Privacy Policy

Chinuch App (“we,” “our,” or “us”) is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our educational management platform.

We comply with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and other applicable student privacy laws.

2.1 Student Data

We collect student information provided by schools or parents, including:

• Student names, grade levels, and class assignments
• Attendance records
• Behavior logs and incident reports
• Assessments, grades, and academic progress
• Standards and skills tracking data
• Bus check-in/check-out records
• Emergency contact information
• Parent/guardian information

2.2 Teacher & Staff Information

• Names, email addresses, and contact information
• School affiliation and role
• Class assignments and schedules
• Login credentials (encrypted)

2.3 Parent Information

• Names, email addresses, and phone numbers
• Relationship to students
• Account credentials

2.4 Usage Data

• Log data (IP addresses, browser type, pages visited)
• Device information
• Usage patterns and preferences
• Audit logs of data access and modifications

2.5 Marketplace Store Activity

The marketplace is the public store where teachers buy and sell teaching materials. It is separate from your school's records, and this section applies only there:

• View and cart counts: How many times a listing was opened or added to a cart, recorded as counts per listing per day. These counts are not linked to a visitor, an account, or a browsing history.
• Approximate location: The country, state or region, and town of a store view and of a purchase. For a purchase with a delivery address we use that address. Otherwise our hosting provider resolves the location from the network connection before the request reaches us, and gives us only the resolved place. We do not store the IP address it was derived from, and the location is added to a count rather than kept against a person.
• Search terms: Words typed into the store search, with the listings that were shown and which of them was opened.
• Order details: What was purchased, the amount, and the delivery address for a physical item.

Students are excluded. When a signed-in student browses or searches the store, their search terms and location are not recorded at all. This is a deliberate limit, not a setting: see Sections 3 and 7.

2.6 Campaign & Store Visitor Analytics

Schools publish public fundraising campaign pages and public store pages (school fundraiser shops) through our platform. This section applies only to visitors of those public pages — not to school records, and not to the marketplace, which Section 2.5 covers. Two kinds of measurement exist there, and they are different on purpose:

• Anonymous daily counters (always on, campaign pages): How many times a page was viewed, a donate button clicked, a form started or completed, recorded as counts per campaign per day — split by things like device type and which link brought the visit. These are numbers, not people: they carry no session, no identity, and no browsing history, which is why they run without asking. Store pages have no counters of their own; without consent, a store visit records nothing.
• Per-visit sessions (only with your consent): If you accept the analytics banner on a campaign or store page, your visit is given a random session identifier generated by your browser, and we record what that session did on the page: on a campaign page, which sections were seen and clicked and how far the donation form got; on a store page, which products were seen, added to the cart, and how far checkout got. In both cases we record how the visit arrived (a referrer category and the referring site's hostname — never the full address of the page you came from), any campaign tags on the link (UTM), and how long the page was open. The identifier is meaningless outside your browser and is not connected to a school account, an email address, a donation record, or an order. When a store purchase is completed, the session is marked as having led to a purchase — a yes/no and a time; the order does not keep the session identifier and the session does not name the order.

We do not store IP addresses in either case. As with the marketplace (Section 2.5), nothing about a public-page visit is derived from or kept against a network address.

Students are excluded here too. A visit from a signed-in student account is never given a session, regardless of what was answered on the banner — the same rule, enforced the same way, as marketplace store activity.

Consent is asked once, remembered, and reversible. The banner appears on the school's public campaign and store pages (never inside widgets embedded on other websites, where only the anonymous counters run). One answer covers both kinds of page. Declining changes nothing except that no session is recorded. To change your answer later, use the “Privacy choices” link in the page footer.

Retention is fixed and automatic:

• VISITOR_SESSION_PII_DAYS (90 days): the referring hostname, landing path, and free-text link tags are removed from a session.
• VISITOR_EVENT_RETENTION_DAYS (180 days): the click-by-click record of the visit is deleted.
• VISITOR_SESSION_RETENTION_DAYS (400 days): the session record itself is deleted.

