Privacy & Terms

Privacy Policy for Grassroot Academy

1. Introduction

Welcome to Grassroot Academy ("we," "us," or "our"). We are committed to protecting the privacy and security of our users' personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information from users of our website (www.grassroot.academy) and our AI-powered educational services.

Grassroot Academy is based in Illinois, United States, and provides educational technology services to K-12 students, college/university students, and individual learners of all ages. Because we are an Illinois-based company that serves K-12 students, we comply with the Illinois Student Online Personal Protection Act (SOPPA), the federal Children's Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), and the Illinois Personal Information Protection Act (PIPA).

2. Information We Collect

We are transparent about every category of data we collect. Below is a complete list.

2.1 Information You Provide Directly

• Account & Identity Information: First and last name, email address, phone number, date of birth, grade level, educational institution
• Parent/Guardian Information: Parent or guardian name and email address (required for users under 18)
• Authentication Credentials: Password (hashed; we never store plaintext passwords), Google account identifier (if you sign in with Google)
• Student Profile Information: Age, grade level, learning segment (K-12, higher education, working professional, parent), learning goals, focus areas, preferred study pace
• Interest and Background Information: Hobbies, interests, learning preferences (used solely to personalize the educational experience)
• Educational Content & Interactions: Text inputs, chat transcripts with AI tutors, voice recordings, drawings, and other content you create while using our learning tools
• Academic Performance Data: Quiz scores, assessment results, learning progress, achievement data, and learning analytics

2.2 Information Collected Automatically

• Session & Usage Data: Session duration, features used, pages visited, and how you interact with our AI tools
• AI Interaction Data: Questions asked, responses received, and learning patterns
• Device & Browser Information: Browser type (we do not collect device serial numbers or persistent device identifiers beyond what Google Analytics provides)
• Cookies and Analytics: We use cookies and Google Analytics (tracking ID: G-ETBJLPWN9T) to understand usage patterns and improve our services

2.3 Billing Information

• Payment Data: All payment card numbers, billing addresses, and financial account details are collected and processed exclusively by Stripe, our third-party payment processor. We do not receive, store, or have access to your full card number. We receive only a transaction confirmation, the last four digits of your card, card brand, and billing country for record-keeping.

2.4 Information We Do NOT Collect

• Social Security numbers
• Driver's license or state ID numbers
• Biometric identifiers (fingerprints, facial geometry, retina scans, voiceprints)
• Precise geolocation data
• Medical or health insurance information
• Disciplinary, criminal, or juvenile records

3. How We Use Your Information

We use the collected information solely for educational purposes and to operate and improve our services:

• Provide Educational Services: Deliver personalized AI-powered learning experiences
• Track Academic Progress: Monitor learning outcomes and provide progress reports to students, parents, and (where authorized) schools
• Personalize Learning: Adapt content based on interests, age, grade level, and learning style
• Improve Our Platform: Enhance our AI algorithms and educational content quality
• Communicate: Send service updates, educational resources, and respond to inquiries
• Safety and Security: Ensure a safe learning environment and prevent misuse
• Comply with Legal Obligations: Fulfill our obligations under SOPPA, COPPA, FERPA, and other applicable laws

We do NOT:

• Sell, rent, lease, or trade any personal information or student data to any third party, ever.
• Use student data for targeted advertising on our platform or any other platform.
• Build non-educational profiles of students. We do not use covered information to create profiles for any purpose other than furthering K-12 educational purposes or purposes authorized by the student/parent.

4. Third-Party Service Providers

We share data only with the specific third-party services listed below, and only for the purposes described. Each provider is contractually required to protect your data and use it only as we direct.

• Stripe (Stripe, Inc.) — Payment processing. Stripe receives your payment card details, billing address, and transaction amounts to process subscription payments. We do not store your full card number. Stripe Privacy Policy
• Google OAuth (Google LLC) — Authentication. If you choose "Sign in with Google," Google shares your name, email address, and profile photo with us to create or link your account. Google Privacy Policy
• Google Analytics (Google LLC) — Website analytics. We use Google Analytics 4 to understand how visitors use our website. Google Analytics collects anonymized usage data including pages visited, session duration, and browser type. We have IP anonymization enabled. Google Privacy Policy
• Supabase (Supabase, Inc.) — Database and backend infrastructure. Supabase hosts our application database and authentication system. Student data stored in Supabase is encrypted at rest and in transit. Supabase Privacy Policy
• Calendly (Calendly LLC) — Meeting scheduling. If you book a call with our team, Calendly collects your name, email, and scheduling preferences. Calendly Privacy Policy

We do not share student data with any third party for advertising, marketing, or any non-educational commercial purpose.

