Privacy Policy for Grassroot Academy

1. Introduction

Welcome to Grassroot Academy ("we," "us," or "our"). We are committed to protecting the privacy and security of our users' personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information from users of our website (www.grassroot.academy) and our AI-powered educational services.

Grassroot Academy is based in Illinois, United States, and provides educational technology services to K-12 students, college/university students, and individual learners of all ages.

2. Information We Collect

Information You Provide Directly

We collect information that you voluntarily provide when creating an account or using our services:

• Account Information: Name, email address, phone number
• Student Profile Information: Age, grade level, educational institution
• Interest and Background Information: Hobbies, interests, learning preferences (used solely to personalize the educational experience)
• Educational Content: Text inputs, voice recordings, drawings, and other content you create while using our AI-powered learning tools
• Academic Performance Data: Progress tracking, assessment results, learning analytics, and achievement data

Information Collected Automatically

When you use our services, we automatically collect:

• Usage Information: How you interact with our AI tools, features used, session duration
• AI Interaction Data: Questions asked, responses received, learning patterns
• Cookies and Analytics: We use cookies and Google Analytics to improve our services and user experience

Information We Do NOT Collect

We do not collect:

• Payment card information directly (payments are processed by our third-party provider, Stripe)
• Precise location data
• Device-specific information beyond basic browser type

3. How We Use Your Information

We use the collected information solely for educational purposes and to improve our services:

• Provide Educational Services: Deliver personalized AI-powered learning experiences
• Track Academic Progress: Monitor learning outcomes and provide progress reports
• Personalize Learning: Adapt content based on interests, age, and learning style
• Improve Our Platform: Enhance our AI algorithms and educational content
• Communicate: Send service updates, educational resources, and respond to inquiries
• Safety and Security: Ensure a safe learning environment and prevent misuse

We do NOT sell, rent, or share your personal information with third parties for their marketing purposes.

4. Information Sharing and Disclosure

We share information only in these limited circumstances:

• Service Providers: With trusted third parties who help us operate our platform (e.g., AWS for hosting, Stripe for payment processing)
• Educational Institutions: With schools or universities when you access our services through an institutional account, and only as permitted by FERPA
• Parents/Guardians: For users under 18, with verified parents or guardians upon request
• Legal Requirements: When required by law, court order, or to protect rights and safety
• Consent: With your explicit consent

5. Children's Privacy (COPPA Compliance)

Users Under 13

We take special precautions for users under 13 in compliance with the Children's Online Privacy Protection Act (COPPA) and the 2025 FTC updates:

• Parental Consent Required: Children under 13 may only use our services with verifiable parental consent
• Separate Consent for Third-Party Disclosure: We obtain separate parental consent before disclosing children's personal information to third parties for any purpose, including educational partnerships
• Parental Rights: Parents can review, delete, or restrict further collection of their child's information at any time
• Limited Collection & Retention: We collect only information necessary for educational purposes and retain it only as long as reasonably necessary to fulfill the specific educational purpose for which it was collected
• No Behavioral Advertising: We never use children's data for targeted advertising, marketing, or building behavioral profiles for commercial purposes
• No Sale or Monetization: We do not sell, rent, or monetize children's personal information under any circumstances
• No Indefinite Retention: We do not retain children's personal information for speculative or undefined future uses

School Exception

When students access Grassroot Academy through their school, the school may provide consent on behalf of parents under COPPA's "school official" exception. In such cases:

• Data collection is limited to what is reasonably necessary for the educational activity
• Student data is used solely for educational purposes authorized by the school
• We do not use student data for commercial purposes unrelated to the educational service
• Parents retain all rights to access and control their child's information

To provide consent or exercise parental rights, contact us at headmaster@grassroot.academy.

6. Educational Records (FERPA Compliance)

When Grassroot Academy is used by educational institutions, we comply with the Family Educational Rights and Privacy Act (FERPA). FERPA protects the privacy of student education records maintained by schools that receive federal funding.

