Privacy Policy

Educational Purposes Only: All student data is used exclusively for educational assessment and classroom activities.

• Providing personality assessment results to help students understand themselves
• Enabling teachers to better understand their students’ learning styles
• Facilitating classroom discussions about personality differences and teamwork
• Maintaining individual student progress and quiz history

We Never:

• Market or advertise to students
• Sell student information to third parties
• Use student data for commercial purposes
• Contact students directly via email or other means
• Share individual student results outside the classroom

How We Comply with COPPA: Animal Genius operates under the “school consent” provision of COPPA, which allows schools to provide consent for educational services on behalf of students under 13.

We take student privacy seriously and implement industry-standard security measures:

• Encryption: All data is encrypted in transit and at rest
• Secure hosting: Data is stored with enterprise-grade cloud providers
• Access controls: Only authorized personnel can access student information
• Anonymous identifiers: Students use secure passport codes instead of personal login credentials
• Regular audits: We regularly review our security practices and procedures
• Data minimization: We collect only the minimum data necessary for educational purposes

We Do Not Sell or Share Student Information with third parties for commercial purposes.

All service providers who may access student data are required to:

• Use the data only for providing educational services
• Maintain the same level of privacy protection
• Not use student information for their own commercial purposes

Classtopia includes an educator-only community (“Zoo Keepers”) where teachers can share posts and, when the feature is enabled, send private direct messages to other teachers. These features are for adults only — students never have access to community content or messaging.

Keep student information out of messages: Community posts and direct messages are for professional collaboration between educators. Teachers should not share student personal information beyond the platform’s first-name-and-last-initial convention.

• Active use: Student data is retained while the school actively uses our platform
• On request: When a school asks us to delete its data — including when it stops using the platform — we complete the deletion within 30 days of the request
• Individual removal: Schools can ask us to delete specific student records, handled on the same 30-day timeline
• Students removed from a class: A student removed from every class is automatically and permanently deleted after a 30-day recovery window, which exists so an accidental removal can be undone
• Graduation/transfer: Schools typically manage student data when students leave their classroom
• Sign-in security logs: Our sign-in attempt log (including IP addresses, used only to detect and block abuse) is automatically deleted after 7 days and is never used for any other purpose
• Infrastructure logs: Our hosting and authentication providers keep their own short-term operational logs, which can include IP addresses, under their standard retention periods

We use minimal tracking technologies to operate our platform:

• Essential cookies: Required for login and basic platform functionality
• Session management: To maintain student and teacher sessions securely
• No advertising: We do not use cookies for advertising or marketing, we never place advertising networks on our pages, and we do not sell personal information (embedded YouTube video playback is described separately below)
• Product analytics: We record which features are used so we can improve the platform. Teacher activity events are linked to a teacher account identifier and are automatically deleted after 180 days; they are also deleted when the teacher’s account is deleted. Page-level traffic measurement excludes student pages entirely

Service providers we use: We rely on a limited set of vendors to run the platform. They process only what their service requires, may not use it for their own purposes, and none of them receive student data for marketing or advertising:

• Supabase — database and authentication hosting
• Vercel — application hosting, plus its traffic and performance measurement
• Stripe — subscription payments (teacher and school billing only)
• Intercom — in-app support chat, shown only to signed-in teachers
• Sentry — error monitoring, with personal information filtered before reports are sent
• Flodesk — email to teachers

YouTube video playback: Lesson and training videos are hosted on YouTube and embedded on teacher-facing pages through YouTube’s privacy-enhanced (no-cookie) player, with video thumbnails served from YouTube’s image servers. Loading a page with an embedded player or thumbnail transmits standard technical data (such as the page address and IP address) to YouTube, and the player sets no cookies until a video is played. When a video is played, YouTube (Google) processes viewing data under Google’s own privacy policy, not the vendor commitments above. Videos are embedded on teacher-facing pages and played on teacher-controlled screens; students do not need YouTube accounts and we send YouTube no student information.

• Breach notification: We will notify affected schools without undue delay, and no later than 72 hours after confirming a data breach affecting their student data
• Data residency: Our application and database are hosted in the United States. Some service providers listed above may process limited data (such as a teacher’s email or an error report) in other regions under their standard terms
• Vendor reviews: We are happy to complete district privacy and security questionnaires — contact us using the information below

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will:

• Update the “Last Updated” date at the top of this policy
• Notify schools and teachers via email about material changes
• Provide schools with at least 30 days notice for significant changes
• Give schools the opportunity to review changes before they take effect

If you have questions about this privacy policy or how we handle student information, please contact us:

For Parents: Please contact your child’s school or teacher first with privacy questions, as they are the primary administrators of student data in our platform.

For Schools: We’re committed to working with you to address any privacy concerns and ensure our platform meets your educational needs while protecting student information.