Privacy Policy

1. Introduction

EverTold, LLC ("Let's Vibe," "we," "us," or "our") operates an AI creative learning platform and curriculum program delivered through schools. This Privacy Policy explains how we collect, use, disclose, and protect information in connection with our platform and services.

This policy applies to all users of the Let's Vibe platform, including school administrators, teachers, and students who access the platform through their school's institutional subscription. If you are a student, your school has entered into an agreement with Let's Vibe on your behalf and is responsible for ensuring your access to the platform is appropriate under applicable law.

By accessing or using the Let's Vibe platform, you acknowledge that you have read and understood this Privacy Policy. Schools agree to this policy on behalf of their students and staff as part of their institutional contract with Let's Vibe.

2. Our Role as a Data Processor

Let's Vibe is a business-to-business (B2B) service provider. Schools and educational institutions are our direct clients (data controllers). We act primarily as a data processor with respect to student information - we handle that data on behalf of and under the instruction of the school.

This distinction matters under applicable data protection laws including the Lei Geral de Protecao de Dados (LGPD) and, where applicable, the General Data Protection Regulation (GDPR). The school bears responsibility for the lawful basis of processing student data and for securing any required consents from parents or guardians prior to enrolling students on the platform.

For information we collect directly from school administrators and teachers (such as account registration data), we act as a data controller in our own right.

3. Information We Collect

3.1 From Schools and Teachers

When a school registers for Let's Vibe or a teacher creates an account, we collect:

• Full name
• Work email address
• School or institution name and location
• Role within the institution (administrator, teacher, coordinator)
• Contact phone number (optional)

3.2 From Students (via the School)

Student accounts are created and managed by the school. Through normal use of the platform, we collect:

• Name (first name and last name)
• School-issued email address
• Grade level or year group
• Creative track selection (e.g., GameDev, SoundWave, Visual Arts, AppBuilder, StoryTeller)
• Module completion status and progress data
• Project submissions and creative work uploaded to the platform
• Earned badges and achievement records
• XP (experience points) and level data generated through platform activity
• Prompts entered into AI features and the responses returned, kept as conversation history the student and their teacher can review

3.3 Usage and Technical Data

When you use the platform, we automatically collect certain technical information to operate and improve the service:

• Browser type and version
• Device type and operating system
• IP address (used for security and fraud prevention, not for profiling)
• Session duration and feature usage patterns (aggregated)
• Error logs and performance data

We do not use tracking cookies for behavioral advertising. We do not build advertising profiles on users of any age.

3.4 Payment Information

We do not collect payment card information directly through the platform. School billing is handled through a separate invoicing process. All financial transactions are managed outside the platform, either directly or through a third-party billing provider.

4. How We Use Your Information

We use the information we collect to:

• Create and manage user accounts and school subscriptions
• Deliver curriculum content, module assignments, and platform features
• Track and display student progress to the student and their teacher
• Generate progress reports and completion records for teachers and administrators
• Administer achievement systems (badges, XP, levels) that motivate student engagement
• Provide technical support and respond to inquiries
• Diagnose technical issues, improve platform stability, and optimize performance
• Improve curriculum content based on anonymized and aggregated usage patterns
• Comply with applicable legal obligations

We process data only for the purposes described in this policy. We do not use student data for commercial purposes unrelated to delivering educational services.

5. How We Share Information

We do not sell personal data. We do not share personal data with third parties for advertising or marketing purposes. We may share data in the following limited circumstances:

5.1 Cloud Infrastructure and Hosting

The Let's Vibe platform is hosted on Vercel (infrastructure) and uses Neon or compatible PostgreSQL-compatible database services for data storage. These providers act as subprocessors and handle data only as necessary to provide the hosting service. They are bound by appropriate data processing agreements.

5.2 AI Service Providers

The platform's AI features are delivered through commercial AI providers. We use two, and each has a distinct and limited role:

• Groq, Inc. (GroqCloud): the provider for every text-based AI feature, including student tutoring, writing and code assistance, lesson planning support for teachers, and analysis of an image a student submits for feedback. It runs an open-weight model that Groq hosts on our behalf.
• Google LLC (Gemini API): used only to generate images and video. It is never used for tutoring, text, or analysis. Media generation is switched off by default and becomes available only when the platform owner enables it.

We do not send student names, email addresses, or school names to these providers. An AI request is assembled from anonymized context only: an opaque account identifier that is meaningless outside our own database, grade level, creative track, and progress counts, together with what the student types. The model is instructed never to ask for or repeat personal information.

We do not use student work to train AI models, and we do not license or sell it for that purpose. Content sent to the providers named above is processed to return a result to the student. Each provider's handling of that content is governed by its own published terms. We review those terms before adopting a provider, we make them available to schools in writing on request, and we notify schools before we add or replace a provider.

AI features are gated on consent. A student may use them only while an active guardian consent for AI use is on record; without one, no request reaches any provider. Any linked guardian may withdraw that consent at any time, and the withdrawal takes effect on the next request rather than at the end of a term. Teachers can review their own students' AI tutoring conversations for oversight.

5.3 Within Your School

Teacher accounts at a school can view the progress and submissions of students enrolled in their cohort. School administrators can view enrollment and completion data for students at their institution. Students cannot view other students' individual data.

5.4 Legal Requirements

We may disclose information if required to do so by law, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, user data may be transferred as part of that transaction. We will notify schools of any such change and ensure the acquiring entity is bound by data protection obligations consistent with this policy.

