Privacy Policy

The Short Version — Plain English

We collect only what we need: your name, email, role, and learning progress.

Student data is never sold, shared for advertising, or used for any purpose outside this platform.

The AI sandbox sends only your typed prompt to Google Gemini — no name, no email, no identifying information.

Only you and your district administrator can see your data. We cannot share it with other districts or third parties.

Data is stored in the United States on Supabase (SOC 2 Type II certified infrastructure).

You or your district can request deletion of your data at any time.

1 Who We Are 2 Information We Collect 3 How We Use Your Information 4 Who Can See Your Data 5 The AI Sandbox — A Special Note 6 Student Privacy (FERPA, SOPPA, COPPA) 7 Data Security & Storage 8 Data Retention 9 Your Rights 10 Contact Us

1 Who We Are

This Privacy Policy applies to the EnhanceED AI Literacy Platform (the "Platform"), operated by EnhanceED LLC, an Illinois-based company founded by Michael Theriault, Ed.D. The Platform is an online professional development and AI literacy tool designed for K-12 educators, students, and district administrators.

Contact: contact@mtinnovations.ai

2 Information We Collect

We collect only the information necessary to provide the Platform's educational services.

Data Type	What It Is	Why We Collect It
Account Information	Full name, email address, role (teacher, student, or administrator)	Create and manage your account; route you to the correct experience
District Association	Which district license you accessed through (via access code)	Associate you with your district for reporting and administration
Learning Progress	Which modules you started and completed; completion timestamps	Show your progress, unlock sequential modules, generate certificates
Assessment Data	Quiz and pretest answers; scores	Place teachers in the right learning track; generate district reports
AI Sandbox Prompts	Text you type into the practice sandbox	Sent to Google Gemini to generate a response — not stored by us after the session

We do not collect: Social Security numbers, financial information, health information, precise geolocation, browsing history outside the platform, or any biometric data.

3 How We Use Your Information

We use the information we collect solely to operate and improve the Platform:

Authenticate your account and maintain your session
Display your learning progress and XP on your dashboard
Unlock modules sequentially based on completion
Provide district administrators with completion reports for their staff or students
Generate placement recommendations from the pretest (teachers only)
Improve the Platform's content and functionality over time

We do not use your information for advertising, sell it to third parties, or use it to build behavioral profiles for any purpose outside the Platform.

4 Who Can See Your Data

Who	What They Can See	How It's Enforced
You	Your own profile, progress, and scores	Supabase Row Level Security (RLS)
Your District Admin	Names, progress, and scores of users in their district only	RLS restricts access to same district_id only
EnhanceED AI (super_admin)	All platform data — for support, maintenance, and aggregate reporting	Requires separate super_admin role; access logged
Other districts	Nothing — complete data isolation between districts	RLS enforced at the database level, not just the application level
Third parties	None, except as required by law or described in this policy	No third-party analytics, ad networks, or data brokers

5 The AI Sandbox — A Special Note

The Platform includes a practice AI sandbox powered by Google Gemini 2.5 Flash. Here is exactly what happens when you use it:

Only the text you type is sent to Google Gemini via a secure server-side function.
Your name, email address, user ID, and all account information are not included in the request to Google.
The Platform does not store your sandbox prompts or Gemini's responses after the session ends.
Google processes the prompt under its own privacy policy and Google Workspace for Education terms, where applicable.

ℹ️

For Illinois Google districts: Most Illinois K-12 districts that use Google Workspace for Education already have agreements with Google covering Gemini usage. Because the Platform is built around Google's AI tools — the same tools your district has likely already approved — no additional parent consent process is typically required beyond your existing Google agreements. We recommend confirming with your district's IT or legal team if you have questions specific to your district.

⚠️

Sandbox privacy best practice: The Platform instructs users not to enter student names, identifying information, or confidential school data into sandbox prompts. The sandbox is designed for practicing with generic scenarios.

6 Student Privacy (FERPA, SOPPA, COPPA)

✓ FERPA Aligned

✓ Illinois SOPPA

ℹ COPPA — See Below

FERPA (Family Educational Rights and Privacy Act): The Platform operates as a "school official" providing services on behalf of the district under FERPA. Districts retain ownership and control of their students' educational records. EnhanceED AI accesses student data only to provide the Platform's services, not for any independent purpose.

Illinois SOPPA (Student Online Personal Protection Act, 105 ILCS 85): EnhanceED AI complies with Illinois SOPPA requirements for operators of online services directed to students:

Student data is not sold or rented to third parties
Student data is not used to build advertising profiles
Student data is not disclosed for commercial purposes unrelated to education
Districts may request deletion of their students' data at any time
We will notify districts without unreasonable delay of any unauthorized access to student data

COPPA (Children's Online Privacy Protection Act): The Platform is designed for K-12 use and is recommended for students in grades 9–12 and educators. It is not directed at children under 13 as a primary audience. Districts using the Platform with students under 13 are responsible for ensuring appropriate parental consent in accordance with COPPA requirements. We recommend limiting Platform access to students age 13 and older unless your district has obtained the necessary consents.

7 Data Security & Storage

All Platform data is stored in the United States on Supabase (Supabase Inc.), which runs on AWS infrastructure in the US-East region. Supabase is SOC 2 Type II certified and provides enterprise-grade security controls.

Security measures include:

All data transmitted over HTTPS/TLS encryption
Row Level Security (RLS) policies enforced at the database level — not just the application layer
Supabase Auth handles password hashing and session management (passwords are never stored in plaintext)
The AI sandbox function runs server-side, keeping API keys out of the browser
District data is logically isolated — no query can return another district's data

🔒

No student PII touches the AI model. The sandbox Edge Function strips all user context before calling Gemini. The only thing Google receives is the text of the prompt itself.

8 Data Retention

We retain your data for as long as your district's license is active and as needed to provide the Platform's services.

Active accounts: Data is retained for the duration of the district's license agreement.
License expiration: We will contact the district at least 30 days before expiration. Districts may export their data and/or request deletion.
Account deletion requests: Honored within 30 days. Assessment records required for certificate verification may be retained in anonymized form for up to 1 year.
AI sandbox prompts: Not retained — they are processed in real time and discarded after the response is returned.

9 Your Rights

Depending on your role and applicable law, you or your district may have the right to:

Access the personal data we hold about you or your students
Correct inaccurate information in your account
Delete your account and associated data
Export your district's data in CSV format (available in the Admin Dashboard)
Restrict processing in certain circumstances under applicable law

To exercise any of these rights, contact us at contact@mtinnovations.ai. District administrators may also use the Admin Dashboard export function for data access and portability.

Questions? Contact Us.

If you have questions about this policy, want to request data deletion, or need a signed Data Processing Agreement (DPA) for your district, reach out directly.

EnhanceED LLC
Michael Theriault, Ed.D.
contact@mtinnovations.ai

We respond to privacy inquiries within 5 business days. View our DPA template →