StandUp Privacy Policy
Last updated: 2026-04-05 Effective date: 2026-04-05
This Privacy Policy explains what data StandUp collects, how we use it, who can access it, and what rights you have. It is written in plain English because IT admins, teachers, parents, and students should all be able to read it without a lawyer.
If you are a school IT administrator evaluating StandUp, please also read our School Privacy Addendum, which addresses school-specific concerns (no data selling, no ads, retention, breach notification, sub-processors, opt-outs).
1. What Data We Collect
We collect only what is necessary to run StandUp as an educational service.
1.1 Account Information
- Name (teacher or student display name)
- Email address (for sign-in and password reset)
- Role (teacher, student, school admin)
- School / class association
- Authentication provider identifiers (Google OAuth sub, Supabase user ID)
- Optional profile photo
1.2 Classroom Content (Teacher-Provided)
- Lesson materials uploaded by teachers (PDFs, slide decks, documents, images, audio/video)
- Lesson recaps, summaries, and teacher notes
- Class rosters created or imported by teachers
- Assignment prompts and rubrics
1.3 Student-Generated Content
- Questions posted to the Q&A board (posted anonymously to peers, but linked to the student account internally for moderation and safety)
- AI Tutor chat transcripts
- Quiz answers and results
- Practice Mode answers
- Voice transcripts from Live Voice Tutor sessions (text only; audio is not retained after transcription)
- Study session participation records
1.4 Usage Telemetry
- Page views, button clicks, and feature usage counts (aggregated where possible)
- Device type, browser, and operating system
- Approximate geographic region (derived from IP, not precise location)
- Error and crash logs
1.5 What We Do NOT Collect
- We do not collect precise location (GPS).
- We do not collect contacts, photos, microphone audio outside an active Live Tutor session, or camera feeds.
- We do not buy or ingest data from data brokers.
- We do not build advertising profiles.
2. How We Collect It
- Directly from you: when you sign up, create a class, upload a lesson, post a question, or chat with the AI Tutor.
- From your school: when a school admin provisions accounts or syncs a roster.
- Automatically: usage telemetry is recorded as you interact with the product.
- From authentication providers: if you sign in with Google, Google provides your name, email, and profile photo.
We do not use tracking pixels from advertising networks. We do not share data with social media platforms.
3. How We Use It
StandUp uses your data only to operate the educational service.
Specifically, we use data to:
- Authenticate you and keep your account secure
- Deliver teacher-created lesson content to the correct students
- Generate AI-powered quizzes, tutoring responses, and lesson recaps
- Moderate Q&A posts for safety (every post passes through automated moderation before going live)
- Show teachers class-level analytics so they can see where students are struggling
- Notify you about account events (password reset, class invitations)
- Debug errors and improve reliability
What we will never do with your data:
- We do not sell your data. Not now, not ever. This is a contractual commitment to every school.
- We do not run advertising. StandUp has no ads and no ad partners.
- We do not use student data to train AI models. Student content is not used to fine-tune or retrain Anthropic's, OpenAI's, or our own models. See Section 8 for how we work with AI sub-processors.
- We do not share data with marketing partners. We have none.
- We do not use student data for any commercial purpose beyond running the educational service the school has authorized.
4. Where We Store It
- Primary database: Supabase (PostgreSQL), hosted in the United States (US region).
- File storage: Supabase Storage, US region, encrypted at rest with AES-256.
- Application hosting: Vercel (edge network). Application code runs on Vercel's US infrastructure; static assets may be cached at edge locations globally, but student data itself is not stored at edge nodes.
- Backups: Supabase-managed encrypted backups, US region, retained per Supabase's standard policy.
- Logs: Application logs (errors, request metadata) are retained for 30 days for debugging and security monitoring.
All data in transit is encrypted with TLS 1.3. All data at rest is encrypted with AES-256.
5. Who Can Access It
StandUp enforces least-privilege access through database Row-Level Security (RLS) policies. Specifically:
- Students can see their own data, the classes they are enrolled in, and the public Q&A/lesson content in those classes.
- Teachers can see the classes they own, the students in those classes, and the content those students generate inside those classes.
- School administrators can see all classes, teachers, and students within their school, and can request exports or deletions.
- StandUp staff (currently the solo founder) can access data only when necessary for support, debugging, or security investigations. Access is logged and limited to the minimum required to resolve the issue.
- AI sub-processors (Anthropic, OpenAI) receive only the content required to answer a specific request, with student PII stripped where possible. They do not have persistent access to our database. See Section 8.
- Hosting providers (Supabase, Vercel) have operational access to the infrastructure StandUp runs on, under their own SOC 2 / ISO 27001 controls. They are contractual sub-processors.
We do not share data with anyone else unless legally compelled (e.g., valid court order), and we will notify the affected school in writing before complying, to the extent legally permitted.
6. Retention Periods
We keep data only as long as it is needed to run the service or as required for a school's records.
| Data | Retention |
|---|---|
| Active account data (profile, classes, lessons) | Kept while the account is active |
| Deleted account data | 30-day soft delete, then hard purge |
| AI Tutor chat transcripts | 90 days, then purged |
| Live Voice Tutor transcripts | 90 days, then purged; raw audio not retained |
| Q&A posts and answers | Kept for the school year, then archived per school request |
| Quiz and Practice Mode results | Kept for the school year; teachers may export before purge |
| Application logs | 30 days |
| Security and audit logs | 1 year |
| Backups | Rolling per Supabase's managed backup window |
At contract termination, schools have a 30-day export window; after that window, all school data is purged from primary storage within 30 days and from backups as those backups expire on their normal rotation.
