Privacy Policy

Last updated: May 26, 2026 · Version 1.0

AdaptEd is a personalized K-12 AI tutor used by families with children of all ages. This policy explains what data we collect, why, where it goes, and the rights you have over it. It is written in plain English on purpose. If anything is unclear, contact us at Diego@learnadapted.com.

1. Who we are

AdaptEd is operated by Adapted Education. We are the data controller for the information collected through the AdaptEd application. Our contact email is Diego@learnadapted.com.

2. Children's privacy and parental consent (COPPA)

AdaptEd is designed for use by children, including those under 13. Under the U.S. Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from a child under 13 without verifiable parental consent.

During signup, the parent or legal guardian acknowledges they are over 18, that they are the parent or legal guardian of any child added to the account, and that they consent to AdaptEd's collection and use of that child's information as described in this policy. We record the time and policy version of every consent for audit purposes.

A parent or legal guardian may at any time: (a) review the information we have collected about their child, (b) request deletion of that information, or (c) refuse to permit further collection or use. The dashboard includes self-service controls for (a) and (b); for (c), email Diego@learnadapted.com and we will respond within 14 days.

3. What we collect

From parents we collect:

• Name, email address, password (stored hashed by Supabase)
• Communications you send us (support emails, feedback)

From children (with parental consent) we collect:

• First name (or any display name the parent enters), grade level
• A 4-digit PIN the child uses to log in (stored hashed)
• Photos of homework or worksheets the child uploads
• Answers, learning activity, time spent on lessons, and detected misconceptions
• Optional feedback ratings and short text comments the child writes about a lesson

We do not collect: precise geolocation, contact lists, persistent device identifiers used for ad tracking, or biometric data. We do not show advertisements and we do not sell or rent personal information to anyone.

4. How we use the information

• Generate personalized lesson content, practice questions, and reteach videos
• Diagnose and adapt to the specific misconception each child has
• Provide parents with progress summaries
• Operate, maintain, and improve the service
• Detect and prevent abuse
• Comply with legal obligations

5. Third-party service providers

We use a small number of vetted vendors as data processors. Each one has signed a Data Processing Agreement with us where required and processes data only on our instructions.

• Supabase — hosted Postgres database, authentication, and file storage
• Vercel — application hosting
• Anthropic (Claude) — generates lesson content and reads homework photos to identify what concept the child is working on
• OpenAI — generates text embeddings used to match uploaded worksheets to our concept library
• ElevenLabs — generates the voice narration for lesson videos
• Resend — sends transactional emails (parent NPS check-ins, weekly summaries)
• Cloudflare — DNS and CDN for the marketing site

These vendors may process the child's display name, grade level, the content of an uploaded worksheet, and the AI-generated lesson text for the limited purpose of providing their service to us. They are contractually prohibited from using the data for any other purpose, including training models on it.

6. Data retention

• Homework photos: automatically deleted 30 days after upload.
• Generated lesson videos: cached indefinitely so the same concept doesn't need to be regenerated for the next child; deleted on account deletion.
• Learning activity and progress data: retained for as long as the account is active, then deleted within 30 days of account deletion (some derived aggregate statistics with no PII may persist).
• Account records (parent email, login): retained for as long as the account is active.

7. Your rights and choices

You have the right to access, correct, delete, and obtain a portable copy of personal data we hold about you or your child. You can:

• View everything we have on your family at Dashboard → View my data
• Download your full data set as JSON at Dashboard → My data → Export JSON
• Delete a child profile and all associated data from the kid's profile page (cascading deletion is immediate)
• Delete your entire account from Dashboard → Delete account; this withdraws consent and removes every kid you've added
• Email Diego@learnadapted.com for corrections or any request the in-app tools don't cover

We respond to verified requests within 14 days (and to deletion within 24 hours via the in-app tool). We honor these rights nationwide regardless of which state you live in.

7.1 State-specific rights

Residents of the following states have additional protections under state privacy laws. We treat these rights as applying to every AdaptEd user, not just residents:

• California (CCPA / CPRA): right to know what categories of personal information we collect, sources, purposes, and third parties; right to delete; right to correct; right to opt out of the sale or sharing of personal information; right to limit use of sensitive personal information; right against retaliation for exercising these rights. We do not sell or share personal information.Your "sale/share" opt-out is therefore implicit.
• Virginia (CDPA): right to access, correct, delete, obtain a portable copy; right to opt out of targeted advertising, sale, or profiling for decisions with legal/similarly significant effects. We do not engage in any of these.
• Colorado (CPA): right to access, correct, delete, obtain a portable copy; right to opt out of targeted advertising, sale, or profiling.
• Connecticut (CTDPA): right to access, correct, delete, obtain a portable copy; right to opt out of targeted advertising, sale, or profiling.
• Utah (UCPA): right to access, delete, obtain a portable copy; right to opt out of sale of personal data and targeted advertising.

To exercise any of these rights: use the in-app dashboard for the common cases (view, export, delete) or email Diego@learnadapted.com. We verify your request by sending a confirmation to the parent email on file and require you to click a link before we act. You may appeal a denied request by replying to that email.

8. Security

We use industry-standard practices: TLS in transit, encrypted-at-rest databases through Supabase, hashed passwords and PINs, private file storage, row-level security policies that prevent one family from reading another's data, least-privilege server-only API keys, and an admin access audit log for every privileged action. We are working toward SOC 2 Type II readiness as part of our enterprise sales preparation. No system is perfectly secure, but we will notify affected parents promptly if we ever discover a breach.

9. International users

AdaptEd is operated from the United States. If you access AdaptEd from outside the U.S., your information is transferred to and processed in the U.S. By using AdaptEd you consent to that transfer.

10. Changes to this policy

We may update this policy when we add features or change how data is processed. If a change is material — meaning it affects how we collect or share children's data — we will email you and require renewed parental consent before applying it to existing accounts. The current version is shown at the top of this page.

11. Contact

Questions, requests, or complaints: Diego@learnadapted.com.

See also: Terms of Service · Pilot Agreement