Privacy Policy

Website: Telos (https://telosedu.org)
Operated by: Brandon Bonner and Rowan Block, general partners doing business as "Telos," a general partnership formed under the laws of South Carolina, United States
Contact: noreply@telosedu.org
Effective Date: July 27, 2026
Last Updated: July 27, 2026

1. Introduction

This Privacy Policy explains how we collect, use, share, and protect information when you visit telosedu.org (the "Site") or use our courses, tools, and related services (together, the "Services").

We are based in the United States. If you use the Services from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States.

By using the Services, you agree to this Privacy Policy. If you do not agree, please do not use the Services.

2. What Information We Collect

2.1 Information You Give Us

Account information: name, email address, password (stored in encrypted form), and account preferences.
Profile and learner information: the display name, age range, or grade level you enter for a learner, and any settings you choose.
Content you submit: answers, written responses, drawings, uploads, chat messages sent to our AI assistant, and any other material you enter into the Services.
Communications: messages you send us by email, contact form, waitlist form, or support request.

2.2 Information Collected Automatically

When you use the Site, we and our service providers may collect:

IP address and approximate location derived from it (city or region level).
Browser type, device type, operating system, and screen size.
Pages viewed, links clicked, referring website, and time spent on pages.
Dates and times of access, and error or diagnostic logs.
Cookies used to keep you signed in and remember your settings (see Section 8).

We use Vercel Analytics to understand how visitors use the Site. Vercel Analytics is privacy-focused: it does not use cookies, does not store an identifier on your device, and does not track you across other websites. It records page views and aggregate usage patterns only. We do not use Google Analytics or any advertising or cross-site tracking service.

2.3 Payment Information

We do not currently accept payments and do not collect billing or payment card information. If we begin charging for the Services, we will update this Privacy Policy and tell you before any payment information is collected.

2.4 Information We Do Not Intentionally Collect

We do not ask for and do not want to receive sensitive information such as government identification numbers, financial account numbers, health records, biometric data, precise GPS location, or information about race, religion, political opinions, or sexual orientation. Please do not submit this information through the Services.

3. How We Use Information

We use the information we collect for the following purposes:

To provide the Services: create and maintain your account, deliver course content, save progress, and generate personalized learning activities.
To communicate with you: send confirmations, receipts, service notices, security alerts, and answers to your questions.
To send marketing messages: send newsletters or product updates only where permitted by law or where you have opted in. You can unsubscribe at any time using the link in any marketing email.
To improve the Services: analyze usage patterns, test new features, fix errors, and improve content quality and accessibility.
To keep the Services safe: detect and prevent fraud, abuse, spam, scraping, and violations of our Terms and Conditions.
To meet legal obligations: comply with tax, accounting, and other legal requirements, and respond to lawful requests from authorities.

Legal bases (for users in the EEA and UK). We process personal data where: (a) it is necessary to perform our contract with you; (b) you have given consent (for example, for non-essential cookies or marketing email); (c) it is necessary for our legitimate interests in operating and securing the Services, provided those interests are not overridden by your rights; or (d) it is necessary to comply with a legal obligation.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.

4. Artificial Intelligence Features

Parts of the Services use third-party artificial intelligence models to generate lessons, feedback, images, and conversational replies.

When you use an AI feature, the text or prompt you submit is sent to our AI provider to produce a response.
We instruct users not to include personal or identifying information in AI prompts, and we ask that learners use first names or nicknames only.
AI output can be inaccurate or incomplete. It is educational content, not professional advice. Please review Section 6 of our Terms and Conditions.

5. Children's Privacy

Our Services are designed for children's education but are intended to be purchased and managed by a parent, guardian, or teacher, who must be at least 18 years old.

Accounts must be created by an adult. Children may use the Services only through an account created and supervised by their parent, guardian, or school.
We ask adults to provide only the minimum information about a child — such as a first name or nickname and an age range.
We do not knowingly collect personal information directly from children under 13 without verifiable parental or school consent, as required by the U.S. Children's Online Privacy Protection Act (COPPA).
We do not use children's information for targeted advertising, and we do not sell it.
A parent, guardian, or school may review, request deletion of, or refuse further collection of a child's information at any time by emailing noreply@telosedu.org. We will verify the request before acting on it.

If we learn we have collected personal information from a child without the required consent, we will delete it promptly.

6. Third-Party Sharing

We share personal information only as described below. We do not sell it.

6.1 Service Providers (Processors)

We share information with vendors who perform services for us and are contractually required to protect it and use it only for our instructions. These include categories such as:

Category	Purpose	Example Providers
Hosting and content delivery	Host and serve the Site	Vercel Inc.
Database, accounts, and authentication	Store accounts, learner profiles, and course progress; send sign-in and confirmation email	Supabase, Inc.
Outbound email	Deliver account, confirmation, and service email	Resend, Inc.
Analytics	Measure Site usage (cookieless)	Vercel Analytics
AI processing	Generate lesson content, feedback, and images	Google LLC (Gemini and Imagen APIs)

6.2 Legal and Safety

We may disclose information if we believe in good faith that it is necessary to: comply with a law, subpoena, or court order; enforce our Terms and Conditions; investigate fraud or security incidents; or protect the rights, safety, or property of our users, the public, or us.