7. Deletion and Access Rights
Schools, parents, and eligible students have the following rights:
- Right to access: request a copy of the data StandUp holds about a specific student.
- Right to correction: request that inaccurate data be corrected.
- Right to deletion: request that a student's data be deleted.
- Right to export: receive a student's data in a machine-readable format (JSON or CSV).
How to exercise these rights:
- School IT admins can submit a per-student export or delete request through their school admin console, or by emailing the contact in Section 10.
- Parents and eligible students should contact their school first; the school will relay the request to StandUp.
- StandUp will respond to verified requests within 30 days, and typically within 7 business days.
Deletion requests are honored in primary storage immediately upon verification and propagate to backups as those backups age out on their normal rotation (maximum 30 days).
8. AI Sub-Processors
StandUp uses third-party AI providers to power the AI Tutor, quiz generation, content moderation, and lesson recap features. We are fully transparent about who they are and what they receive.
8.1 Current AI Sub-Processors
- Anthropic (Claude) — used for AI Tutor, quiz generation, and lesson recap. Governed by Anthropic's Commercial Terms and DPA. Anthropic does not train on data submitted via its API by default.
- OpenAI — used as a failover provider for AI Tutor and quiz generation when Claude is unavailable, and for specific model tiers. Governed by OpenAI's Business Terms and DPA. OpenAI does not train on data submitted via its API.
Both providers are contractually bound to not use API-submitted content to train their models.
8.2 What Data Goes to AI Providers
Only the content necessary to answer a specific prompt is sent. We strip student personally identifiable information (PII) from prompts before sending, per our internal data-handling practice. The AI provider sees the lesson content, the question, and a generic role (e.g., "student"), but not names, emails, or school identifiers.
8.3 School Opt-Out
Schools may request to route their traffic to a specific provider only (for example, Claude only, or OpenAI only). This is documented in the School Privacy Addendum.
8.4 AI Content Moderation
Every Q&A post passes through automated moderation before going live to the class. This is a safety feature, not a surveillance feature.
9. Breach Notification
In the event of a security incident that involves unauthorized access to student data, StandUp will:
- Contain the incident as the first priority.
- Notify affected schools within 72 hours of confirming the breach, in line with FERPA expectations and our internal incident response plan.
- Provide the school with: what happened, what data was involved, when it happened, what we've done to contain it, and what we recommend the school do.
- Cooperate with the school on any notifications the school must make to parents, students, or regulators.
- Publish a post-mortem to the school within 14 days of containment.
Our full Incident Response Plan is available in the Trust Center.
10. Contact
Privacy questions, data requests, or security reports:
- Email: danielnwah123@gmail.com
- Security: danielnwah123@gmail.com
- Mailing address: available on request
The current primary contact is the founder. For urgent security issues, please use the security email and mark the subject line URGENT.
11. FERPA and StandUp's Role as a "School Official"
StandUp is designed to comply with the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g; 34 CFR Part 99).
When a school uses StandUp, StandUp acts as a "school official" with a legitimate educational interest under 34 CFR § 99.31(a)(1)(i)(B). This means:
- StandUp performs a service for the school that the school would otherwise use employees to perform.
- StandUp is under the direct control of the school with respect to the use and maintenance of education records.
- StandUp is subject to FERPA's requirements governing the use and redisclosure of personally identifiable information from education records.
- Student data from the school belongs to the school and the student, not to StandUp.
- StandUp will not redisclose education records to any other party without the school's written authorization, except as permitted by FERPA (for example, in response to a valid subpoena, after notice to the school).
- StandUp will not use education records for any purpose other than the educational service the school has authorized.
11.1 FERPA Data Handling Summary
- Collection: Education records are collected only when teachers, school admins, or students enter or upload them into StandUp.
- Storage: Education records are stored in Supabase (US), encrypted at rest, access-controlled via RLS policies.
- Processing: Processing is limited to the educational service — delivering lessons, generating quizzes, answering student questions, and providing teachers with class analytics. AI processing is performed under the sub-processor terms in Section 8.
- Deletion: Education records are deleted upon school request (per Section 7) or at contract termination (per Section 6), whichever comes first.
- Directory information: StandUp does not treat any student data as "directory information" and does not disclose any student data publicly.
11.2 Parent and Eligible Student Rights
FERPA gives parents (and students 18+ or in postsecondary programs) the right to inspect, review, and request correction of education records. StandUp honors these rights through the school — parents and eligible students should contact their school IT admin, who will work with StandUp to fulfill the request.
11.3 Compliance Commitments
- StandUp will not sell or rent education records.
- StandUp will not use education records for advertising or marketing.
- StandUp will not use education records to train AI models.
- StandUp will notify the school of any data breach involving education records within 72 hours of confirmation.
- StandUp will return or destroy education records upon contract termination, per the school's written instructions.
12. Changes to This Policy
If we make material changes to this Privacy Policy, we will notify schools in writing at least 30 days before the changes take effect. Non-material changes (typo fixes, clarifications) will be published with an updated "Last updated" date.
13. See Also
- School Privacy Addendum — school-specific terms, sub-processor opt-out, data residency, contract termination
- Trust Center — security documentation, data flow diagram, incident response plan, IT Admin FAQ
- Data Processing Agreement (DPA) — SDPC National DPA pre-filled with StandUp's practices, available on request
StandUp is an educational technology product. We exist to help students learn. Every decision in this Privacy Policy is made with that purpose in mind.