Privacy | Shema Studies

This Privacy Policy describes how Shema Studies ("we," "us," or "our") collects, uses, discloses, retains, and protects personal information collected from parents, legal guardians, and students who use our AI-powered homeschooling platform (the "Service"). We are committed to protecting your privacy and the privacy of your children, and we comply with all applicable U.S. federal and state privacy laws, including the Children's Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA/CPRA), the Washington Privacy Act (RCW 19.373), and other applicable state laws.

1. Information We Collect

We collect personal information from two distinct categories of users: (A) parents/guardians and (B) students, including children under the age of 13. The types of information we collect from each category are described in detail below.

A. Parent/Guardian Information

When you create an account, subscribe to the Service, or join our waitlist, we collect the following personal information:

Email address: Used as your unique account identifier, for account access, authentication, and for sending you transactional and (with your consent) marketing communications;
First name: Used to personalize our communications with you and to identify you within the Platform;
Account role: Designates you as an admin (parent) user with full management capabilities over student profiles, subscriptions, and settings;
Subscription & payment metadata: Plan type, number of enrolled students, subscription status (pending, active, past_due, canceled, expired), checkout session IDs, Stripe subscription IDs, and transaction history. Note: we do not store your full credit card number — payment processing is handled entirely by our payment processor, Stripe, Inc., which is PCI-DSS compliant;
Consent metadata: The timestamp at which you accepted these Terms, the version of the Terms you agreed to, and records of your consent to receive marketing emails;
Communications with Shiloh AI: Full text transcripts of your conversations with our parent-facing AI assistant, including all messages you send and all AI responses you receive (see Section 5);
Account activity data: Login timestamps, session duration, IP address, browser type, device information, and pages/screens viewed within the parent dashboard.

B. Student Information (Including Children Under 13)

When you (the parent or guardian) enroll a student on the Platform, we collect the following personal information from and about the student. This collection occurs only after we have obtained verifiable parental consent through the subscription purchase process, as required by COPPA:

First and last name: Used to personalize the learning experience, to identify the student within the Platform, and to address the student by name in AI-generated content;
Grade level: Used to generate age-appropriate curriculum, assignments, and AI tutoring content tailored to the student's educational level (K through 12th grade);
Parent-assigned password: A simple password created by the parent that the student uses to log in to the student portal. This is stored in the student's profile and is used for session authentication;
Session & access tokens: Short-lived access tokens and rotating refresh tokens used to authenticate the student's session securely, along with token expiration timestamps;
Enrolled subjects: The list of subjects the parent has assigned to the student, along with subject names, icons, colors, descriptions, and current unit topics;
Learning progress data: Assignment titles, descriptions, elements (learning blocks), completion status (draft, published, completed, graded), due dates, scores, student answers, per-question mentor feedback, sequence order, day/week/block numbers, lesson titles, unit topics, block types (check-in, video, practice, review, quiz), and AI teacher notes;
AI conversation data: Full text transcripts AND voice recordings of all interactions between the student and the Platform's AI features (including the Live Tutor, Shiloh AI, and Runway Tutoring), as described in detail in Section 5;
Gamification data: Experience points (XP), XP award history, badges earned, achievement status, and items redeemed in the XP shop;
Shiloh memories: AI-generated and parent-annotated memory entries about the student, including milestones, skill upgrades, struggles, interests, and notes — used to personalize future curriculum;
Session/activity data: Login timestamps, last active timestamp, last XP award timestamp, current screen being viewed (visible to the parent via live view), and activity pings used for presence tracking;
Compliance data: State of residence, school district, school year structure (semester or trimester), school year start date, instructional hours, credit tracking for high school students, and compliance setup status;
Avatar/mentor selection: The student's selected AI tutor avatar or mentor, if applicable;
Reflection data: Any reflection entries or check-in responses the student submits as part of their daily learning blocks.

