EdToolkit ("we", "us", "our") operates the classroom.edtoolkit.com and homeschool.edtoolkit.com web applications. We are the data controller for the personal data processed through these services.

We collect only the data necessary to provide our services: - **Account data:** Email address, display name, and authentication credentials (password is hashed and never stored in plaintext). - **Profile data:** Teaching role or household name, child profile information (first name, birth year, grade level) provided by the parent account holder. - **Usage data:** Feature interactions, timestamps, and session identifiers for service improvement. - **Payment data:** When you subscribe, payment details are processed directly by Stripe. We store only your Stripe customer ID and subscription status — never card numbers.

We use your data to: - Provide and maintain the EdToolkit service - Personalize AI-generated content (lesson plans, planning outputs) - Process payments and manage subscriptions - Send essential service communications (password resets, security alerts) - Improve our services through aggregated, anonymized usage analytics We do NOT use your data for advertising or sell it to third parties.

Our homeschool application allows parent account holders to create child profiles. Children do not have their own accounts or login credentials. - Child profile data (first name, birth year, grade level) is collected only with the parent's direct action. - The parent account holder has full control over child data creation, modification, and deletion. - We do not collect data directly from children under 13. - We do not use child profile data for marketing or advertising purposes. - Parents may request deletion of all child data at any time by deleting the child profile or contacting us.

For users in the European Economic Area (EEA) and UK, we process personal data under the following legal bases: - **Contract performance:** Processing necessary to provide the service you signed up for. - **Legitimate interest:** Service improvement, security, and fraud prevention. - **Consent:** Marketing communications (opt-in only, withdrawable at any time).

We retain your account data for as long as your account is active. When you delete your account: - All personal data is permanently deleted within 30 days. - Anonymized, aggregated analytics data may be retained. - Backup copies are purged within 90 days.

Depending on your jurisdiction, you have the right to: - **Access:** Request a copy of your personal data. - **Rectification:** Correct inaccurate personal data. - **Erasure:** Request deletion of your personal data ("right to be forgotten"). - **Portability:** Receive your data in a structured, machine-readable format. - **Restriction:** Limit how we process your data. - **Objection:** Object to processing based on legitimate interest. - **Withdraw consent:** Where processing is based on consent. To exercise any of these rights, contact us at privacy@edtoolkit.com.

We implement appropriate technical and organizational measures: - All data is transmitted over TLS (HTTPS). - Authentication credentials are hashed using industry-standard algorithms. - Access to production data is restricted and audited. - We use Firebase infrastructure (Google Cloud) which maintains SOC 2 and ISO 27001 certifications. - For teacher and homeschool users, your personal data (account, profiles, projects, and content you create) is stored in the EdToolkit EU Firestore database located in the European Union (eur3 multi-region). Platform reference content such as curriculum lists may be served from non-EU databases but does not contain personal data.

We use the following third-party processors: - **Google Firebase:** Authentication, database, hosting, file storage (Google Cloud). Your personal data is hosted in the EU region. - **Stripe:** Payment processing (PCI-DSS compliant) - **Google Gemini:** AI content generation (no personal data is sent to AI models beyond session context) Each processor is bound by data processing agreements compliant with applicable regulations.

Your account, profile, and project data is stored in the European Union by default. Reference platform content may be processed in other regions where our processors operate but does not contain personal data. For any personal data transferred outside the EEA/UK, we ensure adequate protections through Standard Contractual Clauses (SCCs) or equivalent mechanisms.

We may update this policy from time to time. Significant changes will be communicated via email or in-app notification. Continued use of the service after changes constitutes acceptance.

For privacy-related inquiries or to exercise your data rights: - Email: privacy@edtoolkit.com - Response time: Within 30 days of receipt.