Privacy Policy
Effective date: June 4, 2026
Notavo is an educational platform operated by Notavo. This policy explains what information we collect from schools, teachers, and students, how we use it, and the rights families and schools have. Protecting student data is central to how Notavo is built.
1. Our role
When a school or district uses Notavo, the school controls the student data. We act as a service provider, a school official with a legitimate educational interest under FERPA, processing data only to provide the service and only under the school's direction. We do not use student data for our own purposes.
2. Information we collect
From students: a first name and last initial, a class code, and the work they do in the product, such as tutoring conversations, practice answers and scores, songs they create, and activity and progress data. Student accounts are not tied to email addresses; students join through a class code. From teachers and administrators: account details such as name, email, school, and role. Automatically: basic usage and log data needed to run and secure the service.
3. How we use information
We use it only to provide and improve the educational service: delivering tutoring and practice, generating progress insight for teachers, keeping the service secure, and meeting legal obligations. We do not sell student data, we do not show advertising, and we do not build commercial profiles of students or use their data for behavioral targeting.
4. Children's privacy (COPPA)
Notavo is intended for use in a school setting. For students under 13, we rely on the school to provide consent on behalf of parents for the educational use of the service, consistent with FTC guidance, and on verifiable parental consent where applicable. We collect only the data needed for the educational service and use it only for that purpose.
5. Service providers we use
We use a small set of trusted providers, each receiving only what it needs: Google Firebase (Google LLC) for hosting, authentication, and database; Anthropic (Claude) to power the tutoring and practice features by processing the text a student submits; and ElevenLabs to generate audio for certain features. Before student-entered content is sent to our AI providers, we take steps to remove direct personal identifiers. We require these providers to process data only to provide their service to us, not for their own purposes, and not to train their models on student data.
6. Data sharing
We do not sell student data. We share it only with the service providers above, with the school or district that controls the data, when directed by the school, or when required by law.
7. Data retention and deletion
We keep student data only as long as needed to provide the service or as directed by the school. When a school ends its use of Notavo, or on a valid request, we delete or return student data within 45 days. Schools, parents, and eligible students can request access, correction, or deletion through the school.
8. Security
We protect data with encryption in transit, access controls, and school-level data separation so one school's data is not accessible to another. No system is perfectly secure, but we work to protect data and to notify affected schools promptly of any incident involving their data.
9. Rights of parents and eligible students
Under FERPA, parents and eligible students have the right to access, review, and request correction or deletion of education records. Because the school controls these records, please direct requests to your school, and we will support the school in fulfilling them.
10. State student data privacy laws
We comply with applicable federal and state student data privacy laws in the places our schools operate, including New Jersey. Where a state grants additional rights, those rights apply.
11. Changes to this policy
We may update this policy. We will post the new effective date and, for material changes affecting student data, notify the schools that use Notavo.
12. Contact
Notavo, admin@notavo.org.