5. Data Retention and Deletion

We retain information only as long as reasonably necessary for the educational purpose for which it was collected:

• Active Account Data: Retained while your account is active and for 30 days after account closure to allow for reactivation
• Chat Transcripts & AI Interactions: Retained for up to 12 months from creation to support ongoing learning continuity, then automatically deleted
• Quiz Scores & Learning Progress: Retained while your account is active; deleted within 60 days of account closure or deletion request
• Analytics & Session Data: Retained for up to 14 months (Google Analytics default retention), then automatically deleted
• Billing Records: Transaction records retained for 7 years as required by tax and financial regulations
• School-Provided Student Data (SOPPA): Deleted or transferred back to the school within 60 days after the school's written agreement ends or the school requests deletion

Deletion requests: We honor verified deletion requests from users, parents, guardians, or schools. Upon receiving a valid request, we will delete the applicable data within 30 days and confirm deletion in writing. See Section 10 for how to submit a request.

6. Children's Privacy and COPPA Compliance

We strictly comply with the Children's Online Privacy Protection Act (COPPA), including the 2025 FTC amendments effective April 22, 2026.

6.1 Parental Consent

• We require verifiable parental consent before collecting any personal information from children under 13.
• Accepted verification methods include: email confirmation with follow-up confirmation, credit card verification, signed consent form, or video call with our team.
• Schools may provide consent on behalf of parents solely for educational purposes, consistent with FTC guidance.

6.2 What We Collect from Children Under 13

For children under 13, we collect only the minimum information necessary to provide our educational services: first name, parent email address, age/grade level, and educational content created during tutoring sessions.

6.3 Parental Rights Under COPPA

• Parents can review all personal information we have collected from their child
• Parents can request deletion of their child's information at any time
• Parents can refuse further collection of their child's information
• We will not require a child to disclose more information than is reasonably necessary to participate in our educational activities
• Our platform does not enable children to make personal information publicly available

To exercise any of these rights, email headmaster@grassroot.academy with the subject line "COPPA Parent Request." We will verify your identity as the parent or guardian and respond within 10 business days.

7. SOPPA Compliance (Illinois Student Online Personal Protection Act)

As an Illinois-based educational technology provider, we comply with the Student Online Personal Protection Act (105 ILCS 85/).

7.1 Covered Information

When we receive student data through an agreement with an Illinois public school district, that data is "covered information" under SOPPA. This includes any personally identifiable information created or provided by a student, parent, or school employee in the course of using our services.

7.2 Our Commitments Under SOPPA

• We do not sell, rent, lease, or trade covered information under any circumstances.
• We do not use covered information for targeted advertising on our site or any other site.
• We do not use covered information to build profiles about students for any non-educational purpose.
• We implement and maintain security procedures that meet or exceed industry standards to protect covered information.
• We delete or transfer covered information back to the school when it is no longer needed or upon the school's request, within 60 days.
• We provide schools with an updated list of any third parties or subprocessors who may access student data, updated at the beginning of each state fiscal year and calendar year.

7.3 Written Agreements with Schools

Before receiving any student data from an Illinois public school district, we execute a written agreement (which may be in electronic form) that specifies: the categories of covered information to be provided, the educational product or service being offered, the authorized uses of covered information, breach cost allocation, data deletion timelines, and security requirements.

Grassroot Academy has signed the Illinois National Data Privacy Agreement (IL-NDPA) v1.0a and offers a General Offer of Privacy Terms to qualifying school districts. View the Student Data Privacy Agreement (IL-NDPA) tab →

7.4 Breach Notification to Schools

In the event of a data breach affecting covered information, we will notify the affected school or school district as expediently as possible and no later than 30 calendar days after determining the breach occurred. The notification will include the date of the breach, a description of the affected information, and recommended steps.