How this differs from Marketplace Store Activity (Section 2.5): the marketplace records only counts and approximate locations and never keeps a per-visitor record of any kind; campaign and store pages additionally keep the consented per-visit session described above — but no location at all, and only after you say yes.

2.7 Financial and Payment Data

When schools or parents use our payment features, we collect payment-related information through our payment processor, Stripe:

• Credit/debit card details (processed and stored securely by Stripe, not stored on our servers)
• Bank account information for ACH payments (tokenized account and routing numbers)
• Billing addresses
• Payment history and transaction records
• Account ownership verification details

Important: We use Stripe Financial Connections to securely verify bank account ownership and enable ACH payments. We do not access your bank balance, transaction history, or any other financial data beyond what is necessary for payment processing.

We use the collected information solely for educational and school operational purposes:

• Provide and maintain our educational services
• Track student progress and academic performance
• Facilitate communication between teachers, students, and parents
• Generate reports and analytics for educational improvement
• Manage attendance and behavior tracking
• Handle transportation and bus logistics
• Process tuition payments, event fees, and other school-related payments
• Ensure platform security and prevent fraud
• Comply with legal obligations (FERPA, COPPA, state laws)
• Show a marketplace seller aggregate statistics about their own listings — how many times each was viewed, bought, and from which countries, regions and towns

We do NOT use student data for:

• Advertising or marketing purposes
• Behavioral profiling for commercial purposes
• Selling or renting data to third parties
• Any non-educational purpose

Marketplace seller statistics are a commercial use, so student activity is kept out of them at the point of collection. A student's search terms and location are never written down, and nothing a student does can appear in any seller's report.

We do not sell, trade, or rent student data. We may share information only with:

• The School: Teachers, administrators, and authorized staff within the school organization
• Parents/Guardians: For their own children's records, as authorized by the school
• Service Providers: Vendors who assist in platform operations. All must sign data protection agreements
• Legal Requirements: When required by law, court order, or to protect rights and safety

We never share student data with advertisers or unrelated third parties.

Marketplace sellers. When you buy from the marketplace, the seller of that item is shown your name, the item and amount you bought, and the delivery address if it is being shipped to you. They also see their own listings' view, sale and location totals as counts, which never name a buyer. A seller is never shown your school records, your other purchases, or anything about a visitor who did not buy from them.

We implement industry-standard security measures to protect your data:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Secure authentication with password hashing
• Role-based access controls
• Multi-school data separation
• Audit logs for all data access and modifications
• Regular security audits and updates
• Secure data centers with physical security
• Incident response procedures
• Regular backups with encryption

A detailed Security Policy is available upon request or at /legal/schools.

We comply with the Family Educational Rights and Privacy Act (FERPA) and are designated as a School Official with a legitimate educational interest. We:

• Protect student education records as required by FERPA
• Limit access to authorized school officials and parents
• Do not disclose personally identifiable information without consent
• Allow parents to review and request corrections to their child's records
• Maintain student data ownership with the school
• Provide data export capabilities upon request
• Delete data according to school requests and retention policies

We comply with the Children's Online Privacy Protection Act (COPPA). For children under 13:

• Schools may consent on behalf of parents for educational use
• Parents may directly provide consent through school invitation
• We collect only information necessary for educational services
• We do not allow children to submit personal information directly
• We do not use children's data for advertising or commercial purposes

For detailed COPPA information, see our COPPA Notice.

We comply with applicable state student privacy laws, including:

• California SOPIPA
• New York Education Law §2-d
• Colorado SB 16-173
• Texas Student Privacy Laws
• Other applicable state regulations

We retain student data only as long as necessary:

• Active Schools: Data is retained while the school's account is active
• School Termination: Data is archived for 60 days, then permanently deleted
• School Requests: We delete specific student records within 10 business days
• Audit Logs: Retained for 1 year for compliance
• Marketplace Search Records: A search record's contact details are removed after 90 days and the record itself is deleted after 400 days
• Campaign Visitor Analytics: A consented visit's referring site and landing details are removed after 90 days, its click-by-click record is deleted after 180 days, and the session record after 400 days, as described in Section 2.6
• Marketplace Order Records: Retained for 7 years for tax and legal compliance, as described in Section 15

Schools own 100% of all Student Data. Schools may:

• Access, edit, export, or delete student data at any time
• Request full data exports in CSV, JSON, or SQL format
• Request deletion of individual students, classes, or full database
• Transfer data to other systems

We provide data exports within 10 business days of request.

