Privacy Policy – HEARTH LSM

1. Operator and contact

The operator of the Platform is the entity providing this service. For privacy-related questions, data requests, or complaints, contact us at lsm@hearthvision.com.

2. Information we collect

Account and profile data: Name, email address, password (hashed), role (e.g., administrator, principal, teacher, student), and, where applicable, grade level, graduation year, school and class assignments, and profile photo.
Student education records: Assessment results, scores, completion status, and related data created or submitted through the Platform in an educational context. Such data may constitute “education records” under FERPA when maintained by a school.
School and class data: School name, address, contact details, theme and branding, class rosters, and content uploaded or entered by schools (e.g., announcements, gallery items).
Usage and technical data: Log data (e.g., IP address, browser type, timestamps), session information, and similar technical data necessary for security, availability, and abuse prevention.

3. Legal basis and purposes

We process personal information to provide, secure, and improve the Platform; to fulfill our contract with schools and users; and, where applicable, with consent or under the “school official” exception under FERPA when we act on behalf of the school. We use information to:

Deliver assessment, gradebook, and progress-tracking features.
Manage accounts, roles, and school/class assignments.
Send transactional and security-related communications (e.g., verification, password reset).
Protect against fraud, abuse, and security incidents.
Comply with legal obligations and respond to lawful requests.

4. Children under 13 (COPPA)

The Platform may be used by students under 13 in a school or homeschool context. We do not knowingly collect personal information from children under 13 except where:

A school or educational institution has authorized use and provided consent where required (e.g., under COPPA’s school consent provisions), or
A parent or guardian has provided verifiable consent for homeschool or similar use.

If you believe we have collected information from a child under 13 without proper consent, contact us at lsm@hearthvision.com and we will take steps to delete such information.

5. FERPA and education records

Where the Platform is used by schools subject to FERPA, student data that constitutes “education records” is maintained in accordance with FERPA. We act as a “school official” with a legitimate educational interest when we process such data on behalf of the school under our agreement. We do not use education records for advertising or sell them. We may disclose education records only as permitted by FERPA (e.g., with consent, under applicable exceptions, or as required by law).

6. Security and retention

We operate a private system and follow current, highly secure standards to protect personal information. We implement appropriate technical and organizational measures (including encryption, access controls, and secure hosting) to protect data against unauthorized access, alteration, disclosure, or destruction. Data backups are performed for reliability and disaster recovery; backups are stored under the same security standards and are not shared with or accessible to third parties. We retain data only as long as necessary to provide the service, comply with law, or resolve disputes. Schools may request deletion or export of their data; we will honor such requests in accordance with our agreements and applicable law.

7. Sharing and disclosure

We do not share, sell, or disclose your information to third parties. Data backups are maintained by us under the same security standards and are not shared with or accessible to any third party. The only circumstances in which information may be disclosed are:

Within the Platform: Authorized users within the same school or class (e.g., teachers viewing their students’ results) as part of normal operation of the private system.
When required by law: To law enforcement or other parties when required by applicable law or to protect rights and safety.

We do not use service providers or subcontractors to process or access your data for their own purposes; any infrastructure used to run the Platform is operated under strict technical and contractual controls so that your data remains private and is not shared with third parties.

8. Your rights

Depending on your role and jurisdiction, you may have the right to access, correct, or delete your personal information; to object to or restrict certain processing; and to data portability. Parents and guardians may have the right to review or delete information collected from their children. To exercise these rights, contact us at lsm@hearthvision.com. Schools can manage and export data through the Platform and by contacting us.

9. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top will be revised, and we will provide notice of material changes where required by law (e.g., by email or a notice on the Platform).