Privacy Policy

This Privacy Policy ("Policy") describes how Helios Collective Inc., a Delaware corporation ("Company," "we," "us," or "our"), collects, uses, discloses, and protects information in connection with the SafeLane platform and related services (collectively, the "Service"). By accessing or using the Service, you agree to the terms of this Policy.

1. Scope and Applicability

This Policy applies to all users of the Service, including parents, guardians, and authorized adult users ("Account Holders") and the minor children ("Children") whose profiles are created and managed by Account Holders. The Service is not directed to Children under 13 years of age without parental consent. All Children's accounts are created and supervised by Account Holders.

2. Information We Collect

2.1 Information Provided by Account Holders

• Account Registration Data: Name, email address, and authentication credentials (passwords are cryptographically hashed and never stored in plaintext).
• Child Profile Data: Child's first name (or alias), age or grade level, learning preferences, and subject interests, as provided by the Account Holder.
• Payment Information: Payment transactions are processed by Stripe, Inc. We do not store, process, or have access to full credit card numbers, bank account numbers, or other financial account credentials.
• Communications: Information you provide when contacting us for support or feedback.

2.2 Information Generated Through Use

• Conversation Data: Questions submitted to the AI tutoring system and the AI-generated responses.
• Project Data: Files, documents, and URLs uploaded to project workspaces, and AI-generated study materials.
• Usage Data: Session duration, features accessed, device type, browser type, IP address, and general interaction patterns.
• Analytics Data: Aggregated, anonymized performance metrics collected through Vercel Analytics.

3. Children's Privacy and COPPA Compliance

We are committed to complying with the Children's Online Privacy Protection Act ("COPPA") and applicable state privacy laws regarding minors. Specifically:

• Parental Consent Required: All Child accounts are created exclusively by a verified Account Holder (parent or guardian). We do not collect personal information directly from Children without prior verifiable parental consent.
• Limited Data Collection: We collect only the information necessary to provide the educational Service to Children.
• No Advertising to Children: We do not serve targeted advertising to Children, and we do not use Children's data for marketing purposes.
• No Third-Party Behavioral Tracking: We do not permit third parties to collect personal information from Children for behavioral advertising purposes.
• Parental Access and Control: Account Holders may review, correct, or delete their Child's personal information at any time through the Service settings or by contacting us at privacy@safelane.me.
• Right to Revoke Consent: Account Holders may revoke consent for the continued collection of a Child's information by deleting the Child's profile or contacting us.

4. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve the Service, including AI-powered tutoring functionality;
• Personalize the learning experience based on a Child's age, grade level, and learning preferences;
• Generate homework receipts and learning progress reports for Account Holders;
• Detect and flag potentially concerning content or interactions for parental review;
• Process payments and manage subscriptions;
• Respond to support requests and communications;
• Analyze usage patterns on an aggregated, anonymized basis to improve the Service; and
• Comply with legal obligations and enforce our Terms of Service.

5. How We Share Information

We do not sell, rent, or trade personal information. We share information only in the following limited circumstances:

• AI Service Providers: Conversation content is transmitted to third-party AI model providers (Anthropic, OpenAI, and Google) to generate educational responses. These providers process data pursuant to their respective data processing agreements and do not use your data to train their models.
• Payment Processor: Stripe, Inc. processes payment transactions in accordance with its privacy policy and PCI-DSS compliance standards.
• Infrastructure Providers: Supabase (database hosting) and Vercel (application hosting) provide infrastructure services and process data pursuant to their respective data processing agreements.
• Legal Compliance: We may disclose information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect the rights, property, or safety of the Company, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, user information may be transferred as part of that transaction, subject to the acquirer's commitment to honor this Policy.

6. Data Retention

• Conversation Data: Retained for 90 days from creation, after which it is automatically purged unless the Account Holder elects to delete it sooner.
• Account Data: Retained for the duration of the active account and for 30 days following account deletion to allow for recovery.
• Payment Records: Retained as required by applicable tax and financial reporting laws.
• Anonymized Analytics: May be retained indefinitely in aggregated, de-identified form.

7. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect personal information, including:

• Encryption of data in transit (TLS 1.2+) and at rest;
• Row-level security policies in our database to prevent unauthorized access;
• Cryptographic hashing of authentication credentials;
• Access controls limiting employee access to personal information on a need-to-know basis; and
• Regular review of security practices.

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

8. Your Rights and Choices

Subject to applicable law, you have the right to:

• Access: Request a copy of the personal information we hold about you or your Child.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your account and associated personal information.
• Data Portability: Request an export of your data in a machine-readable format.
• Opt-Out: Unsubscribe from non-essential communications at any time.

To exercise any of these rights, contact us at privacy@safelane.me. We will respond to verified requests within 30 days.

9. State-Specific Privacy Rights

Residents of certain U.S. states (including California, Colorado, Connecticut, Virginia, and others) may have additional rights under state privacy laws, including the right to know what personal information is collected, the right to delete, and the right to opt out of the sale or sharing of personal information. We do not sell personal information. To exercise your rights, contact us at privacy@safelane.me.

10. International Users

The Service is operated from the United States. If you access the Service from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to this transfer.

11. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you access.

12. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated by posting the revised Policy on this page with an updated "Last Updated" date and, where required by law, by providing direct notice to Account Holders. Continued use of the Service after changes become effective constitutes acceptance of the revised Policy.

13. Contact Information

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or need to report a concern, contact us at:

Helios Collective Inc.
Email: privacy@safelane.me
Web: safelane.me/contact