Privacy Policy for Grassroot Academy

1. Introduction

Welcome to Grassroot Academy ("we," "us," or "our"). We are committed to protecting the privacy and security of our users' personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard information from users of our website (www.grassroot.academy) and our AI-powered educational services.

Grassroot Academy is based in Illinois, United States, and provides educational technology services to K-12 students, college/university students, and individual learners of all ages.

2. Information We Collect

Information You Provide Directly

We collect information that you voluntarily provide when creating an account or using our services:

• Account Information: Name, email address, phone number
• Student Profile Information: Age, grade level, educational institution
• Interest and Background Information: Hobbies, interests, learning preferences (used solely to personalize the educational experience)
• Educational Content: Text inputs, voice recordings, drawings, and other content you create while using our AI-powered learning tools
• Academic Performance Data: Progress tracking, assessment results, learning analytics, and achievement data

Information Collected Automatically

When you use our services, we automatically collect:

• Usage Information: How you interact with our AI tools, features used, session duration
• AI Interaction Data: Questions asked, responses received, learning patterns
• Cookies and Analytics: We use cookies and Google Analytics to improve our services and user experience

Information We Do NOT Collect

We do not collect:

• Payment card information directly (payments are processed by our third-party provider, Stripe)
• Precise location data
• Device-specific information beyond basic browser type

3. How We Use Your Information

We use the collected information solely for educational purposes and to improve our services:

• Provide Educational Services: Deliver personalized AI-powered learning experiences
• Track Academic Progress: Monitor learning outcomes and provide progress reports
• Personalize Learning: Adapt content based on interests, age, and learning style
• Improve Our Platform: Enhance our AI algorithms and educational content
• Communicate: Send service updates, educational resources, and respond to inquiries
• Safety and Security: Ensure a safe learning environment and prevent misuse

We do NOT sell, rent, or share your personal information with third parties for their marketing purposes.

4. Information Sharing and Disclosure

We share information only in these limited circumstances:

• Service Providers: With trusted third parties who help us operate our platform (e.g., AWS for hosting, Stripe for payment processing)
• Educational Institutions: With schools or universities when you access our services through an institutional account, and only as permitted by FERPA
• Parents/Guardians: For users under 18, with verified parents or guardians upon request
• Legal Requirements: When required by law, court order, or to protect rights and safety
• Consent: With your explicit consent

5. Children's Privacy (COPPA Compliance)

Users Under 13

We take special precautions for users under 13 in compliance with COPPA:

• Parental Consent Required: Children under 13 may only use our services with verifiable parental consent
• Parental Rights: Parents can review, delete, or restrict further collection of their child's information
• Limited Collection: We collect only information necessary for educational purposes
• No Behavioral Advertising: We never use children's data for targeted advertising

To provide consent or exercise parental rights, contact us at headmaster@grassroot.academy.

6. Educational Records (FERPA Compliance)

When we receive education records from schools:

• We act as a "school official" under FERPA
• We use education records solely for educational purposes
• We do not disclose education records except as directed by the school or parent
• Parents maintain rights to access and control their child's education records

7. International Users (GDPR Compliance)

For users in the European Union, you have additional rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Restriction: Limit processing of your personal data
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing activities

To exercise these rights, contact headmaster@grassroot.academy.

8. Data Retention

We retain your information for the following periods:

• Active Account Data: During active use and for 3 years after account closure
• Educational Records: 7 years (or as required by applicable state law)
• Academic Performance Data: 3 years after last activity
• AI Interaction History: 2 years for service improvement purposes
• Analytics Data: 3 years

You may request deletion of your account and associated data at any time through your account settings or by contacting us.

9. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Limited access to personal information by authorized personnel only
• Secure data centers in the United States (and local regions as we expand)

However, no internet transmission is 100% secure. We encourage users to protect their account credentials.

10. Your Rights and Choices

Account Management

• Access and update your information through account settings
• Delete your account and all associated data through settings
• Download your data in a portable format

Communication Preferences

• Opt-out of non-essential emails through email preferences
• Control notification settings in your account

Cookies

• Most browsers allow you to refuse cookies
• Note: Disabling cookies may limit functionality

11. Third-Party Services

Our service integrates with:

• Stripe: For payment processing (we do not store payment information)
• Google Analytics: For usage analytics
• AWS: For secure cloud hosting

These services have their own privacy policies governing their data practices.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by:

• Posting the updated policy with a new "Last Updated" date
• Sending an email notification for significant changes
• Obtaining consent where required by law

13. Contact Information

14. State-Specific Rights

California Residents

Under the California Consumer Privacy Act (CCPA), you have additional rights including the right to know what personal information we collect, delete your information, and opt-out of any "sales" (though we do not sell personal information).

Other States

Residents of Virginia, Colorado, Connecticut, and Utah may have additional rights under state privacy laws. Contact us to exercise these rights.

Acknowledgment for Users Under 18: By using Grassroot Academy, users under 18 confirm they have permission from a parent or guardian. Parents can contact us anytime to review or request deletion of their child's information.