2. How We Use Your Information

2.1 How We Use Parent/Guardian Information.

We use the personal information collected from parents and guardians for the following purposes:

To create, manage, and authenticate your account;
To process subscription payments and manage your subscription lifecycle (activation, renewal, upgrade, cancellation);
To provide you with access to the parent management dashboard and all of its features;
To send you transactional emails (payment receipts, subscription confirmations, security notifications, service announcements);
To send you marketing and promotional emails, but only if you have explicitly consented to receive them (see Section 6);
To respond to your inquiries, support requests, and parental rights requests;
To provide the Shiloh AI assistant, which uses your student data to generate personalized curriculum recommendations and progress analyses;
To monitor and review your conversations with the Shiloh AI assistant for safety and quality purposes (see Section 5);
To detect, prevent, and address fraud, abuse, security issues, and violations of our Terms;
To comply with our legal obligations under federal and state law.

2.2 How We Use Student Information.

We use the personal information collected from students for the following purposes:

To generate personalized AI curriculum, assignments, and learning content tailored to the student's grade level, subjects, and individual learning needs;
To provide the student with access to the learning portal, including assignments, interactive activities, gamification features, and the XP/badge system;
To power the Live AI Tutor, which uses the student's questions and grade level to generate age-appropriate explanations and visual models;
To track the student's learning progress, grades, assignment completion, and compliance with state homeschool requirements;
To record and store all AI conversations (text transcripts and voice recordings) for safety monitoring and quality assurance, as described in Section 5;
To generate and maintain "Shiloh memories" — evolving notes about the student's milestones, struggles, interests, and skill upgrades — which are used to personalize future curriculum and adapt to the student's needs over time;
To display the student's current activity and progress to the parent via the parent dashboard and live view;
To award XP, badges, and other gamification rewards;
To provide compliance tracking, including instructional hours and high school credit tracking;
To detect, prevent, and address misuse of the AI features or violations of our Terms;
To comply with our legal obligations under COPPA, FERPA (where applicable), and state student data privacy laws.

2.3 How We Do Not Use Your Information.

We do not:

Use children's personal information to deliver behavioral advertising to the child;
Use children's personal information to amass a profile about the child that is not reasonably necessary for the operation of the Service;
Disclose children's personal information to third parties except as necessary to operate the Service (e.g., our AI model providers, cloud storage providers, payment processor, and analytics providers), and only under contractual obligations requiring the third party to protect the data and use it solely for the purpose for which it was disclosed. We do not sell children's personal information.

3. Legal Bases for Processing (Applicable Laws)

We process personal information under the following legal bases, as applicable:

Consent: For marketing emails and for the collection of personal information from children under 13 (parental consent obtained through subscription purchase);
Contractual necessity: To provide the Service you have subscribed to, including curriculum generation, progress tracking, and AI tutoring;
Legal obligation: To comply with COPPA, CAN-SPAM, CCPA/CPRA, Washington state law, and other applicable federal and state laws;
Legitimate interests: To monitor AI safety, prevent abuse, detect fraud, and maintain the security and quality of the Service;
Vital interests & safety: To protect the safety of children using the Platform by monitoring AI conversations for inappropriate or harmful content.

4. AI Conversation Recording, Transcription & Monitoring

4.1 Overview.

One of the most important safety features of Shema Studies is our comprehensive recording and monitoring of all AI conversations. Because the Platform's AI features interact directly with children, we believe it is our responsibility — and a parental expectation — that every AI interaction is recorded, reviewable, and monitored for safety. This section describes in detail what we record, why, how, and your rights regarding these recordings.

