Privacy Policy

1. Information We Collect

• Account information: name, email, password (hashed), grade, country, board (for students in India), avatar, and an optional phone number.
• Parent / guardian contact: a parent or guardian email is required for every student account; a parent or guardian phone number is optional. We use them to notify the parent of the account's creation, to send class updates, and to handle parental requests (access, correction, deletion).
• Learning data: test results, mastery progress, lesson activity, spaced-repetition state, badges, and streak information generated through normal use of the Service.
• Live-class data: for live one-on-one or group classes booked through Glow Grades, we use Daily.co to deliver the video call and to produce a text transcript of the class audio. We do not store the underlying audio or video file. See Section 3 for the detailed retention rules.
• Messages: direct messages exchanged between teachers and students or families on the platform.
• Payment information: wallet top-ups and class payments are processed by Stripe, and teacher payout details are collected by Stripe (or, in all teacher payouts). We do not store your card or bank details.
• Technical data: browser type, device type, IP address, and approximate location (country only) for security, debugging, and platform reliability. If you turn on push notifications, a device token for your phone or tablet.
• Analytics: usage events to understand feature performance. See Section 5.

2. How We Use Your Information

• To provide and operate the Glow Grades learning experience.
• To generate personalized AI-powered practice questions, lessons, study plans, and progress reports.
• To produce post-class summaries for the teacher (a recap of topics covered and suggested follow-up) and a separate, age-appropriate summary for the student, and — at a teacher's request — an AI-generated analysis of a student's recent results to help the teacher plan.
• To process wallet top-ups, class payments, and teacher payouts via our payment providers (see Section 6).
• To send transactional emails (e.g., password resets, parent notifications, class reminders, post-class summaries). We do not send marketing emails without your consent.
• To send transactional WhatsApp messages at the phone number you provide (e.g., class summaries, class reminders ~15 min before scheduled classes, booking notifications to teachers, payment alerts). Consent is established when you create your account and accept our Terms with a phone number on file. You can opt out at any time by replying STOP to any WhatsApp message or by toggling the setting off in your account preferences.
• To send push notifications to your phone or tablet, only after you allow them on the device; each category can be switched off in the app.
• To investigate and prevent abuse, fraud, and security incidents.

We do not use student voice recordings or transcripts to train any machine-learning model, to identify any individual by voice (no voice biometrics), or for any advertising purpose.

3. Live Class Recording & AI Processing

When a teacher conducts a live class on Glow Grades, the class audio is processed in real time by Daily.co (our video-call provider) and transcribed into text. The resulting text transcript is sent to OpenAI (gpt-4o-mini) to produce structured summaries used by the platform. We do not retain the raw audio or video file.

• What is stored: the text transcript of the class audio, plus four derived AI-generated summaries (an internal admin analysis, a teacher recap, a parent-facing message draft, and a student-safe class recap).
• Who can read what:
  • The full transcript and the admin analysis are visible only to Glow Grades operations staff for quality monitoring.
  • The teacher recap is visible only to the teacher who taught the class.
  • The parent-facing message and the student-safe summary contain no verbatim quotes and are subject to a list of forbidden terms (no scores, no judgemental language, no admin metrics).
• Retention: the verbatim transcript is automatically deleted 30 days after the class ends — from our database and, by a deletion request to Daily.co, from their systems. The four derived summaries persist for the lifetime of the account because they contain no verbatim content.
• Not an emotion-recognition system: the "sentiment" field in our internal admin analysis describes the overall tone of a session (e.g., engaged, neutral, low energy) at session level, derived from text only. We do not classify individual student or teacher emotional states, and the field is never shown to students or parents. We believe this falls outside the scope of "emotion recognition systems" under EU AI Act Article 5.
• Notice: teachers and students see a notice on the live-class pre-join screen and in our Terms before joining a class. By joining, all participants consent to this transcription. Teachers and students may decline to use camera or microphone and still attend.

4. Children's Privacy (COPPA, GDPR, DPDP)

Glow Grades is designed for grades 1–12, which means our entire student user base consists of minors. We treat every student account as a minor account, regardless of jurisdiction.

• We require a parent or guardian email at signup. We notify the parent that the account has been created and explain how to access, correct, or delete the child's data. The parent may opt the child out at any time using the one-click link in that email or by contacting us at the address below; opting out deletes the student account and its data.
• We collect only the minimum information necessary to deliver the Service.
• We do not show advertisements inside the student learning area, and we do not run advertising or measurement trackers inside the learning area or on the sign-up page. We do not sell or rent children's data to anyone. On our public marketing pages we use limited, consent-based advertising-measurement cookies that are never used to profile children (see the Cookies and Analytics section below).
• Parents and guardians may at any time email hello@glowgrades.com to request a copy of their child's data, correct it, or have it deleted. We will action verified parental requests within 30 days.
• This section is intended to comply with the U.S. Children's Online Privacy Protection Act (COPPA) for children under 13, the General Data Protection Regulation (GDPR) Article 8 for children under 16 in the EEA / UK, and the Digital Personal Data Protection Act (DPDP) 2023 of India for users under 18.

