Privacy Notice

1. Who controls your data

Engaged Education LLC, trading as engagED, is the data controller for personal data we process to operate engagED. This notice describes our teacher-facing AI lesson planning service. For privacy questions or requests, contact engagededucationsupport@gmail.com.

2. What we collect and why

• Account and profile information: your name, preferred name, email, sign-in identifiers and authentication credentials, school details, and homeschool preferences. We use this to create and secure your account and personalize the service (contract performance; legitimate interests in account security).
• Teaching content: class details, curriculum or standards documents, lesson plans, materials, prompts and chat messages, standing preferences, and lesson feedback. We process this to provide AI-assisted planning, generate resources, and adapt suggestions to your classes (contract performance).
• Optional Canvas connection: your Canvas site address, access token, selected course information, and course resources retrieved through your connection. We use this to connect your courses and inform lesson planning at your request (contract performance). Tokens are encrypted in storage.
• Usage and technical information: lesson and material generation and regeneration events, activity timestamps, IP addresses, browser and device information in operational logs, errors, and security records. We use these to operate, troubleshoot, protect, and improve the service and understand usage (legitimate interests in service reliability, fraud prevention, and improvement).
• Credit and purchase records: credit balances and ledger entries, purchase references, amounts, and payment status received from Paddle. We use these to fulfill purchases, maintain credit balances, resolve disputes, and keep required financial records (contract performance and legal obligations).
• Support correspondence: your email address and messages you send us. We use these to answer questions, handle privacy and refund requests, and resolve problems (contract performance, legitimate interests in customer support, or legal obligation, depending on the request).

If you use an outside sign-in provider, we receive the identity information that provider makes available for authentication, such as your email and name. Any optional processing requiring consent will be explained when requested; you can withdraw that consent.

3. AI processing and student information

Relevant prompts, teaching context, documents, and requests are transmitted through Lovable's AI services to the AI providers used to produce responses and images. Only submit content you are authorized to share. AI responses may contain information from the context you provide.

engagED is intended for educators, not student accounts or direct use by children. Do not upload identifiable student records, names, health details, or other sensitive student data. Use anonymized classroom context. If you believe a child's personal data or student records were submitted, contact us to request removal.

4. Who receives data

• Service providers: Lovable Cloud and its hosting, storage, authentication, and infrastructure providers; AI processing providers; and support or email providers where needed to operate the service.
• Paddle: our Merchant of Record receives information needed for product sales, payment processing, subscription management where applicable, tax compliance, invoicing, and refunds. Paddle handles payment information under its own privacy notice; we do not store full payment card details.
• Connections and sharing you choose: Canvas receives requests necessary for your connection. Anyone with an existing substitute share link may access the lesson packet you chose to share and submit feedback; treat these links as private.
• Professional advisers and authorities: legal or accounting advisers where necessary, and authorities when required by law or to protect legal rights and prevent fraud.

We do not sell your personal information. Access within our business is limited to authorized people who need it for support, administration, security, or compliance.

5. How long we keep data

We retain account details and saved teaching content while your account remains active and they are needed to provide the service. You can delete supported content in the app or request account and content deletion through support. After deletion or account closure, we delete or anonymize data when it is no longer needed, except where retention is necessary for legal obligations, resolving disputes, or security.

Purchase and credit records are retained for the period required by applicable accounting, tax, and legal obligations. Support correspondence and usage or security records are kept only as long as necessary for their stated purposes. Backups may retain deleted information temporarily until they expire through the normal backup cycle.

6. Cookies and browser storage

We and our providers use essential cookies or browser storage to maintain sign-in sessions, secure authentication, and support checkout. These are necessary to provide the functions you request. We do not currently use optional marketing or advertising cookies, and our generation usage records are service records rather than optional tracking cookies.

You can clear or block cookies and browser storage in your browser settings, but sign-in or checkout may stop working. If we introduce optional analytics or marketing cookies, we will explain them and provide consent and preference controls where required before using them.

7. Security and international processing

We use appropriate technical and organizational measures, including encrypted connections, access controls, account authentication, and encryption of stored Canvas access tokens. No online service can guarantee absolute security.

Our providers may process data in countries outside your own, including outside the UK or European Economic Area. Where applicable data protection law requires safeguards, we use appropriate transfer mechanisms, such as adequacy decisions or standard contractual clauses, together with additional measures where necessary. Contact us for information about safeguards applicable to your data.

8. Your privacy rights

Depending on your location and applicable law, you may request access, correction, deletion, restriction of processing, or a portable copy of your personal data; object to processing based on legitimate interests; and withdraw consent without affecting earlier lawful processing. We do not sell personal information or use it for targeted advertising.

Email engagededucationsupport@gmail.com to exercise your rights. We may need to verify your identity without collecting more information than necessary. For UK/EEA requests, we respond within one month, subject to lawful extensions that we will explain. Other requests are handled within the timeframe required by applicable law.

You may complain to your local data protection or privacy authority, including the relevant supervisory authority in the UK or EEA. We encourage you to contact us first so we can address your concern.

9. Changes to this notice

We may update this notice as the service changes. We will update the effective date and notify you of material changes through the service or email where appropriate.