4.2 What We Record.

We automatically record, transcribe, and store the following data for every interaction between any user (student or parent) and any AI feature on the Platform (including the Live Tutor, Shiloh AI, and Runway Tutoring):

Text transcripts: A complete, word-for-word written record of every message exchanged, including the user's input (whether typed or transcribed from speech via the browser's Speech Recognition API) and the AI's response. The transcript is stored as both a formatted text string and a structured array of individual messages, preserving the role (user or AI), content, and sequential order of each message;
Voice recordings (student tutor sessions): Audio recordings of the student's microphone during Live Tutor sessions, captured using the browser's MediaRecorder API. These recordings capture the student's spoken input to the AI tutor. The audio is recorded as a WebM audio file, uploaded to our secure cloud storage, and the resulting file URL is stored alongside the transcript;
Conversation metadata: For each conversation, we record: the start timestamp (when the conversation or session began), the end timestamp (when it ended), the total duration in seconds, the user's identity (parent user ID or student ID), the user type (student or parent), the user's name, the conversation type (tutor, shiloh, or runway), and — for student conversations — the associated student ID;
Message history: A structured, sequential record of each individual message within a conversation, including the role (user, AI/tutor, or Shiloh), the text content, and the order in which the messages were exchanged.

4.3 Why We Record.

We record AI conversations for the following specific purposes:

Student safety monitoring: To enable authorized platform administrators to review AI responses and verify that the AI is not producing content that is inappropriate, harmful, offensive, sexually explicit, violent, discriminatory, or otherwise unsuitable for children. This is the primary purpose of recording;
AI quality assurance: To evaluate the accuracy, educational value, clarity, and appropriateness of AI-generated responses, and to identify areas for improvement in the AI's behavior;
Misuse detection: To detect and prevent attempts to use the AI features to generate harmful, illegal, or inappropriate content, including attempts to circumvent the AI's safety guardrails;
Parental transparency: To allow parents to review what the AI said to their child and what their child said to the AI, providing full transparency into AI interactions;
Legal compliance: To maintain records that may be necessary or useful for legal, regulatory, audit, or safety purposes;
Incident investigation: In the event of a safety concern or complaint, to provide a complete record of what occurred during a specific AI interaction.

4.4 How We Record.

Recording is automatic and occurs whenever an AI feature is in use. Students are not required to take any action to initiate recording, and recording cannot be disabled while using AI features. For the Live Tutor, voice recording begins when the tutor panel is opened and ends when it is closed. For Shiloh AI (parent assistant), text transcripts are saved when the parent navigates away from the conversation or the page. The recording technology we use includes:

MediaRecorder API: A browser-based API that captures audio from the device's microphone. Audio is recorded in WebM format and uploaded to our cloud storage via the Platform's file upload integration;
Speech Recognition API: A browser-based API that converts the student's spoken words into text, which is then used as input to the AI and included in the text transcript;
Text logging: All text messages (both user input and AI output) are logged in real-time as they are exchanged.

We do not use third-party voice biometrics, voice fingerprinting, or facial recognition. Voice recordings are used solely for safety review and are not processed for biometric identification purposes.

4.5 Who Can Access Recordings.

AI conversation recordings and transcripts are accessible only to:

The parent or legal guardian who created the student's account — they can access their own child's recordings and their own conversations with Shiloh AI through the Platform or by request;
Authorized platform administrators (Shema Studies staff with appropriate access privileges) — for the purpose of safety monitoring, quality assurance, and incident investigation;
Authorized service providers (e.g., cloud storage providers, AI model providers) — who process data on our behalf under contractual obligations requiring them to maintain the confidentiality and security of the data and to use it solely for the purpose of providing their service to us.

We do not share AI conversation recordings or transcripts with any other third parties, and we do not make them publicly available.

4.6 Retention of Recordings.

Voice recordings and text transcripts are retained for the duration of the active subscription and for a reasonable period thereafter (generally up to 12 months after subscription cancellation, unless a longer or shorter period is required by applicable law or necessary for safety, compliance, or legal purposes). Parents may request deletion of their child's conversation logs at any time by contacting us, subject to any legal retention obligations that may require us to retain certain records for a limited period.

4.7 Parental Access to Recordings.

Parents may request access to their child's AI conversation logs — including transcripts and voice recordings — at any time by contacting us using the information in Section 11. We will provide access within a reasonable timeframe (generally within 30 days) after verifying the requester's identity as the parent or legal guardian. Parents may also review conversation logs directly through the Platform's admin interface, where available.

