaccurate personal information by contacting us at info@oyla.us, and we will update it.
  • Right to opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information (including children's), and we do not use it for cross-context behavioral advertising, so there is nothing to opt out of.
  • Right to non-discrimination — we will not treat you differently for exercising any of these rights.

Because our Service is directed to children, we apply the additional protections required by California and federal law: we never sell or share the personal information of any user, and for any consumer under 16 we would obtain affirmative (opt-in) consent before any such sale or sharing — which we do not do. Personal information about children under 13 is collected only after verifiable parental consent (see Section 3).

The categories of personal information we collect, the purposes for which we use them, and the limited service providers we disclose them to are described in Sections 2, 4, and 7. To exercise any of these rights, use your account dashboard or contact us at info@oyla.us. We verify requests through your account email before acting on them, and you may use an authorized agent to submit a request on your behalf.

12. Changes to this policy

If we make a material change to how we collect, use, or disclose children's personal information, we will notify parents by email and obtain new consent where required by law before applying the change to previously collected information.

13. Contact us

OYLA Magazine Inc., Attn: Privacy, 651 N Broad St, Suite 206, Middletown, Delaware, 19709, United States. Email: info@oyla.us · Phone: +1 (814) 300-8043.