In the event of unauthorized access or disclosure of student data, we will:

• Notify affected schools within 72 hours of confirming a breach
• Provide details about what happened and what data was affected
• Describe steps taken to contain and remediate the issue
• Offer guidance and support for schools
• Cooperate fully in any investigation

You have the right to:

• Access your personal information
• Correct inaccurate data
• Request deletion (subject to legal requirements)
• Opt-out of non-essential communications
• Data portability and export
• Review audit logs of data access

Parents requesting corrections or deletions should contact their child's school, as schools control educational records under FERPA.

To request that a Chinuch App login and its associated personal data be deleted, follow the steps on chinuchapp.com/privacy/delete-account.

We may use service providers (subprocessors) to support platform operations:

13.1 Infrastructure & payments

• Hosting and infrastructure providers (e.g., Supabase)
• Email notification services (e.g., SendGrid)
• Security and monitoring tools
• Payment processing (Stripe, Inc.) — PCI-DSS Level 1 certified

13.2 AI subprocessors

The following AI providers may receive prompts and receive responses as part of our AI-powered features. See Section 14 below for the strict rules we apply before any data reaches them.

• Anthropic, PBC (Claude models) — the AI assistant (in-app chat and texting, including photos sent to it by text), lesson authoring, remediation diagnosis, report-card narratives, and email drafting. Commercial terms.
• OpenAI, OpCo LLC (GPT / gpt-4o models) — short structured completions, open-response grading, name transliteration. Business terms.
• Google LLC (Gemini, Imagen, Vision) — image generation for educational slides, handwriting OCR for scanned assessments. Gemini API terms.
• Perplexity AI, Inc. (Sonar models) — citation-backed research for teacher-facing content. Terms.
• ElevenLabs, Inc. — text-to-speech and speech-to-text for accessibility features and for voice notes sent to the AI assistant by text; audio is deleted after processing per provider DPA. Terms.

All subprocessors must sign data protection agreements and meet equal or higher security standards.

We do not permit any AI subprocessor to train on customer traffic. Our API settings or contracts with each provider above disable the use of our data for model training.

Chinuch App uses AI models to help teachers and students with tasks such as generating lesson materials, drafting parent emails, transcribing speech, grading open-ended responses, and building remediation packets.

14.1 What we send to AI providers

Outbound AI requests follow two paths. They are not treated the same.

The assistant (the in-app chat, and texting a school number where that school has turned the text assistant on) works with school records only for a school that has accepted the AI Assistant Addendum, its authorization as the school. Until then it answers how-to questions only. For such a school it sends the names and school records the signed-in person is already allowed to open. That includes a student's name, and a parent's name or email when the task is to find that person or draft a message about them. Attendance, class, grades, and behavior-log text can be included on the same terms. The assistant also sends an internal id so it acts on the right record. Those ids are not meaningful outside our system.

Before an assistant request leaves our servers, a field scrub drops Social Security and tax identifiers, payment-card and bank numbers, Stripe identifiers, passwords, API keys, session tokens, and structured date-of-birth, street-address, medical, medication, allergy, diagnosis, IEP, 504, mental-health, and private-note fields. It also masks Social Security-shaped and card-shaped numbers inside remaining text. It does not replace names, emails, or phone numbers with placeholders. The assistant cannot find a person or draft a message about them if the name never leaves our servers.

Reports, narratives, and document tools (progress reports, remediation diagnosis, hearing reports, and similar generators) register the known student name and replace it with a placeholder such as "Student A" or "[Student]" before the prompt is sent. That text is also stripped of phone numbers, email addresses, street addresses, dates of birth, 9-digit school IDs, and card-like numbers. Where the finished text needs the real name, we put it back on our server after the model responds.