4.8 AI Limitations & No Guarantee.

While we actively monitor AI conversations and take reasonable steps to ensure the AI produces appropriate, educational content, we cannot guarantee that every AI-generated response will be accurate, complete, unbiased, or appropriate. AI models may occasionally produce incorrect, nonsensical, or unexpected outputs (sometimes referred to as "hallucinations"). Parents are strongly encouraged to periodically review their child's conversation logs and to report any concerns to us immediately. The Service is an educational aid and is not a substitute for parental supervision, professional educational guidance, or professional advice of any kind.

5. Information We Share

We may share personal information with third parties in the limited circumstances described below. Some of these disclosures may constitute a "sale" or "sharing" of personal information under certain state laws, such as the CCPA. For information about your right to opt out of such sales or sharing, see Section 8.

Service providers: We share personal information with third-party service providers who perform services on our behalf, including: (a) Stripe, Inc. (payment processing — receives subscription and payment metadata but not full payment card details); (b) AI model providers (large language model APIs — receive prompts and generate AI responses, and may process conversation data as necessary to provide the AI features); (c) cloud storage providers (store files, voice recordings, and conversation logs); (d) email delivery services (send transactional and marketing emails); (e) analytics providers who may receive usage data, IP addresses, device information, and page interaction data to help us understand how the Service is used and improve its features. All service providers are contractually obligated to protect personal information and to use it only for the purpose of providing their services to us;
Legal compliance: We may disclose personal information when required by law, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is necessary to protect the safety, rights, or property of any person, especially a child;
Business transfers: In connection with a merger, acquisition, reorganization, sale of assets, or other business transaction, we may transfer personal information to the acquiring or successor entity, subject to the same privacy protections described in this policy;
With parental consent: We may share children's personal information with third parties if we obtain parental consent to do so.

We do not share children's personal information with third parties for the third party's own commercial purposes, except for service providers who process data on our behalf to operate and improve the Service (including analytics providers).

6. Email Communications & Marketing

6.1 Marketing Emails.

We send marketing and promotional emails only to users who have explicitly consented to receive them by providing their email address and checking the consent box on our waitlist signup form or other marketing form. Marketing emails may include product announcements, feature updates, educational resources, promotional offers, newsletters, and surveys.

6.2 Transactional Emails.

We send transactional emails (payment receipts, subscription confirmations, security notifications, service announcements) to all account holders. These emails are necessary to operate the Service and cannot be opted out of.

6.3 CAN-SPAM & State Law Compliance.

All marketing emails we send include: (a) our physical mailing address; (b) a clear and conspicuous identification that the message is an advertisement or solicitation; (c) a clear, functioning unsubscribe link; and (d) a valid reply-to email address. We honor all unsubscribe requests within ten (10) business days, as required by the federal CAN-SPAM Act (15 U.S.C. §7701 et seq.), California Business & Professions Code §17529.4, and Washington's Commercial Electronic Mail Act (RCW 19.190). You may unsubscribe at any time.

We do not use false or misleading subject lines, do not use deceptive header information, and do not send marketing emails to users who have not consented or who have unsubscribed.

7. Data Security

We implement reasonable technical, administrative, and organizational measures designed to protect personal information from unauthorized access, use, alteration, disclosure, or destruction. These measures include:

Row-Level Security (RLS): Student data is access-controlled at the database level so that only the parent who created the student profile and authorized platform administrators can read or modify the student's records. Students can access their own data but cannot access other students' data;
Authentication: Parent accounts are authenticated through the Platform's authentication system with email and password. Student sessions use short-lived access tokens (15-minute expiration) with rotating refresh tokens for secure, stateless session management;
Encryption: Data is transmitted over encrypted connections (HTTPS/TLS). Cloud storage providers encrypt data at rest;
Access controls: Internal access to personal information is restricted to authorized personnel who need access to perform their job functions, and all access is logged;
Service provider due diligence: We require our service providers to maintain appropriate security measures and to process personal information only as instructed by us.

