Student Privacy Terms of Service

• Designed for classroom use with students (including under 13) under a teacher or school’s authorization.
• Students join with a classroom code issued by a teacher. Teachers create their own accounts.
• By creating a teacher account or enabling student access, you represent that you are authorized by your school or district to do so and that you will obtain any required parental consent under COPPA/FERPA/PPRA and Massachusetts 603 CMR 23.00.

ImagineAI lets students create illustrated books through conversational AI and image generation. Teachers oversee class activity via a dashboard scoped to their own classes and students; students can access only their own work and assigned classes.

The LEA (school/district) owns and controls Student Data and Pupil Records. ImagineAI LLC acts as a “School Official” with a legitimate educational interest, under the direct control of the LEA for FERPA and Massachusetts law purposes. Students and teachers own the creative content (books, text, images) they produce; ImagineAI retains ownership of its platform and underlying technology. We will use Student Data only to provide and support the Service as described here.

• Identifiers: teacher email, student email (for login only), student username, optional student name as entered on a book title page, classroom code.
• Account security: hashed password or federated auth credentials.
• Student work: generated text, images, and book content the student creates.
• System logs: minimal service logs (e.g., timestamped requests, error traces) without storing IP addresses beyond transient transport logs required by hosting providers.
• No collection of photos, voice data, biometrics, precise location, disability/IEP/ELL flags, race/ethnicity, or other sensitive indicators.

• Operate the chat and image generation needed to build books.
• Display class dashboards for teachers, restricted to their students.
• Provide support, security, and service reliability.
• Improve the Service using de-identified or aggregated data only; we do not attempt to re-identify students.

• No selling or renting Student Data.
• No targeted advertising, marketing, or profiling of students or families.
• No disclosure of Student Data to third parties except subprocessors listed below, or as required by law after notice to the LEA unless legally prohibited.
• No use of Student Data to train third-party models; prompts/outputs sent to model providers listed below are processed only to generate the requested result and are not retained by them.

• Supabase (database and authentication; hosted on Railway-managed PostgreSQL).
• Railway/Heroku (application hosting; US-only).
• Resend (transactional email to teachers). Student emails are not used for marketing.
• OpenAI, Anthropic (LLM generation for text/chat; prompts/outputs are transient and not used for training).
• Google image models and FAL.ai (image/video generation; prompts/outputs are transient and not used for training).

Each subprocessor is bound by written terms requiring at least the same data protections as this Agreement. We will notify the LEA before adding or replacing a subprocessor and give an opportunity to object.

• Encryption in transit (HTTPS/TLS) and at rest for stored data.
• Access to production data is limited to the founder/administrator on a need-to-know basis; confidentiality obligations apply.
• Credentials are protected; passwords are hashed.
• Supabase-managed backups for the database (US-only). Retention follows Supabase policy; deletions propagate to backups as their retention windows expire.
• We conduct periodic risk reviews and will remediate identified issues.

Upon an LEA request, we will provide or correct a student’s personally identifiable information within required timelines (target within 72 hours, earlier if state law requires). If a parent or student contacts us directly, we will refer them to the LEA and cooperate with the LEA’s instructions.

• We keep student accounts and work while the classroom is active.
• Upon LEA request, we will return specified Student Data within 3 days and delete it as soon as practicable (target within 3 days), with written confirmation.
• Outside of LEA requests, we keep data only as long as needed to support the classroom and delete promptly when the LEA ends use of the Service or instructs deletion.
• De-identified data may be retained for service improvement, never for re-identification.

If Student Data is accessed or acquired by an unauthorized person, we will notify the LEA within 72 hours of confirmation (or faster if state law requires, e.g., 24 hours initial notice in some states) and provide the required details. We will cooperate with any investigation and remediation.

We will direct third parties (including law enforcement) to request Student Data from the LEA. We will not disclose Student Data unless required by law and, where lawful, will give the LEA prior notice.

Students and teachers retain ownership of the content they create. By using the Service, you grant us a limited license to host, process, and display that content solely to operate the Service for the classroom.

ImagineAI LLC agrees to extend these privacy terms to any Massachusetts school district that signs the General Offer of Privacy Terms (Exhibit E of the Massachusetts Student Data Privacy Agreement). Price and service scope may be set separately, but privacy protections remain the same.

This Agreement is governed by the laws of the Commonwealth of Massachusetts. Venue and jurisdiction reside in the state and federal courts located in Plymouth County, Massachusetts.

ImagineAI LLC
Email: kyle30683@gmail.com
Privacy/Security Contact: Kyle Maloney
(Physical notice address available to districts upon request.)