5. Cookies & Analytics

We use a small number of cookies and similar technologies. Essential cookies (for login sessions and security) are always set when you use the Service — without them the Service cannot work. Non-essential analytics cookies (set by PostHog, our product-analytics provider) are only set after you accept them via the cookie banner shown on your first visit. You may decline analytics at any time by clicking "Decline" in the cookie banner; analytics will not be collected and any previously-set analytics cookies will not be reused. Separately from cookies, our servers record a small number of product events (for example "a test was completed") against your account id for signed-in actions, so we can see which features work; these never include transcript, message, or answer content.

On our public marketing pages (for example the free-trial page and teacher profiles) we also count, on our own servers and without any cookie, which steps visitors take — a grade picked, a sample question tried, a button tapped — under a random number that lives only in that browser tab and is discarded when it closes. These counts hold no name, email, IP address or device details, are never joined to an account, and are used only to see where families stop.

On our public marketing pages only — not the student learning area and not the sign-up page — we use Meta (Facebook) advertising and measurement cookies to understand how our ads to parents perform. These are set only after you accept "Advertising" cookies in the cookie banner, are never used to profile children, and send no name, email, or contact details to Meta. You may decline them at any time; previously-set advertising cookies will not be reused. We do not set these cookies for visitors in India.

Your banner choice is stored in your browser. To change it later, clear this site's data in your browser and the banner will ask again — or email us at the address in Section 14 and we will record your choice for you.

6. Data Sharing & Service Providers

We do not sell or rent your personal information. With your consent, we share limited, non-identifying advertising-measurement data with Meta (Facebook) as described in the Cookies and Analytics section; we never share data from the student learning area for advertising. We use the following service providers ("processors"), each acting on our instructions under a written agreement. Where a provider offers an AI model, we state whether our data may be used to train it.

• Supabase — authentication and database hosting (US).
• Vercel — web hosting and edge delivery.
• Daily.co — live-class video and audio-to-text transcription.
• OpenAI — AI question generation, lesson generation, and class summary generation. Receives class transcripts and curriculum prompts; inputs are scoped to the minimum needed for each task. Under OpenAI's API terms our data is not used to train their models.
• Google (Gemini API) — AI practice-question and study-plan generation, the teacher-requested performance analysis described in Section 2, and drafting help for teacher blog posts. For the performance analysis Google receives a student's first name, grade, subject, topics and recent scores — never a transcript or a message. Under the Gemini API terms we use, our data is not used to train Google's models.
• NVIDIA (NIM API) — generation and independent checking of practice questions, and illustrations for lessons. Receives curriculum prompts (subject, topic, skill) only — no student personal data. Under NVIDIA's API terms our data is not used to train their models.
• OpenRouter — routes some practice-question generation requests to third-party AI model providers. Receives curriculum prompts only — no student personal data. Under OpenRouter's terms our data is not used to train models.
• Stripe — wallet top-ups, class payments, and teacher payouts (Stripe Connect).
• Resend — transactional and notification email delivery.
• Meta Platforms (WhatsApp Business Platform) — delivery of the transactional WhatsApp messages described in Section 2. Meta receives the recipient phone number and the message text, which may include a student's first name and the class topic. This is separate from Meta's advertising role below.
• Apple — delivery of push notifications to iPhone and iPad. When you turn notifications on, Apple receives a device token for your device and the text of each notification so it can be delivered. We send these to Apple directly; no other push service is involved.
• Google (Firebase Cloud Messaging) — delivery of push notifications on Android, in the same way: a device token and the text of each notification.
• Sentry — error tracking. When something breaks on our servers, the error report carries the account id of the signed-in user so we can reproduce the problem; no transcript, answer, or message content is sent.
• PostHog — product analytics (in your browser only after you accept; on our servers as described in Section 5).
• Meta Platforms, Inc. (Facebook) — advertising and conversion measurement for our marketing campaigns, on public marketing pages only and only with your consent. No child personal data is sent; sign-up measurement is performed server-side using only an advertising click identifier.

We may also disclose information when required by law, court order, or to protect the safety of users.