14.2 What we do not send to AI providers

• Payment card numbers, bank-account numbers, or Stripe secrets. Payments stay with Stripe.
• Social Security numbers and similar government identifiers.
• Passwords, API keys, and session tokens.
• A child's photo.
• Structured date-of-birth, street-address, medical, medication, allergy, diagnosis, IEP, 504, mental-health, and private-note fields.
• On report and document tools, the child's name, email, phone number, street address, date of birth, and school ID, which those tools replace or strip before the prompt is sent.

A behavior or health log's free-text description can still be included when a staff member asks the assistant about a log they are already allowed to read. The assistant does not use that text for a disciplinary decision on its own. A person confirms any write.

14.3 Child-safety guardrails on every AI call

• Every AI prompt that can reach a child is wrapped with a non-negotiable safety preamble that forbids sexual, violent, self-harm, substance-use, weapons, political, and age-inappropriate content, in line with Anthropic's guidance for organizations serving minors and equivalent OpenAI and Google policies.
• AI-generated content shown to a student is visibly labeled as "AI-generated" and includes a way to report inappropriate output. Reports are reviewed by our safety team and the child's school.
• AI is not used for disciplinary decisions, identity verification, mental-health diagnosis, or anything that permanently affects a child's record without a human reviewing it first.

For additional information specific to children under 13, see our COPPA Notice.

Our platform enables schools to collect tuition payments, event fees, and other school-related charges.

15.1 Payment Processor

All payment processing is handled by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. We do not store credit card numbers or full bank account numbers on our servers.

15.2 Stripe Financial Connections

For ACH bank payments, we use Stripe Financial Connections to securely link and verify bank accounts. We do NOT access your bank balance or transaction history.

15.3 Payment Data Retention

Payment records are retained as long as the school account is active and for 7 years thereafter for tax and legal compliance purposes.

When a parent, teacher, student, or school administrator opts in to receive text messages from their school, we collect and process the following information solely for the purpose of operating that messaging program:

• The mobile phone number provided
• The date, time, source, and (where available) IP address and user-agent at the time of opt-in
• The messages sent to and received from that number
• Delivery status, error codes, and STOP / HELP keyword responses

16.1 How phone numbers are used

Phone numbers and SMS opt-in information are used only to deliver the messages described in our SMS Messaging Policy — attendance alerts, dismissal updates, school-to-parent messages, homework hotline notifications, and account verification codes.

16.2 No sharing for marketing

Phone numbers and SMS opt-in information are not shared with third parties or affiliates for marketing or promotional purposes, and are not sold or rented to anyone for any purpose. We do not use this data to build advertising profiles or to advertise to anyone.

16.3 Service providers

Phone numbers are shared only with our messaging service provider, Twilio Inc., which delivers messages on our behalf and is contractually bound to use the data only for that purpose. Twilio is the “CSP” (Communications Service Provider) for our A2P 10DLC campaign with The Campaign Registry (TCR).

16.4 Carrier visibility

By the nature of SMS, U.S. mobile carriers (and TCR, on the carriers’ behalf) receive the destination number, sender number, and message body of every message we send. Carriers may also see metadata such as message length and delivery status.

16.5 Retention & deletion

SMS message logs are retained for 12 months for delivery diagnostics and compliance, then deleted. Phone numbers themselves are retained as part of your school user profile and are deleted according to the rest of this Privacy Policy. You can delete your phone number at any time from parent notification settings or by asking your school administrator.

16.6 How to opt out

Reply STOP to any message to immediately stop receiving SMS from that school’s sender number, or turn off SMS in parent notification settings. Opting out of SMS does not affect your account or your ability to use the platform; you will continue to receive in-app and email notifications.

We may update this Privacy Policy periodically. We will notify schools of material changes via email or platform notification. Continued use of the platform after changes constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy:

Email: privacy@chinuchapp.com
Support: support@chinuchapp.com
Website: chinuchapp.com

For school-specific legal agreements, visit /legal/schools.