Privacy Policy

This Privacy Policy explains how we collect, use, share, and protect information when you visit telosedu.org (the "Site") or use our courses, tools, and related services (together, the "Services").

We are based in the United States. If you use the Services from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States.

By using the Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services.

When you use the Site, we and our service providers may collect:

We use Vercel Analytics to understand how visitors use the Site. Vercel Analytics is privacy-focused: it does not use cookies, does not store an identifier on your device, and does not track you across other websites. It records page views and aggregate usage patterns only. We do not use Google Analytics or any advertising or cross-site tracking service.

We accept payment for our course and for a NOVA subscription. Payments are processed by Stripe, Inc., and we never see or store your full card number. Your card details go from your browser to Stripe directly.

What we hold on our own systems is only what we need to know what you bought: a Stripe customer identifier, which product you have, its status, when the current period ends, and how many learner seats it covers.

What Stripe holds, under its own privacy policy, includes your name, email address, billing address, the card details you enter, and the transaction record. Stripe uses this both on our instructions and for its own legal purposes — fraud prevention, anti-money-laundering, and financial reporting — for which it is an independent controller and we are not. See Section 6.1.

Sales tax is calculated at checkout from the billing address you give. We keep the address only as part of the transaction record described in Section 9.

We do not ask for and do not want to receive sensitive information such as government identification numbers, financial account numbers, health records, biometric data, precise GPS location, or information about race, religion, political opinions, or sexual orientation. Please do not submit this information through the Services.

We use the information we collect for the following purposes:

Legal bases (for users in the EEA and UK). We process personal data where: (a) it is necessary to perform our contract with you; (b) you have given consent (for example, for non-essential cookies or marketing email); (c) it is necessary for our legitimate interests in operating and securing the Services, provided those interests are not overridden by your rights; or (d) it is necessary to comply with a legal obligation.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.

Parts of the Services use third-party artificial intelligence models to generate lessons, feedback, images, and conversational replies.

Our Services are designed for children's education but are intended to be purchased and managed by a parent, guardian, or teacher, who must be at least 18 years old.

Before a child uses the Services, the adult who owns the account must affirm, at signup and under this notice, that they are the parent, legal guardian, or teacher of the learners who will use it, and must confirm control of the email address they gave us.

Where an account is purchased, the card transaction together with the notice we email you at the moment of purchase serves as our verification. That notice sets out what we collect, that a child's work is sent to the AI provider described in Section 6, and how to review, delete, or withdraw. This is the consent we rely on for that disclosure, and we record which of these methods verified each account and when.

Where a school signs an agreement with us, the school provides consent on behalf of the parents in its role as the holder of the education records.

On free accounts. A free account is verified by the signup affirmation and confirmed email address alone. If you would rather your child's work were not sent to an AI provider at all, do not use the AI features: the course can be worked through without them, and NOVA's memory can be switched off or the tutor left unused. You can also delete anything already sent, at any time, from your account.

We keep a record of each consent — the method, the date, and the version of this notice it was given under — for as long as the account exists, so that we can demonstrate we obtained it. Closing the account deletes that record along with everything else tied to it.

At any time you may:

Email support@telosedu.org. We will verify that the request comes from the account holder before acting on it, and we will act within 30 days.

Inside the product, the account holder can also review and delete what the AI tutor has remembered at any time, and can turn that memory off entirely, without contacting us.

If we learn we have collected personal information from a child without the required consent, we will delete it promptly.

We share personal information only as described below. We do not sell it.

We share information with vendors who perform services for us and are contractually required to protect it and use it only for our instructions. These include categories such as:

Stripe is not only our processor. For fraud prevention, anti-money-laundering checks, and its own financial and regulatory reporting, Stripe decides how it uses your payment data and acts as an independent controller. We have no control over that use and it is governed by Stripe's Privacy Policy rather than this one.

We use the paid tier of Google's Gemini and Imagen APIs. Under those terms, what you and your learners submit is not used to train or improve Google's models. Google processes it to generate the reply and may retain it briefly for abuse monitoring under its own published terms. We do not use your learners' work to train any AI model of our own, and we do not share it with any other AI provider.

We may disclose information if we believe in good faith that it is necessary to: comply with a law, subpoena, or court order; enforce our Terms and Conditions; investigate fraud or security incidents; or protect the rights, safety, or property of our users, the public, or us.

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will notify you if your information becomes subject to a materially different privacy policy.

We share information with others when you ask us to or clearly agree to it.

Regardless of where you live, you may:

To exercise these rights, email support@telosedu.org with the subject line "Privacy Request."

If the GDPR or UK GDPR applies to you, you have the right to:

If you are a California resident, you have the right to:

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana) have similar rights of access, correction, deletion, portability, and opt-out. We apply the protections in this section to all such residents.

We do not use analytics cookies, advertising cookies, or cross-site tracking cookies. Our analytics provider measures Site usage without cookies or device identifiers.

Because we set only strictly necessary and preference cookies, most cookie-consent laws do not require us to obtain consent before setting them. We still describe them here so you know what is stored.

Blocking strictly necessary cookies may prevent you from signing in or saving progress.

We keep personal information only as long as we need it:

The periods above are enforced by automated nightly jobs, not by hand: one deletes expired records in our database, one deletes what the tutor has learned about a learner once it is out of date, one deletes the corresponding uploaded files from storage, and one removes learner sign-ins that have been paused past the 60 days above. We keep a log of each run. Closing your account deletes the data tied to it regardless of where it sits in these windows — with one exception, which we want to be plain about: billing and transaction records survive account deletion, because tax and accounting law requires us to keep them. They are records of a payment, not of a learner, and contain nothing about your child.

We may keep information longer where required to comply with a legal obligation, resolve a dispute, or enforce our agreements.

We use reasonable administrative, technical, and physical safeguards, including encryption in transit (HTTPS), encryption of stored passwords, row-level access controls on our database, access limited to staff who need it, and regular review of our providers.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any regulator as required by applicable law.

We are located in the United States and process data there. For transfers of personal data from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) or another lawful transfer mechanism, together with additional safeguards where appropriate. You may request a copy of the relevant safeguards by emailing us.

The Site may link to other websites we do not control. This Privacy Policy does not apply to them. Please read the privacy policy of any site you visit.

We may update this Privacy Policy from time to time. We will change the "Last Updated" date at the top. If the changes are material, we will give you notice by email or a clear notice on the Site before they take effect. Continuing to use the Services after the effective date means you accept the updated policy.

Questions, requests, or complaints about privacy:

We aim to reply to every privacy request within 5 business days.