COPPA Notice

Chinuch App
Operated by Chinuch App LLC (DBA Chabad Chinuch)
Website: https://chinuchapp.com

This COPPA Notice explains how Chinuch App, operated by Chinuch App LLC (DBA Chabad Chinuch), handles the personal information of children under 13 years of age in compliance with the Children's Online Privacy Protection Act (COPPA).

Chinuch App is an educational platform used by schools and parents to track student attendance, behavior, assessments, transportation, and communication.

We take the privacy and safety of children seriously and follow all COPPA requirements.

Children under 13 cannot create accounts or use the platform independently. Access is only granted under one of the following:

A. School Authorization (COPPA-Compliant “School as Agent” Consent)

A school may consent on behalf of parents solely for educational use. This is allowed under COPPA when:

• The platform is used for educational purposes
• No data is used for commercial/advertising purposes
• The school remains in control of the data

B. Parent/Guardian Authorization

Schools or parents may directly invite parents to create accounts and approve student access.

We collect only what is necessary to provide educational services. This may include:

• Student name
• Grade, class, or division
• Attendance records
• Behavior logs
• Assessments, assignments, and grades
• Bus check-in/check-out
• Parent/guardian contact information
• Emergency contacts
• Login username (created by school)

We do not allow children to submit personal information directly.

We use data only to provide educational services requested by the school or parent, including:

• Attendance tracking
• Academic assessments and grades
• Behavior monitoring
• Transportation logs
• Parent-teacher communication
• Compliance with school policies

We do not use children's data for:

• Advertising
• Behavioral profiling
• Commercial purposes
• Selling or renting data

We only share children's information with:

A. The School

Teachers, administrators, and authorized staff.

B. Parents/Guardians

When allowed by the school.

C. Service Providers

Vendors that help operate and secure the platform (e.g., hosting, email notifications). All vendors:

• Sign a data protection agreement
• Must meet security standards
• Cannot use data for their own purposes

We never share children's data with advertisers or unrelated third parties.

Chinuch App uses AI models to assist teachers and students with tasks such as generating lesson materials, grading open-ended responses, drafting parent communications, building remediation packets, and transcribing speech. We follow the child-safety guidance published by the providers we use (including Anthropic's guidelines for organizations serving minors).

A. What we send to AI providers

• We never send a child's full name, email, phone number, street address, date of birth, NYC OSIS / school ID, parent contact details, or medical information to any AI provider. Before any prompt leaves our servers, it passes through a central PII-scrub that replaces names with placeholders (e.g. "Student A", " [Student]"), replaces IDs with "[ID]", and strips emails, phones, DOBs, and addresses.
• Internal database IDs (opaque UUIDs) may be sent when needed for the AI task; those IDs are not meaningful outside our system.
• Student responses, teacher notes, and curriculum content may be sent so the model can do its job. These are still scrubbed of the PII patterns above before leaving our servers.
• We do not send children's biometric data, voice prints, or photos to AI providers for identity-linked processing. Speech-to-text for student-facing features uses a provider that is contractually bound to delete audio after transcription.

B. AI sub-processors we currently use

The following AI providers may receive scrubbed prompts as described above. Each has a data-processing agreement on file with Chinuch App LLC.

• Anthropic (Claude): lesson authoring, remediation diagnosis, report-card narratives, email drafting. Terms.
• OpenAI: open-response grading, Hebrew/English name transliteration, short structured completions. Terms.
• Google (Gemini / Imagen / Vision): image generation for educational slides, handwriting OCR for scanned assessments, structured content generation. Terms.
• Perplexity: citation-backed research for teacher-facing content. Terms.
• ElevenLabs: text-to-speech and speech-to-text for accessibility features; audio is deleted after processing per provider DPA. Terms.

None of these providers may use a child's data to train their models. Our contracts / API settings disable training on our traffic.

C. Child-safety rules applied to every AI request

• Every AI prompt that can reach a child is wrapped with a non-negotiable safety preamble that forbids sexual, violent, self-harm, substance-use, weapons, political, or age-inappropriate content.
• AI is not used for disciplinary decisions, identity verification, mental health diagnosis, or anything that permanently affects a child's record without a human reviewing it.
• Any content shown to a student that was produced by AI is labeled with an "AI-generated" badge and includes a way to report inappropriate output. Reports go to the child's school and to our safety team.

Parents/guardians may:

• Review any personal information about their child
• Request correction of inaccurate data
• Request deletion of their child's data (via the school)
• Revoke consent for further data collection

Because schools control educational records under FERPA, we process deletion requests through the child's school. Parents may contact support@chinuchapp.com for assistance.

We use industry-standard security measures to protect children's information, including:

• Encryption
• Role-based access controls
• Audit logs
• Secure authentication
• Separation of school data
• Regular backups

A full Security Policy is part of our legal compliance bundle and is available at /legal/schools#security.

We retain child data only as long as the school account is active.

When a school ends its use of the platform:

• Records are exported to the school
• All data is deleted within 60 days unless legally required to retain longer

For detailed retention policies, see our Data Retention & Deletion Policy.

We may update this notice to reflect legal or operational changes. Schools will be notified of significant updates.

For questions or COPPA-related requests:

For additional privacy information, see our Privacy Policy.