Despite these measures, no system can be guaranteed to be 100% secure. In the event of a data breach affecting personal information, we will notify affected users and any applicable regulatory authorities as required by law, including notification to parents of affected children as required by COPPA and state breach notification laws.

8. Your State & Federal Privacy Rights

We comply with all applicable U.S. federal and state privacy laws. Depending on your state of residence, you and your child may have specific privacy rights. We honor these rights for all users, regardless of state of residence.

8.1 Federal Rights (COPPA).

If you are the parent or legal guardian of a child under 13 who uses the Service, you have the following rights under the Children's Online Privacy Protection Act (COPPA), 16 C.F.R. Part 312:

Right to Review: You may request to review the personal information we have collected from your child. We will provide the information in a clear and comprehensible format within a reasonable timeframe;
Right to Delete: You may request that we delete your child's personal information, subject to certain legal exceptions (e.g., where retention is required by law or for ongoing safety investigations);
Right to Refuse Further Collection: You may refuse to permit the further collection or use of your child's personal information. If you exercise this right, we will no longer be able to provide the Service to your child;
Right to Withdraw Consent: You may withdraw your previously given consent at any time by cancelling your subscription and contacting us to request deletion of your child's data;
Right to Direct Collection: You may direct us not to collect specific categories of personal information from your child in the future.

To exercise any of these rights, please contact us using the information in Section 11. We will verify your identity as the parent or legal guardian before processing your request, as required by 16 C.F.R. §312.6.

8.2 California Privacy Rights (CCPA/CPRA).

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know/Access: You may request the categories and specific pieces of personal information we have collected about you, the categories of sources, the business or commercial purpose for collecting the information, and the categories of third parties with whom we share it;
Right to Delete: You may request that we delete your personal information, subject to certain exceptions;
Right to Correct: You may request that we correct inaccurate personal information;
Right to Opt-Out of Sale/Sharing: You may opt out of the "sale" or "sharing" of your personal information. Some of our service providers, including analytics providers, may process usage data in ways that constitute "sharing" under the CCPA. To opt out of such sharing, you may contact us using the information in Section 12;
Right to Limit Use of Sensitive Personal Information: You may limit the use of your sensitive personal information to purposes necessary for providing the Service;
Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

California residents also have rights under the California Student Online Personal Information Protection Act (SOPIPA), Cal. Bus. & Prof. Code §22584, which prohibits the use of K-12 students' personal information for targeted advertising, profiling, or selling. We comply with SOPIPA.

8.3 Washington Privacy Rights (RCW 19.373 — My Health My Data Act).

If you are a Washington resident, you have the following rights under the Washington Privacy Act and the My Health My Data Act (RCW 19.373):

Right to Access: You may request a copy of your personal data;
Right to Delete: You may request deletion of your personal data;
Right to Opt-Out: You may opt out of targeted advertising, the sale of personal data, and certain profiling;
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights;
Right to Appeal: If we decline to take action on your request, you may appeal our decision.

Washington residents also have rights under Washington's student data privacy provisions (RCW 28A.604), which we comply with.

8.4 Other State Privacy Rights.

Residents of other U.S. states may have similar privacy rights under their state's applicable privacy laws, including but not limited to: Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), and other states that enact comprehensive privacy legislation. We honor these rights for all users, regardless of state of residence. If you wish to exercise any privacy right, please contact us using the information in Section 11.

8.5 How to Submit a Request.

To submit a privacy rights request, please contact us using the information in Section 11. In your request, please specify: (a) the right you wish to exercise; (b) whether the request is regarding your data or your child's data; and (c) enough information for us to verify your identity. We will verify your identity before processing the request and will respond within 45 days, as required by applicable law. If we need more time, we will inform you of the reason and extension period.

9. Data Retention

9.1 Active Subscriptions.

We retain personal information for as long as your account or subscription is active. This includes all student data, learning progress, conversation logs, voice recordings, and compliance records.

