Privacy Policy

1. Information We Collect

We collect information you provide directly to us, including:

• Account information (name, email, password)
• Child profile information you choose to add
• Content you create using our tools
• Communications with our support team

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Send you technical notices and support messages
• Respond to your comments and questions
• Monitor and analyze usage patterns

3. AI Features and Clinical Content

Some features use artificial intelligence to help generate documents such as social stories, behavior-support drafts, IEP goal suggestions, and session-note drafts. To protect your child's privacy, supported text-generation workflows use identifier-removal and placeholder safeguards. These safeguards do not guarantee that free text, uploaded images, or audio contain no identifying information. Only include information needed for the activity. AI features may send the input needed to generate a response to third-party providers.

AI-generated content is a draft decision-support aid for qualified caregivers and professionals. It is not a medical, psychological, or educational diagnosis and is not a substitute for the independent judgment of a licensed clinician. Every AI clinical output is labeled accordingly and is intended to be reviewed by a qualified person before it is relied upon.

4. Data Security

Our safeguards include the following controls. Their presence is not a certification of legal compliance or a guarantee against unauthorized access:

• The web application uses HTTPS for connections to the service.
• Designated sensitive database fields use application-level encryption. This does not mean that every database field, uploaded file, or log is encrypted by that mechanism.
• Passwords and session tokens are stored only as one-way hashes.
• Access to your records is scoped to your account; we apply least-privilege access controls and maintain audit logs (with sensitive values excluded from the logs themselves).
• Card payments are handled by our PCI-DSS-compliant payment processor (Stripe); we never store full card numbers on our servers.

No method of transmission or storage is 100% secure, and we do not claim formal certification under any framework. We continue to invest in our security program as we grow.

5. Children's Privacy

Accounts are held by adults, including parents, caregivers and education professionals. Some activities are designed for children to use with adult supervision. Those activities may process responses, progress and optional media supplied through the account.

When creating a child profile, we ask for an adult's permission attestation and record its date and time. A checkbox does not independently verify parental identity. Adults must have authority to provide the child's information; schools and service providers should contact us to review their authorization and data-protection requirements.

You remain in control of your child's information at all times. You can review and export it. Archiving a child profile hides it from the active profile list but retains its records. To withdraw permission or request permanent erasure of a child's information, contact privacy@ezducate.me. We may need to verify your authority before acting on a request. Account deletion is a separate action available through Data Export.

6. Data Sharing and Service Providers

We do not sell your personal information, and we do not use your child's information for advertising. We share information only as needed to run the service:

• Vetted service providers (subprocessors) that help us operate — for example Stripe for payments and AI providers for the generative features described in Section 3. We share only what each provider needs. Identifier-removal safeguards and their limitations are described above.
• Therapists or caregivers you explicitly authorize.
• Legal authorities when required by law.

7. Data Retention

We keep your account and child information for as long as your account is active so we can provide the service. Archived profiles remain stored; archiving is not permanent erasure or withdrawal of permission. The account-deletion workflow removes account-owned database records. Requests involving uploaded files, subprocessors, backups or a single child's records require a scope review. Financial records may be retained for accounting obligations. Contact privacy@ezducate.me for the applicable retention and erasure details before relying on a particular deletion timeframe.

8. Your Rights and Choices

You can exercise the following directly from your account settings, or by contacting us:

• Access and review the personal data we hold.
• Correct inaccurate data.
• Export your data in a portable format (Settings → Data Export).
• Delete your account's database records, subject to the scope and retention details above (Settings → Delete Account).
• Opt out of non-essential communications.

9. Cookies

We use a small number of strictly necessary cookies to keep you signed in and to protect requests (session and security cookies). These are required for the service to function and are exempt from consent under GDPR and CCPA. We do not use advertising cookies or sell cookie data.

We also use a small amount of first-party analytics to understand how features are used so we can improve them. These are non-essential and are only enabled with your consent. On your first visit we show a cookie banner where you can Accept or Reject non-essential analytics; if you reject (or ignore the banner) we collect no analytics at all. You can change your choice at any time, and you can also control cookies through your browser settings.

10. Your GDPR Rights (EEA, UK & Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and equivalent UK/Swiss law apply to our processing of your personal data. EZducate acts as the data controller for the account information you provide, and as a processor for the child information you enter on behalf of a child.

We rely on the following legal bases: performance of our contract with you (to provide the service), your consent (for non-essential analytics and for processing a child's information), our legitimate interests (to secure and improve the service), and legal obligation where applicable.

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict or object to certain processing.
• Data portability — receive your data in a machine-readable format.
• Withdraw consent at any time (including for analytics, via the cookie banner), without affecting processing done before withdrawal.
• Lodge a complaint with your local supervisory authority (for example, your national Data Protection Authority or the UK ICO).

Where your data is transferred outside the EEA/UK (for example to our US-based infrastructure or subprocessors), we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses. To exercise any right, use your account settings or contact us at the address below; we respond within the timeframes required by law (generally one month).

11. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you specific rights over your personal information. In the past 12 months we have collected identifiers (such as name and email), account and customer records, internet activity (such as feature-usage analytics, with your consent), and the information you choose to provide about a child, in order to provide and improve the service.

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under the CPRA. We also do not knowingly sell or share the personal information of consumers under 16.

You have the right to:

• Know what personal information we collect and how we use it.
• Access and obtain a copy of your personal information.
• Correct inaccurate personal information.
• Delete your personal information.
• Opt out of any sale or sharing of personal information — you can exercise this at any time via the “Reject non-essential” option in our cookie banner, which functions as a “Do Not Sell or Share My Personal Information” request and disables optional analytics.
• Limit the use of sensitive personal information.
• Not be discriminated against for exercising any of these rights.

You may exercise these rights through your account settings or by contacting us below, and you may use an authorized agent to submit a request. We will verify your request using your account credentials before acting on it.

12. Contact Us

If you have questions about this Privacy Policy or want to exercise a privacy right, please contact us at privacy@ezducate.me