Privacy Policy

1. Who This Applies To

This policy covers how Outstanda collects and uses information from parent users, school users (teachers and administrators), and students who use the platform.

2. Information We Collect

From parents and school users:

• Name and email address, used for account access and transactional emails.
• Billing information — handled entirely by Stripe. We never see or store card numbers.
• IP address and basic device info for security and abuse prevention.

From students:

• First name, last name, username, grade level, and birth year.
• Educational activity data — answers, scores, levels reached, and time spent.
• Writing submissions — text entered during writing activities.
• Focus session data — tab-switch and inactivity signals used to generate a weekly focus score shown to parents and teachers.

We do not collect student email addresses, phone numbers, photos, precise location, or any social or behavioral data outside of the platform.

3. How We Use Information

We use collected information only to:

• Operate the platform — scheduling assignments, tracking progress, generating parent and teacher reports.
• Evaluate writing using an AI assistant (OpenAI API). Writing text is sent to OpenAI solely for scoring; it is not used to train AI models per our data processing agreement with OpenAI.
• Send transactional emails — login links and billing receipts only.
• Improve platform content using aggregated, de-identified data.

We do not use data for advertising, behavioral profiling, or any commercial purpose beyond providing the service.

4. Children's Privacy — COPPA Notice

Parental consent: Before a child under 13 is added to the platform, the parent or guardian must check a consent box confirming their relationship to the child and agreement to this Privacy Policy. We record the timestamp of that consent alongside the student record.

What we collect from children under 13: First name, last name, username, grade, birth year, and educational activity data as described in Section 2. We do not collect email addresses or contact information from children directly.

How we use children's data: Solely to deliver the educational service to that child. We do not use it for advertising, cross-site tracking, or any commercial purpose. We do not sell it or share it with third parties for marketing.

AI writing evaluation: Writing submissions are sent to the OpenAI API for automated scoring and feedback. OpenAI processes this data under a data processing agreement and does not use it for model training. No student name or identifying information is included in the text sent to OpenAI.

School accounts and FERPA: When a school enrolls students, the school acts as the responsible party for parental consent under FERPA. Schools represent to us that they have the legal authority to enroll the students they add.

Parental rights — you may at any time:

• Review the personal information collected about your child.
• Request correction of inaccurate information.
• Request deletion of your child's account and all associated data.
• Withdraw consent — which will result in the student account being deactivated.

To exercise any of these rights, email [email protected]. We will respond within 10 business days.

5. Data Retention

We retain student data for as long as the account is active. When a parent cancels their subscription or requests deletion, student data is permanently deleted within 30 days. Aggregated, de-identified performance data may be retained for platform improvement.

6. Data Security

Student PINs are stored as bcrypt hashes — never in plain text. All data is transmitted over HTTPS. We do not store payment card information. Access to student data is restricted to the parent who created the account, authorized school staff, and platform administrators.

7. Third Parties

We use a small number of third-party services to operate the platform:

• Stripe — payment processing. Subject to Stripe's Privacy Policy.
• Amazon SES — transactional email delivery.
• OpenAI — AI writing evaluation. Processing is governed by a data processing agreement; data is not used for model training.

We do not use advertising networks, analytics trackers, or social media pixels on student-facing pages.

8. Changes to This Policy

If we make material changes to this Privacy Policy — particularly to how we handle children's data — we will notify parents by email at least 14 days before the change takes effect and will require re-consent where required by law.

9. Contact

Privacy questions or data requests: [email protected]
General support: [email protected]