9.2 After Subscription Cancellation.

If you cancel your subscription, we will retain student records, learning progress data, and AI conversation logs (including voice recordings and transcripts) for a reasonable period (generally up to 12 months) for the following purposes:

Safety: to allow review of AI conversations if a safety concern is reported after cancellation;
Compliance: to maintain records required by applicable law;
Legal: to preserve evidence in case of anticipated or ongoing legal proceedings;
Reactivation: to allow you to reactivate your account and resume where you left off.

After this retention period, the data will be permanently deleted, except where a longer retention period is required by law. You may request earlier deletion at any time, subject to applicable legal exceptions.

9.3 Marketing Unsubscribe.

If you unsubscribe from marketing emails, we will mark your record as unsubscribed and cease sending promotional communications. We retain the minimum data necessary to honor your opt-out request (i.e., your email address and unsubscribe status) to ensure we do not accidentally send you marketing emails in the future.

9.4 Account Deletion.

You may request deletion of your account and all associated personal information at any time through the Platform's settings or by contacting us. We will delete your personal information and your child's personal information, including AI conversation logs and voice recordings, subject to applicable legal retention obligations. Account deletion is irreversible.

10. Children's Privacy (COPPA Details)

This Section supplements Section 8 above with additional details about our COPPA compliance practices. Shema Studies is designed for homeschooled students, including children under the age of 13.

10.1 Verifiable Parental Consent.

Before collecting any personal information from a child under 13, we obtain verifiable parental consent through the subscription purchase process described in our Terms of Service. The subscription purchase requires a parent to provide a payment method, which constitutes a verifiable consent method under 16 C.F.R. §312.5(b)(2). We do not collect personal information from children under 13 prior to obtaining this consent.

10.2 Direct Notice to Parents.

These Terms and this Privacy Policy serve as direct notice to parents about our information practices regarding children. Parents are encouraged to review both documents in full before enrolling their child.

10.3 No Behavioral Advertising.

We do not use children's personal information to deliver behavioral advertising to the child. We do not amass profiles about children that are not reasonably necessary for the operation of the Service.

10.4 No Conditioning on Disclosure.

We do not condition a child's participation in any game, prize, or other activity on the disclosure of more personal information than is reasonably necessary to use the Service for its intended educational purpose.

10.5 Service Providers & Third Parties.

We disclose children's personal information to third-party service providers (e.g., AI model providers, cloud storage providers) only as necessary to operate the Service. All such service providers are contractually obligated to: (a) maintain the confidentiality and security of the data; (b) use the data only for the purpose of providing their service to us; (c) not use the data for any other purpose, including their own commercial purposes; and (d) delete the data upon termination of the service relationship, where applicable.

10.6 Parental Rights.

Parents have the right to review, delete, and refuse the further collection of their child's personal information, as described in Section 8.1. To exercise these rights, please contact us using the information in Section 11.

10.7 Changes Requiring New Consent.

If we materially change our information practices regarding children's personal information in a way that requires new parental consent under COPPA, we will obtain new verifiable parental consent before implementing such changes with respect to your child's data.

11. Changes to This Policy

We may update or modify this Privacy Policy from time to time at our sole discretion. If we make material changes — especially changes that affect the collection, use, disclosure, or retention of children's personal information — we will notify you by email at the address associated with your account and/or by posting a prominent notice within the Service. The "Last updated" date at the top of this document will also be revised.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree to the updated policy, you must stop using the Service and cancel your subscription before the effective date of the changes.

For material changes to children's information practices, we will obtain new parental consent as required by COPPA before implementing such changes.

12. Contact

If you have any questions, concerns, or requests regarding this Privacy Policy, your personal information, your child's personal information, or wish to exercise any of your privacy or parental rights under COPPA, CCPA/CPRA, the Washington Privacy Act, or any other applicable law, please contact us at:

Shema Studies
601 South Pioneer Way, STE F-141
Moses Lake, WA 98837

We will make every reasonable effort to respond to your inquiry within a timely manner and in accordance with any applicable legal deadlines (generally within 45 days for privacy rights requests, and within 10 business days for marketing unsubscribe requests).