Literacy LabLanguage · Literacy · Inquiry
🎒 Join ClassFree Sample

Legal

Privacy Policy

⚠️ Reference draft — review with your legal counsel and set the contact before publishing.

The Multilingual Literacy Lab (“the Platform”, “we”) helps schools run a small-group literacy routine for multilingual learners. This policy explains what data we handle, why, and how we protect it.

In most cases the school is the data controller and we act as the data processor on the school's behalf. We process student data only to provide the service to the school — never to advertise, sell, or build profiles.

Data we collect

  • School & staff: school name, teacher/admin name, email, role, and teaching language, used to create accounts and organize classes.
  • Students: a school-safe display name, grade, class/group, an optional avatar, and a hashed PIN. We deliberately avoid extra student personal data (no student email, address, or national ID).
  • Learning data: diagnostic results, reading measures/bands, skill notes, lesson completions, written responses, and optional oral-reading recordings — created by teachers and students as part of instruction.
  • Technical data: basic sign-in/session information needed to keep accounts secure.

How we use it

  • To provide the service: assessments, small-group formation, differentiated lessons, progress reports, and family summaries.
  • To keep accounts secure and the service reliable.
  • We do not use student data for advertising, and we do not sell personal data.

Where data is hosted & our subprocessors

  • Application hosting: Vercel. Database, authentication, and file storage: Supabase (PostgreSQL). Transactional email: Resend.
  • Optional AI: only if your school connects its own AI provider key, some lesson and assessment text may be processed by that provider under your account to generate content and analysis. This is off by default.
  • We share data with these subprocessors only as needed to run the service.

Security

  • Row-Level Security (RLS) enforces that each school can only access its own data.
  • Data is encrypted in transit (HTTPS/TLS). Passwords and student PINs are stored hashed, never in plain text.
  • Administrative keys are kept server-side only and never exposed to browsers.

Data retention & deletion

  • The school controls its data. We retain it while the school's account is active.
  • Admins can export their school's data and erase a student's data from within the app. On account closure, we delete or return school data on request within a reasonable period.

Your rights & choices

  • Schools and families may request access, correction, export, or deletion of student data. Please route requests through the school, which manages its roster and can act on them directly in the app.
  • Teachers can change their own password and account language in Settings.

Children's privacy

  • The Platform is designed for use under school direction, with minimal student data. The school is responsible for obtaining any consents required by local law (e.g., FERPA in the US, GDPR or national laws elsewhere). We support the school's compliance as its processor.

Changes & contact

  • We may update this policy; we will change the date above when we do. Last updated: 2026-08-27.
  • Questions or data requests: admin@literacylab.app.