6. Children's Privacy and COPPA Compliance

Let's Vibe serves students ages 13 through 17. While the program is designed for students aged 13 and older, the Children's Online Privacy Protection Act (COPPA) in the United States imposes specific requirements for operators of websites and online services that collect personal information from children under 13, and we apply COPPA-aligned protections to all student data as a matter of policy.

Let's Vibe complies with COPPA through the school-operated model. We do not collect personal information directly from children or their parents or guardians. Instead, student accounts are created and managed entirely by the school as an institutional customer. Under COPPA's school official exception, schools may consent to the collection of student information on behalf of parents when the data collection is used solely for educational purposes within the school context.

Schools that enroll students under the age of 13 represent and warrant that they have obtained all necessary parental or guardian consents required under applicable law, including COPPA, before enrolling those students in the Let's Vibe platform.

We limit our collection of data from students under 13 to what is reasonably necessary for educational purposes. We do not condition participation in the program on a student providing more information than is necessary.

Parents or guardians who wish to review, correct, or request deletion of their child's information should contact their school, which retains control over student data. Schools may then coordinate with us at privacy@letsvibe.cc.

7. FERPA and US Student Records

The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g and 34 CFR Part 99, is the United States federal law that protects the privacy of student education records at schools, colleges, and universities that receive funding from the US Department of Education. It gives students, or their parents while the student is a minor at a K-12 school, the right to inspect and review their education records, to ask that inaccurate records be corrected, and to control most disclosures of personally identifiable information from those records.

FERPA obligations belong to the institution, not to us. At a college or university, those rights transfer to the student on enrollment, so a college student rather than a parent generally exercises them. The institution holds the education records; we host and process a portion of that information on its behalf.

Where a US institution determines that FERPA applies to information held on this platform, we operate as a school official with a legitimate educational interest under 34 CFR 99.31(a)(1). In practice that means:

• The institution keeps direct control of the records at all times.
• We use the information only for the purposes the institution designates in our agreement with it.
• We do not redisclose personally identifiable information from education records to anyone else without the institution's authorization, except where the law requires it.
• Access inside our company is limited to staff who need it to deliver the service, under the controls described in Section 10.
• On termination, records are exported to the institution and then deleted or irreversibly anonymized on the schedule in Section 9.

We do not determine whether a particular record is an education record, whether an exception applies, or whether an institution has met its own obligations. Those determinations belong to the institution. Before launch we provide our data-handling documentation, and we sign the data protection agreement the institution's counsel requires.

Requests to inspect, correct, or delete education records are made to the institution that holds them. When an institution instructs us to produce, correct, or delete information it controls, we act on that instruction. Institutions can reach us at privacy@letsvibe.cc.

8. LGPD Compliance (Lei Geral de Protecao de Dados)

Brazilian schools and their students are protected by the Lei Geral de Protecao de Dados (LGPD), Law No. 13,709/2018. Let's Vibe is committed to compliance with the LGPD in connection with the processing of personal data of individuals in Brasil.

Our LGPD commitments include:

• Purpose limitation: We collect and use personal data only for the educational purposes described in this policy and our agreements with schools.
• Data minimization: We collect only the data necessary to deliver the platform and curriculum program. We do not collect surplus information.
• Transparency: This policy is written in plain language, is available to every user, and sets out the terms on which we process school and student data. We notify schools of material changes before they take effect.
• Security: We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or destruction.
• Data subject rights: Users have the right to confirm the existence of processing, access their data, correct inaccurate data, request anonymization or deletion of unnecessary data, request data portability, and object to processing. Requests should be directed to privacy@letsvibe.cc.

Our Data Protection Officer (DPO) can be reached at privacy@letsvibe.cc. For data protection matters governed by Brazilian law, students and their schools may also contact the Autoridade Nacional de Protecao de Dados (ANPD).

9. Data Retention

We retain personal data for as long as the school's contract with Let's Vibe is active. Data is used to provide the platform and generate records accessible to the school during the subscription period.

Upon termination or non-renewal of a school's contract:

• The school will have 30 days from the contract termination date to request an export of their data in a portable format.
• Within 90 days of contract termination, all personal data associated with that school will be permanently deleted or irreversibly anonymized from our systems, except where retention is required by law.

Anonymized, aggregated data (such as aggregate cohort performance metrics) may be retained beyond the contract period for curriculum improvement and reporting purposes, provided it cannot reasonably be used to identify any individual.

10. Security

We take the security of personal data seriously, particularly given that our users include minors. Our security practices include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest in our database infrastructure
• Role-based access controls that limit which staff members can access user data
• Regular security reviews and vulnerability assessments
• Authentication controls including strong password requirements
• Logging and monitoring of access to sensitive data

No security system is impenetrable. In the event of a data breach that affects personal data, we will notify affected schools promptly and in compliance with applicable law, including LGPD notification requirements to the ANPD where applicable.

11. Your Rights

Depending on your location and applicable law, you may have the following rights with respect to your personal data:

• Access: Request confirmation of whether we process your data and receive a copy of that data.
• Correction: Request correction of inaccurate or incomplete personal data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Portability: Request a copy of your data in a structured, machine-readable format.
• Objection: Object to certain types of processing.

For student data, rights are typically exercised through the school. Schools may submit data subject requests on behalf of students to privacy@letsvibe.cc. We will respond to verified requests within the timeframes required by applicable law.

Teachers and administrators may exercise their rights directly by contacting us at privacy@letsvibe.cc.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the effective date at the top of this policy and notify schools via email or through an in-platform notice.

Continued use of the platform after the effective date of an updated policy constitutes acceptance of the revised terms. Schools that do not agree to a material change may terminate their contract in accordance with its terms.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: