Privacy Policy

1. Overview

SMILE LMS (Stanford Mobile Inquiry-based Learning Environment) is operated by Seeds of Empowerment. We are committed to protecting the privacy of all users, especially students and minors.

This policy explains what personal information we collect, how we use it, and your rights regarding your data.

2. Information We Collect

2.1 Required Information

• Account Information: Name, email address, username, password (encrypted)
• Date of Birth: Required to determine applicable privacy protections
• User Type: Student, teacher, or administrator role
• Institution/School: Optional school or institution affiliation

2.2 Educational Data

• Questions you create and submit
• Responses to activities and assessments
• Group memberships and participation
• Learning progress and performance data

2.3 Automatically Collected

• IP address and device information
• Usage patterns and feature interactions
• Session timestamps and duration

3. How We Use Your Information

• Provide and improve the SMILE LMS learning experience
• Facilitate participation in groups and activities
• Enable communication between teachers and students
• Generate learning analytics and progress reports
• Send important service notifications
• Conduct educational research (with anonymized data only)

4. AI Data Processing

4.1 AI Features

SMILE LMS uses AI services to provide:

• Question quality evaluation using Bloom's Taxonomy
• Personalized feedback and improvement suggestions
• Enhanced question alternatives

4.2 Third-Party AI Services

We use the following AI service providers:

• OpenAI (USA) - GPT models for question evaluation
• Anthropic (USA) - Claude models for advanced analysis

4.3 Privacy Protections

• Questions are anonymized before being sent to AI services
• No names, emails, or school information is shared
• AI providers do not use your data to train their models
• You can disable AI features at any time in Settings

5. Information Sharing

We do not sell your personal information. We may share information only:

5.1 Within the Platform

• With teachers and group administrators (educational records)
• With other group members (as part of collaborative learning)
• Anonymous question sharing (when enabled)

5.2 External Sharing

• AI Services: Anonymized questions only (with consent)
• Analytics: Aggregated, non-identifiable usage data
• Legal Requirements: When required by law

6. Children's Privacy (Under 14)

6.1 Parental Consent Required

• Users under 14 must provide a parent/guardian's email during registration
• Parents receive a verification email to approve account creation
• Parents control AI feature access for their children

6.2 Parent Portal

Parents and guardians can:

• View their child's learning activity and submissions
• Enable or disable AI features for their child
• Export their child's data
• Request account deletion

6.3 School-Managed Accounts

For school-managed accounts, the school acts as the consenting party under FERPA and may authorize data collection for legitimate educational purposes.

7. Your Rights

7.1 Access and Export

• View all personal information we hold about you
• Download your data in JSON or CSV format
• Available in Settings > Data Rights

7.2 Correction

• Update your profile information at any time
• Request correction of inaccurate educational records

7.3 Deletion

• Request deletion of your account and all associated data
• For minors: permanent deletion within 30 days (COPPA compliance)
• For others: soft deletion with data retention per legal requirements

7.4 Processing Suspension

• Temporarily suspend data processing while retaining your account
• AI features will be disabled during suspension
• Resume processing at any time

8. Data Security

• All data encrypted in transit (HTTPS/TLS 1.3) and at rest
• Passwords hashed using industry-standard algorithms
• Regular security audits and penetration testing
• Access controls and audit logging for all data access
• Data hosted on secure cloud infrastructure (GCP, AWS)

9. Data Retention

• Active accounts: Data retained while account is active
• Inactive accounts: Anonymized or deleted after 2 years of inactivity
• Deleted accounts: Permanently purged within 30-90 days
• Audit logs: Retained for 7 years for compliance

10. International Data Transfer

Your data may be processed in the following countries:

• United States: Cloud hosting and AI services
• South Korea: Primary service location

All international transfers comply with applicable data protection laws including standard contractual clauses.

11. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes:

• We will update the version number and date at the top
• We will notify you via email or in-app notification
• We may require you to review and accept the updated policy

12. Contact Us