6.3 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will notify you if your information becomes subject to a materially different privacy policy.

6.4 With Your Direction

We share information with others when you ask us to or clearly agree to it.

7. Your Rights

7.1 Rights for Everyone

Regardless of where you live, you may:

Ask us what personal information we hold about you.
Ask us to correct information that is wrong.
Ask us to delete your account and associated data.
Unsubscribe from marketing email at any time.

To exercise these rights, email noreply@telosedu.org with the subject line "Privacy Request."

7.2 GDPR Rights (EEA, UK, and Switzerland)

If the GDPR or UK GDPR applies to you, you have the right to:

Access — obtain a copy of your personal data.
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion ("right to be forgotten").
Restriction — limit how we process your data in certain cases.
Portability — receive your data in a structured, machine-readable format.
Object — object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent — withdraw consent at any time, without affecting processing already carried out.
Complain — lodge a complaint with your local supervisory authority.

7.3 CCPA / CPRA Rights (California)

If you are a California resident, you have the right to:

Know the categories and specific pieces of personal information we collected, the sources, our purposes, and the categories of third parties we disclosed it to.
Delete personal information we collected from you, subject to legal exceptions.
Correct inaccurate personal information.
Opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of; we honor Global Privacy Control signals regardless.
Limit the use of sensitive personal information. We do not collect sensitive personal information for the purposes that trigger this right.
Non-discrimination — we will not deny service, charge different prices, or provide a lower quality of service because you exercised a privacy right.

7.4 Other U.S. State Rights

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana) have similar rights of access, correction, deletion, portability, and opt-out. We apply the protections in this section to all such residents.

7.5 How We Handle Requests

We will verify your identity before acting, usually by confirming control of the email address on the account.
An authorized agent may submit a request on your behalf with written proof of authorization.
We respond within 45 days (extendable by another 45 days where permitted) or within 30 days for GDPR requests (extendable by two months for complex requests).
Our response is free, unless a request is repetitive or clearly excessive.

8. Cookies and Similar Technologies

8.1 What We Use

Strictly necessary cookies — keep you signed in, keep your session secure, and remember your cookie choices. The Site cannot function without these.
Preference cookies — remember settings such as language or display options.

We do not use analytics cookies, advertising cookies, or cross-site tracking cookies. Our analytics provider measures Site usage without cookies or device identifiers.

Because we set only strictly necessary and preference cookies, most cookie-consent laws do not require us to obtain consent before setting them. We still describe them here so you know what is stored.

8.2 How to Control Cookies

Cookie banner: if we ever add non-essential cookies, we will ask for your consent first where the law requires it, and you will be able to change your choice at any time.
Browser settings: most browsers let you block or delete cookies. See the "Help" or "Privacy" settings of Chrome, Safari, Firefox, or Edge.
Analytics: our analytics provider does not use cookies or device identifiers, so there is nothing to opt out of. Blocking it in your browser will not affect how the Site works.
Do Not Track / Global Privacy Control: we honor Global Privacy Control signals as an opt-out request. Browser "Do Not Track" signals have no agreed standard, so we do not respond to them separately.

Blocking strictly necessary cookies may prevent you from signing in or saving progress.

9. Data Retention

We keep personal information only as long as we need it:

Data	Retention Period
Account and profile data	While your account is active, then deleted or anonymized within 30 days of account closure
Learner progress and submitted work	While your account is active, then deleted with the account
Marketing email list	Until you unsubscribe, then suppressed to honor your opt-out
Support and email correspondence	2 years after the matter is closed
Server and security logs	90 days
Analytics data	Aggregate, non-identifying usage data retained by our analytics provider, currently 12 months

We may keep information longer where required to comply with a legal obligation, resolve a dispute, or enforce our agreements.

10. Data Security

We use reasonable administrative, technical, and physical safeguards, including encryption in transit (HTTPS), encryption of stored passwords, row-level access controls on our database, access limited to staff who need it, and regular review of our providers.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any regulator as required by applicable law.

11. International Transfers

We are located in the United States and process data there. For transfers of personal data from the EEA, UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable) or another lawful transfer mechanism, together with additional safeguards where appropriate. You may request a copy of the relevant safeguards by emailing us.

12. Third-Party Links

The Site may link to other websites we do not control. This Privacy Policy does not apply to them. Please read the privacy policy of any site you visit.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will change the "Last Updated" date at the top. If the changes are material, we will give you notice by email or a clear notice on the Site before they take effect. Continuing to use the Services after the effective date means you accept the updated policy.

14. Contact Us

Questions, requests, or complaints about privacy:

Email: noreply@telosedu.org
Postal address: Telos, 2314 Santee Avenue, Columbia, South Carolina 29205, United States
EU/UK representative (if applicable): not currently appointed

We aim to reply to every privacy request within 5 business days.

Read the Terms and Conditions Back to Telos