Our Role as a School Official

When we receive education records from schools, we act as a "school official" under FERPA's School Official Exception. This means:

• Legitimate Educational Interest: We perform institutional services and functions for the school
• Direct School Control: We are under the direct control of the school with respect to use and maintenance of education records
• Limited Use: We use education records solely for authorized educational purposes and do not redisclose personally identifiable information (PII) without consent
• No Commercial Use: We do not use education records for advertising, marketing, or any commercial purpose unrelated to educational services

Parent and Student Rights Under FERPA

• Right to Inspect and Review: Parents and eligible students have the right to inspect and review education records
• Right to Request Amendment: Parents and eligible students can request corrections to inaccurate or misleading records
• Right to Consent to Disclosures: Generally, schools must obtain written consent before disclosing education records
• Right to File a Complaint: Parents and eligible students may file complaints concerning alleged FERPA violations with the U.S. Department of Education

Data Agreements with Schools

Our contracts with educational institutions include:

• Detailed descriptions of what data is collected and how it is used
• Security measures to protect education records
• Limits on redisclosure of personally identifiable information
• Requirements for data deletion or return upon contract termination

Note: Grassroot Academy cannot be held directly liable for FERPA violations (only educational institutions can), but we are committed to supporting our partner schools' FERPA compliance obligations.

7. AI-Powered Learning and Data Use

As an AI-powered educational platform, we want to be transparent about how artificial intelligence is used in our services:

How AI Uses Student Data

• Personalized Learning: Our AI analyzes student interactions to provide customized educational content and adapt to individual learning styles
• Progress Tracking: AI evaluates student responses to track academic progress and identify areas needing additional support
• Content Generation: AI generates educational explanations, practice problems, and feedback tailored to each student
• Safety Monitoring: AI helps detect and prevent inappropriate content or unsafe interactions

AI Model Training and Student Data

• No Training on Children's Data: We do not use personal information from users under 13 to train our AI models
• Aggregated Data Only: For users 13 and older, we may use aggregated, de-identified data to improve our AI's educational effectiveness
• Opt-Out Available: Users can opt out of having their data used for AI improvement purposes
• Human Oversight: AI-generated content is designed with safety measures and human oversight protocols

Third-Party AI Services

Our platform may integrate with third-party AI providers (such as OpenAI, Anthropic, or Google AI). When using these services:

• We implement data processing agreements that prohibit use of student data for model training
• Student queries are anonymized or pseudonymized before being sent to third-party AI services
• We do not share personally identifiable information with AI providers without explicit consent

8. International Users (GDPR Compliance)

For users in the European Union, you have additional rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Restriction: Limit processing of your personal data
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing activities

To exercise these rights, contact headmaster@grassroot.academy.

9. Data Retention

We retain your information for the following periods:

• Active Account Data: During active use and for 3 years after account closure
• Educational Records: 7 years (or as required by applicable state law)
• Academic Performance Data: 3 years after last activity
• AI Interaction History: 2 years for service improvement purposes
• Analytics Data: 3 years

You may request deletion of your account and associated data at any time through your account settings or by contacting us.

10. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Limited access to personal information by authorized personnel only
• Secure data centers in the United States (and local regions as we expand)

However, no internet transmission is 100% secure. We encourage users to protect their account credentials.

11. Your Rights and Choices

Account Management

• Access and update your information through account settings
• Delete your account and all associated data through settings
• Download your data in a portable format

Communication Preferences

• Opt-out of non-essential emails through email preferences
• Control notification settings in your account

Cookies

• Most browsers allow you to refuse cookies
• Note: Disabling cookies may limit functionality

12. Third-Party Services

Our service integrates with:

• Stripe: For payment processing (we do not store payment information)
• Google Analytics: For usage analytics
• AWS: For secure cloud hosting

These services have their own privacy policies governing their data practices.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy with a new "Last Updated" date
• Sending an email notification for significant changes
• Obtaining consent where required by law

14. Contact Information

14. State-Specific Rights

California Residents

Under the California Consumer Privacy Act (CCPA), you have additional rights including the right to know what personal information we collect, delete your information, and opt-out of any "sales" (though we do not sell personal information).

Other States

Residents of Virginia, Colorado, Connecticut, and Utah may have additional rights under state privacy laws. Contact us to exercise these rights.

Acknowledgment for Users Under 18: By using Grassroot Academy, users under 18 confirm they have permission from a parent or guardian. Parents can contact us anytime to review or request deletion of their child's information.