Sandbox

1. Introduction

This Privacy Policy explains how SandboxLearn (“Sandbox,” “we,” “us”), headquartered at 156 Portland Street, Toronto, Canada, collects, uses, stores, and shares personal information when you use Sandbox (the “Service”), an AI-assisted lesson-planning platform for teachers. It applies to teachers, schools, and school boards that use the Service, and to parents, guardians, and students whose information a teacher enters into it.

This policy works together with our Terms of Service, Terms and Conditions, and FERPA Notice. Where student education records are involved, the FERPA Notice describes the rights of parents and eligible students in more detail.

2. Our Role

When a teacher, school, or school board uses Sandbox with student information, that institution is the party responsible for the information, and we process it on their behalf and on their instructions. Under the U.S. Family Educational Rights and Privacy Act (FERPA), we act as a “school official” with a legitimate educational interest, under the direct control of the school. Under Canadian federal and provincial privacy laws, we act as a service provider processing information for the institution.

For teacher account information, such as the details in a Teacher Profile, we are the party responsible for that information and this policy governs how we handle it.

3. Information We Collect

Account and Teacher Profile information. Your name, email address, a hashed password, and the profile details you provide during onboarding or in Settings: where you teach (country, province or state, school board, school), teaching style, experience, and goals, along with your account role, approval state, and subscription tier.

Content you create. The Lessons, Presentations, Documents, Rubrics, Classes, and calendar entries you build or upload, and the prompts and Context Material you send to the assistant in a Chat.

Student Records. Real, identifiable student data (such as names and grades) that an authorized teacher enters. During the current pilot, teachers are asked to enter mock or demo data only, and no real student personal information, unless we have told them in writing that student-records features are available. Student Records are stored in an isolated database and are never sent to the assistant or used by AI features.

Usage and technical data. Information such as pages visited, features used, session activity, browser and device details, and IP address, which we use to run, secure, and improve the Service. We do not use this data for advertising.

Payment information. Sandbox is currently free. If paid tiers are introduced, payments will be handled by Stripe. Card details are processed by Stripe and are never stored on our servers.

4. How We Use Information

We use information to provide and maintain the Service; to let you create, manage, and organize Lessons and related content; to power AI features that generate and edit content for you; to keep the Service secure and prevent unauthorized access; to respond to your support requests; to communicate with you about your account and material changes to the Service; and to meet our legal obligations.

We do not sell personal information. We do not use student information for advertising or marketing, and we do not build advertising profiles from it.

5. AI Features

When you use a Chat or another AI feature, the prompt you write and any Context Material you attach are sent to the AI service providers that generate the response. Those providers process this content under agreements that limit its use to providing the feature to you. Context Material never includes Student Records.

AI-generated content is provided for you to review, edit, and use. You are responsible for checking it before using it with students. See our Terms of Service for the terms that apply to AI-generated content.

6. Children’s Privacy

Sandbox is a tool for teachers, not a service that children sign up for or use directly. We do not knowingly collect personal information directly from children. Where a teacher enters student information for educational purposes, that information is handled as an education record under FERPA and under applicable Canadian privacy laws, and only authorized educators can enter or view it.

Under the U.S. Children’s Online Privacy Protection Act (COPPA), where it applies, schools may provide consent for the collection of student information for use in the educational context. We collect only the minimum information needed for that purpose. Parents and guardians may, through their school, request to review a child’s information, request its correction, or request its deletion.

7. How We Share Information

Service providers. We share information with providers who process it on our behalf to run the Service, under agreements that restrict their use of it to that purpose. These include Google Firebase (Google Cloud) for hosting, database, and authentication; Stripe for payment processing if paid tiers are introduced; our AI service providers for AI features; and providers that help us send email and monitor security.

Legal reasons. We may disclose information where we are required to by law, to respond to lawful requests, or to protect the rights, safety, and security of our users, the public, or Sandbox.

Business transfers. If Sandbox is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

We do not sell personal information, and we do not share student education records except as permitted by FERPA, as directed by the responsible institution, or as required by law.

8. Data Storage and Security

We store data using Google Firebase (Google Cloud). Student Records are held in a separate, isolated database with stricter access rules than the rest of the Service. We use reasonable administrative, technical, and physical safeguards, including encryption in transit and at rest, role-based access controls so that only authorized educators can reach the records they are responsible for, audit logging of access to student records, and automatic session timeouts after periods of inactivity.

No system is completely secure. You must keep your login credentials confidential, use the Service only through your own account, and tell us promptly if you suspect unauthorized access. If we become aware of a breach affecting your data, we will notify you and the affected institution without unreasonable delay, in line with our FERPA Notice and applicable law.

9. Data Location

Sandbox is operated from Canada, and information may be stored and processed in Canada, the United States, and other countries where our service providers operate. Where information is transferred across borders, we rely on our agreements with those providers to protect it. Laws in those countries may differ from the laws where you live.

10. Data Retention

We keep personal information for as long as your account is active and as needed to provide the Service. If you close your account, you have a 30-day grace period to export your content, after which your data is deleted, except where the law requires us to keep certain records (for example, audit logs and consent records) for longer. Student Records are retained and deleted in line with the instructions of the responsible institution and applicable law.

11. Your Rights and Choices

Teachers. You can view and update your Teacher Profile in Settings, export the content you have created, and close your account from your data and privacy settings. You may also ask us to access, correct, or delete your account information.

Parents, guardians, and eligible students. Rights to inspect, correct, and request deletion of a student’s education records are described in our FERPA Notice. Because the school is the party responsible for those records, requests are generally made through the school, and we will support the school in responding.

Depending on where you live, you may have additional rights under Canadian or other privacy laws, such as the right to access the personal information we hold about you and to ask that it be corrected. To exercise any of these rights, contact us using the details below.

12. Cookies and Similar Technologies

We use only the cookies and similar technologies needed to sign you in, keep your session secure, and remember your preferences. We do not use advertising cookies or sell information collected through cookies. You can control cookies through your browser settings, though disabling essential cookies may stop parts of the Service from working.

13. Changes to This Policy

We may update this policy from time to time. For material changes we will give notice by email or in-app notice before they take effect, and where a change materially affects how student information is handled, we will seek renewed consent where required. Continued use of the Service after the effective date means you accept the updated policy.

14. Contact Us

For privacy questions, data access requests, or to report a concern, contact SandboxLearn, 156 Portland Street, Toronto, Canada. Email: privacy@sandboxlearn.com. You can also reach us through our contact page.