Privacy Policy

This Privacy Policy explains how AIERA School(“AIERA School”, “we”, “us”) collects, uses, stores, and shares information when you create a AIERA School account and your child takes a AIERA School assessment.

1. Data we collect

From the parent account holder:

• Full name
• Email address
• Country and (where applicable) state or province
• Hashed password (we never store passwords in plaintext; bcrypt with 12 rounds)
• Payment metadata from Stripe (we do not store card numbers)

For each child added to your account:

• First and last name
• Grade level
• School name (optional)
• Country
• AIERA School Student ID (assigned automatically; format AIERA-YYYY-XXXXX)

We deliberately do notcollect children's dates of birth, photos, biometric data, location, contact information, or government identifiers.

2. How we use data

• To administer the AIERA School exam, score it, and produce diagnostic reports.
• To compute national and global percentiles by comparing your child's composite score against the population of test takers in the same grade.
• To send you transactional emails (account, payment, refund, exam completion, results release) and — based on your preferences — reminders and re-engagement messages.
• To improve AIERA School psychometrically: anonymized, aggregated response data informs item calibration and future content.

3. Children's privacy (COPPA-aligned)

AIERA Schoolis intended for children under 13 only with verified parental consent. The parent who creates the account is the verifying adult. Parents have the right to review their children's information, request corrections, or request deletion at any time.

Children do not have direct accounts on AIERA School — all activity is mediated through the parent account. Children do not receive marketing email of any kind from AIERA School.

4. Storage and security

• Data is stored in a managed Postgres database (Neon) located in the United States. Personally identifying email addresses are stored both in plaintext (for unique-key lookup) and in an encrypted column at rest.
• Backups are encrypted in transit and at rest.
• The application is hosted on Vercel; HTTPS is enforced on all routes.
• Credit-card payment information is processed entirely by Stripe; AIERA School never sees full card numbers.
• Live exam state is cached temporarily in Upstash Redis with a 2-hour expiry.

5. Data sharing

We do not sell personal data. We share data only:

• With service providers we use to run AIERA School: Stripe (payments), Resend (email), Vercel (hosting), Neon (database), Upstash (cache). These providers act as data processors under our instructions.
• When required by law or valid legal process.
• For psychometric research: only fully anonymized aggregates leave the system (e.g., “67% of grade 4 students answered this item correctly”). Individual scores are never shared with third parties.

6. Data retention and deletion

Account data is retained while your account is active. When you delete or deactivate your account from Settings → Danger zone, your name is redacted, all children are marked inactive, and personally identifying email is rotated to an internal sentinel value. Aggregated, anonymized score data may be retained indefinitely for research purposes.

To request full erasure beyond the deactivation flow, contact [email protected].

7. Cookies and analytics

AIERA School uses functional cookies for session management (NextAuth) and CSRF protection. We do not use third-party tracking or advertising cookies. Server-side request logs include IP address and user agent for rate-limiting and security purposes; they are not used for advertising.

8. International transfers

AIERA School is operated from the United States; data is processed there even when you access the service from another country. By using AIERA School you consent to this transfer. Where required by local law (UK, EU, India, etc.), we will honor data subject rights including access, rectification, and erasure.

9. Changes to this policy

We may update this Privacy Policy. Material changes will be communicated by email and noted on this page (the “Last updated” field above).

10. Contact

Questions or requests: [email protected].