🤝 Who We Share Information With

We do not sell your personal data. We only share information with trusted third-party partners who help us operate and provide Chalkie AI, under strict confidentiality and data processing agreements:

OpenAI : We send the prompts and content you provide to OpenAI's API to generate lesson content and other outputs as requested by you. No personal identifiers (like your name or email) are sent with this content. Please review OpenAI's policies for how they handle data received via their API: https://openai.com/policies/usage-policies/

DigitalOcean : Hosts our application servers, website, and stores service data securely.

Google : Manages authentication if you sign in with Google. Used for exporting content to Google Slides if you use that feature. We comply with the Google API Services User Data Policy, including the Limited Use requirements.

Stripe : Handles payment processing securely. We do not store your full card details.

Microsoft Clarity : Provides aggregated and anonymized insights into user journeys and website behaviour to help us improve usability.

YouTube API Services : Used if our service allows embedding or retrieving YouTube content. Use of such features is governed by the YouTube Terms of Service and Google Privacy Policy.

We may also share data if required by law, to protect rights and safety, or in connection with a business transfer (e.g., merger or acquisition), ensuring appropriate safeguards are in place.

🌍 Data Hosting & International Transfers

Our primary servers, hosted by DigitalOcean, are located in Amsterdam, Netherlands 🇳🇱. Data storage and processing comply with GDPR standards.

If we transfer personal data outside the UK, EEA, or Australia (e.g., through our use of third-party services like OpenAI based in the US), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the relevant authorities or verifying the recipient's participation in a recognized adequacy framework, to protect your data in accordance with UK GDPR, EU GDPR, and the Australian Privacy Principles (APPs).

🍪 Cookies and Similar Technologies

We use cookies (small text files placed on your device) and similar technologies (like web beacons or pixels) to operate our website, remember your preferences, analyze performance, and potentially for marketing purposes. These may include:

Essential Cookies: Necessary for the website and service to function (e.g., login sessions).

Analytics Cookies: Help us understand how users interact with our service (e.g., Google Analytics, Microsoft Clarity).

Preference Cookies: Remember choices you make (e.g., language).

Marketing Cookies: Used to deliver relevant advertising (if applicable).

You can typically manage cookie preferences through your browser settings. For more detailed information on the specific cookies we use, their purposes, and how to manage your consent, please contact us.

📘 FERPA Compliance (U.S. Educational Institutions)

If Chalkie AI is used by a U.S. school or district ("School"):

School Official Status: Where applicable under a contract with a School, Chalkie acts as a "school official" with legitimate educational interests under FERPA (34 CFR § 99.31(a)(1)).

Educational Purpose: We collect and use "student data" (if any is provided by the School or its users) solely for the educational purpose of providing the Chalkie AI service as contracted by the School. We do not use student data for commercial purposes like targeted advertising.

Student PII: Chalkie AI is not intended for the direct collection or storage of sensitive personally identifiable information (PII) from student education records within the user-generated content itself (e.g., student names, grades, ID numbers within lesson plans or slides). Schools and their users (e.g., teachers) are responsible for the content they input and should avoid entering sensitive student PII into Chalkie AI prompts or generated materials. We implement reasonable security measures, but the School remains the primary controller of student data under FERPA.

Data Access & Deletion: The School can request access to, review, or request deletion of student data associated with their contract by contacting us. We will comply with such requests within a reasonable timeframe.

Data Security: We implement administrative, physical, and technical safeguards to protect any data processed, consistent with industry standards.

Data Breach: In the event of a data breach potentially involving student data, we will notify the affected School(s) promptly.

🇦🇺 Australian Privacy Act Compliance

For users in Australia, we are committed to complying with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs):

Collection: We only collect personal information reasonably necessary for our functions and activities.

Notification: As outlined in this policy, we inform you about the types of data collected, purposes, third-party sharing, and that data is primarily stored securely in Amsterdam, Netherlands.

Access and Correction: You have the right to request access to and correction of your personal information we hold (see "Your Data Protection Rights").

Data Security: We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorized access, modification, or disclosure.

Cross-border Disclosure: We take reasonable steps to ensure overseas recipients (like OpenAI or DigitalOcean) handle your data in accordance with the APPs, typically through contractual clauses.

Notifiable Data Breaches (NDB): We comply with the NDB scheme requirements in case of eligible data breaches.

🔐 Your Data Protection Rights

Depending on your location and applicable law (particularly under GDPR and similar regulations), you have rights regarding your personal data:

Right of Access: Request a copy of the personal data we hold about you. 📥

Right to Rectification: Ask us to correct inaccurate or incomplete information. ✏️

Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data under certain conditions (e.g., it's no longer needed for the purpose it was collected). 🗑️

Right to Restrict Processing: Ask us to limit how we process your data in specific circumstances. ⛔

Right to Object: Object to processing based on legitimate interests or for direct marketing. 🙅

Right to Data Portability: Request your data be transferred to you or another organization in a structured, commonly used, machine-readable format (where processing is based on consent or contract and automated). 🔄

Right to Withdraw Consent: If processing is based on consent, you can withdraw it at any time (this won't affect past processing). ❌

There is usually no fee to exercise these rights. We aim to respond to verifiable requests within one calendar month. 🕓

📬 To make a request, please contact us using the details at the top of this policy. We may need to verify your identity before fulfilling your request.

📣 How to Complain

We hope to resolve any concerns you have directly. Please contact us first using the details provided above.

However, if you are unsatisfied with our response or believe we are not processing your data in accordance with the law, you have the right to lodge a complaint with your local data protection supervisory authority:

In the UK: Information Commissioner’s Office (ICO)

Website: https://www.ico.org.uk/make-a-complaint

Helpline: 0303 123 1113 ☎️

In Australia: Office of the Australian Information Commissioner (OAIC)

Website: https://www.oaic.gov.au/privacy/privacy-complaints/lodge-a-privacy-complaint-with-us

In the EU: Contact the data protection authority in your member state.

In the U.S.: FERPA complaints are typically handled through the educational institution or the U.S. Department of Education's Student Privacy Policy Office (SPPO).

🔄 Changes to This Policy

We may update this privacy policy from time to time. The "Last Updated" date at the top indicates the latest revision. We encourage you to review this policy periodically. For significant changes, we may notify you via email or through the service.

🙏 Thank you for using Chalkie AI!