8. FERPA Compliance (For Schools)

When schools use our services, we comply with the Family Educational Rights and Privacy Act (FERPA):

• We act as a "school official" with a legitimate educational interest under 34 CFR 99.31(a)(1)
• We use education records solely for educational purposes authorized by the school
• We maintain strict data security and confidentiality measures
• We do not re-disclose education records except as permitted by FERPA
• We assist schools with parent access requests as required by FERPA

9. Data Security

We implement and maintain reasonable security procedures and practices that meet or exceed industry standards, as required by SOPPA and the Illinois Personal Information Protection Act:

• Encryption: Data is encrypted in transit (HTTPS/TLS 1.2+) and at rest in our database
• Access Controls: Role-based access controls, multi-factor authentication for staff, and principle of least privilege
• Password Security: User passwords are cryptographically hashed; we never store or transmit plaintext passwords
• Monitoring: Continuous security monitoring, logging, and periodic auditing
• Secure Development: Regular security reviews, dependency updates, and vulnerability patching
• Incident Response: Documented incident response procedures for identifying, containing, and remediating security incidents

10. Breach Notification

In the event of a data breach involving personal information, we will:

• Schools (SOPPA): Notify affected school districts within 30 calendar days of determining a breach occurred
• Illinois Residents (PIPA): Notify affected individuals in the most expedient time possible and without unreasonable delay
• Illinois Attorney General: Notify the Illinois Attorney General if the breach affects more than 500 Illinois residents
• Parents: Notify parents of affected students within 30 calendar days

Breach notifications will include: the date of the breach, a description of the personal information involved, steps we are taking in response, contact information for questions, and resources from the Federal Trade Commission.

11. Your Privacy Rights

All Users

You have the right to:

• Access your personal information — request a copy of all data we hold about you
• Correct inaccurate information
• Delete your data — request deletion of your account and associated data
• Opt-out of non-essential data processing (e.g., analytics cookies)
• Data portability — request your data in a machine-readable format
• Withdraw consent where applicable

Parents and Guardians

For users under 18, parents and guardians have the right to:

• Inspect and review all personal information we have collected from their child
• Request correction of inaccurate information
• Request deletion of their child's information
• Refuse further collection and withdraw consent for data processing
• Receive copies of their child's learning progress and educational records

How to Exercise Your Rights

To exercise any privacy right, contact us using one of these methods:

• Email: headmaster@grassroot.academy — include "Privacy Request" in the subject line
• Mail: Grassroot Academy, Attn: Privacy, Illinois, United States

We will verify your identity (or your authority as a parent/guardian) and respond within 10 business days. Deletion requests will be completed within 30 days of verification. We will not discriminate against you for exercising your privacy rights.

12. State-Specific Rights

Illinois Residents

Under the Illinois Student Online Personal Protection Act (SOPPA), the Illinois Personal Information Protection Act (PIPA), and other Illinois law, you have the right to:

• Know what personal and student data we collect, how we use it, and to whom we disclose it
• Request deletion of your or your child's data
• Be notified of data breaches in accordance with Illinois law
• File a complaint with the Illinois Attorney General if you believe your rights have been violated

Illinois Attorney General Consumer Fraud Bureau: 1-800-386-5438 or illinoisattorneygeneral.gov

California Residents

Under the California Consumer Privacy Act (CCPA), you have additional rights including the right to know what personal information we collect, delete your information, and opt-out of any "sales" (we do not sell personal information).

Other States

Residents of Virginia, Colorado, Connecticut, Utah, and other states with consumer privacy laws may have additional rights. Contact us at headmaster@grassroot.academy to exercise these rights.

13. International Users

While Grassroot Academy is based in the United States, users from other countries should note:

• Your information will be transferred to and processed in the United States
• We comply with applicable international data protection laws
• We provide privacy rights consistent with global best practices

14. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy with a new "Last Updated" date
• Sending an email notification for significant changes
• Obtaining new consent where required by law (including new parental consent under COPPA when the changes are material)

15. Contact Information

Acknowledgment for Users Under 18: By using Grassroot Academy, users under 18 confirm they have permission from a parent or guardian. Parents can contact us anytime at headmaster@grassroot.academy to review, correct, or request deletion of their child's information.

Disclaimer: This Privacy Policy is provided for transparency and compliance purposes. It does not constitute legal advice. If you have questions about your rights under Illinois law, contact the Illinois Attorney General's office or consult a qualified attorney.