COPPA Notice

Chinuch App
Operated by Chinuch App LLC
Website: https://chinuchapp.com

This COPPA Notice explains how Chinuch App, operated by Chinuch App LLC, handles the personal information of children under 13 years of age in compliance with the Children's Online Privacy Protection Act (COPPA).

Chinuch App is an educational platform used by schools and parents to track student attendance, behavior, assessments, transportation, and communication.

We take the privacy and safety of children seriously and follow all COPPA requirements.

Children under 13 cannot create accounts or use the platform independently. Access is only granted under one of the following:

A. School Authorization (COPPA-Compliant “School as Agent” Consent)

A school may consent on behalf of parents solely for educational use. This is allowed under COPPA when:

• The platform is used for educational purposes
• No data is used for commercial/advertising purposes
• The school remains in control of the data

B. Parent/Guardian Authorization

Schools or parents may directly invite parents to create accounts and approve student access.

We collect only what is necessary to provide educational services. This may include:

• Student name
• Grade, class, or division
• Attendance records
• Behavior logs
• Assessments, assignments, and grades
• Bus check-in/check-out
• Parent/guardian contact information
• Emergency contacts
• Login username (created by school)

We do not allow children to submit personal information directly.

We use data only to provide educational services requested by the school or parent, including:

• Attendance tracking
• Academic assessments and grades
• Behavior monitoring
• Transportation logs
• Parent-teacher communication
• Compliance with school policies

We do not use children's data for:

• Advertising
• Behavioral profiling
• Commercial purposes
• Selling or renting data

We only share children's information with:

A. The School

Teachers, administrators, and authorized staff.

B. Parents/Guardians

When allowed by the school.

C. Service Providers

Vendors that help operate and secure the platform (e.g., hosting, email notifications). All vendors:

• Sign a data protection agreement
• Must meet security standards
• Cannot use data for their own purposes

We never share children's data with advertisers or unrelated third parties.

Chinuch App uses AI models to assist teachers and students with tasks such as generating lesson materials, grading open-ended responses, drafting parent communications, building remediation packets, and transcribing speech. We follow the child-safety guidance published by the providers we use (including Anthropic's guidelines for organizations serving minors).

A. What we send to AI providers

• The assistant needs the school's authorization first. The AI assistant (in-app chat and texting) works with a school's records only after the school accepts the AI Assistant Addendum. In it the school authorizes this use on parents' behalf for educational purposes only, never commercial ones, and agrees to tell parents about it. Until then the assistant answers how-to questions only. The assistant is not available on student accounts: students use only AI practice a teacher assigns, which is age-controlled, labeled as AI, and has a Report button.
• The in-app assistant sends a child's name when a teacher, administrator, or parent who is already allowed to see that child uses the assistant to find them or draft something about them. Contact details that person is allowed to see can be included when the task needs them. The assistant drops structured medical, IEP, date-of-birth, street-address, government-id, and payment fields, and it does not receive a child's photo.
• Report and document tools do not send the child's name. Progress reports, remediation diagnosis, hearing reports, and similar generators replace the known name with a placeholder such as "Student A" or "[Student]" and strip emails, phone numbers, street addresses, dates of birth, and school IDs before the prompt leaves our servers. The real name is put back on our server when the result is shown.
• Internal database IDs may be sent when the assistant needs a stable reference; those IDs are not meaningful outside our system.
• Student responses, teacher notes, and curriculum content may be sent so the model can do its job. On report and document tools, that text is scrubbed of the name and contact patterns above.
• We do not send children's biometric data, voice prints, or photos to AI providers for identity-linked processing. Speech-to-text for student-facing features uses a provider that is contractually bound to delete audio after transcription.

B. AI sub-processors we currently use

The following AI providers may receive prompts as described above. Each has a data-processing agreement on file with Chinuch App LLC.

• Anthropic (Claude): the in-app assistant, lesson authoring, remediation diagnosis, report-card narratives, and email drafting. Terms.
• OpenAI: open-response grading, Hebrew/English name transliteration, short structured completions. Terms.
• Google (Gemini / Imagen / Vision): image generation for educational slides, handwriting OCR for scanned assessments, structured content generation. Terms.
• Perplexity: citation-backed research for teacher-facing content. Terms.
• ElevenLabs: text-to-speech and speech-to-text for accessibility features; audio is deleted after processing per provider DPA. Terms.

None of these providers may use a child's data to train their models. Our contracts / API settings disable training on our traffic.

C. Child-safety rules applied to every AI request

• Every AI prompt that can reach a child is wrapped with a non-negotiable safety preamble that forbids sexual, violent, self-harm, substance-use, weapons, political, or age-inappropriate content.
• AI is not used for disciplinary decisions, identity verification, mental health diagnosis, or anything that permanently affects a child's record without a human reviewing it.
• Any content shown to a student that was produced by AI is labeled with an "AI-generated" badge and includes a way to report inappropriate output. Reports go to the child's school and to our safety team.

Parents/guardians may:

• Review any personal information about their child
• Request correction of inaccurate data
• Request deletion of their child's data (via the school)
• Revoke consent for further data collection

Because schools control educational records under FERPA, we process deletion requests through the child's school. Parents may contact support@chinuchapp.com for assistance.

We use industry-standard security measures to protect children's information, including:

• Encryption
• Role-based access controls
• Audit logs
• Secure authentication
• Separation of school data
• Regular backups

A full Security Policy is part of our legal compliance bundle and is available at /legal/schools#security.

We retain child data only as long as the school account is active.

When a school ends its use of the platform:

• Records are exported to the school
• All data is deleted within 60 days unless legally required to retain longer

For detailed retention policies, see our Data Retention & Deletion Policy.

We may update this notice to reflect legal or operational changes. Schools will be notified of significant updates.

For questions or COPPA-related requests:

For additional privacy information, see our Privacy Policy.