7. Marketplace Nature

Glow Grades is an independent platform. Teachers using the Service are independent providers — not employees, agents, or contractors of Glow Grades. We facilitate connections between students and teachers and provide the technology (scheduling, video calls, transcription, messaging, content, and class payments). When classes are booked and paid for through the platform, payment is processed by our payment providers as described in Sections 1 and 6. Any tuition fees, gifts, tips, or other payments arranged between teachers and students or parents outside the platform's payment tools are not collected, processed, mediated, or guaranteed by Glow Grades. Personal data exchanged directly between teachers and students or parents (for example, in DMs about non-platform arrangements) is not managed by this Privacy Policy.

8. Data Retention & Deletion

• Account data: retained while your account is active. Deleted on request or when you delete your account.
• Learning data (test results, mastery progress, lesson activity): retained while your account is active; deleted with the account.
• Verbatim class transcripts: automatically deleted 30 days after the class ends (see Section 3).
• AI-derived class summaries (no verbatim content): retained for the lifetime of the account.
• Message and notification delivery records (email, WhatsApp, push): retained while the account is active; deleted with the account.
• Operational audit logs (records of our automated question-quality checks and generation runs): automatically deleted 365 days after they are written. They contain no student personal data.
• Aggregated, anonymized analytics: retained indefinitely (does not identify any individual user).

When an account is deleted — by you from Settings, by a parent through the opt-out link or by email, or by us on a verified request — the deletion runs immediately and removes every table that holds the student's data, including learning records, messages, notification delivery records, device tokens, and the account itself. Two kinds of record are detached rather than destroyed: a teacher's record that a class took place, and financial records (approved class prices, payments, payouts) that we are required to keep for accounting. In both cases the person is removed from the record — no name, no email, no account link — and only the amount, date and class remain. We keep an internal count of what each deletion removed so we can verify it was complete.

9. International Transfers

Glow Grades is operated from the United States, and our service providers (Section 6) primarily store and process data in the United States. If you use the Service from the EEA, the United Kingdom, India, or any other country, your information will be transferred to and processed in the United States, which may have different data-protection laws than your country.

For transfers out of the EEA and the United Kingdom we rely on the EU-U.S. and UK-U.S. Data Privacy Framework where a provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) in our agreements with that provider. You can ask us for a copy of the relevant safeguards at the address in Section 14.

10. Your Rights

Depending on where you live, you may have the following rights with respect to your personal information:

• The right to access a copy of your data.
• The right to correct inaccurate data.
• The right to have your data deleted.
• The right to receive your data in a portable format.
• The right to withdraw consent (where consent is the lawful basis).
• The right to lodge a complaint with your local supervisory authority (in the EEA / UK) or the Data Protection Board of India.

To exercise any of these rights, contact us at hello@glowgrades.com. You can also delete your account at any time from the Settings page (web) or from your profile in the app. We will never treat you differently for exercising a privacy right.

11. California Residents (CCPA / CPRA)

If you live in California, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights in Section 10 plus the right to know what categories of personal information we collect (Section 1), the purposes (Section 2), and the categories of third parties we disclose it to (Section 6).

We do not sell personal information, and we do not sell or share the personal information of anyone we know to be under 16. The student learning area and the sign-up page contain no advertising trackers at all. The only "sharing" for cross-context behavioral advertising that can occur is the opt-in advertising measurement on our public marketing pages described in Section 5, and it happens only after you choose "Advertising" cookies in the banner. Declining that choice in the cookie banner — or asking us by email to record a decline — is our "Do Not Sell or Share My Personal Information" control.

We do not use or disclose sensitive personal information for any purpose other than providing the Service. We will not discriminate against you for exercising these rights. You may designate an authorized agent to make a request on your behalf; we will ask the agent for proof of your permission and verify your identity through the email on the account.

12. India (DPDP Act 2023)

If you are in India, the Digital Personal Data Protection Act 2023 applies to the personal data we process. We process a child's data only with the consent of the parent or lawful guardian given at signup (Section 4), we do not track or run behavioural advertising directed at children, and we do not set advertising cookies for visitors in India (Section 5).

Grievance Officer. To raise a grievance about how your personal data is handled, write to our Grievance Officer, GlowGrades LLC, at hello@glowgrades.com with the subject line "Grievance". We will acknowledge your grievance and respond within 30 days. If you are not satisfied with our response, you may approach the Data Protection Board of India.

13. Security

We use industry-standard security practices, including encrypted connections (HTTPS), authenticated sessions (Supabase Auth), row-level security on our database, and operational secrets stored in our hosting provider's environment-variable vaults. No system is 100% secure, but we take protection of student data seriously and continually review our practices.

14. Changes & Contact

We may update this Privacy Policy from time to time. The updated version will be posted here with a revised effective date. When a change is material, we also show a dated notice at the top of this page, summarising what changed in plain words, for 30 days after the new effective date. Continued use of the Service after that date constitutes acceptance of the updated Policy.

Questions about this Privacy Policy or any of your rights? Contact: hello@glowgrades.com. Postal address available on request.