Privacy Policy

Co-Teacher is made by Simovia, Inc., a Delaware corporation (“Co-Teacher,” “we,” “us”), 2423 SW 147th Ave #2225, Miami, FL 33185. This policy explains what we collect when you use the Co-Teacher application and website (the “Service”), how we use it, and the choices you have. Privacy questions go to privacy@co-teacher.com.

This is our public privacy notice. It applies to everyone who uses the Service. For a school that has signed our School Data Privacy Agreement (at co-teacher.com/legal/school-agreement), or a separate data privacy agreement with us, that signed agreement controls over this policy where they differ. A school leader can get the agreement signed in a few minutes from the link at the end of this policy or from inside the app.

• Teachers upload student work and receive analysis and materials. A teacher’s school may or may not have signed our agreement; Section 5 explains the difference.
• School leaders sign the agreement for their school or network and may receive school-level reports.
• Parents and guardians may create their own account to analyze their own child’s work at home.
• Students do not use a school’s Co-Teacher accounts. Work from a school reaches us only because a teacher uploads it. Separately, a student aged 13 or older may create their own account to check their own work; that account is separate from any school’s and shows nothing from a school.

Account information. Name, email address, role (teacher, school leader, parent), school or organization, preferred language, and password or sign-in credentials. If you pay for a plan, Stripe processes the payment; we see the billing details Stripe passes to us and never full card numbers. Support messages you send us.

Student information, uploaded by a teacher or parent. Images of handwritten or printed student work. The student’s name or identifier, if it is written on the work or the teacher enters it; a teacher may use codes or numbers instead, and at a school that has not signed our agreement, teachers upload work with no names at all (Section 5). Grade level, subject and state. The assignment prompt, rubric or curriculum context the teacher adds. A list of student names, built from the names on the work or entered by the teacher. The analysis we generate: scores, feedback, misconceptions, suggested groups, lessons, worksheets and other materials, reports.

Parent and family information. For a parent’s own account: the parent’s name and email, their state, the child’s name and grade level, and what the parent uploads.

Usage and diagnostics. Which features are used and when (we use Mixpanel; the events carry account IDs, event names and counts, and teacher email, never student work, names or results); error reports (we use Sentry, with personal data masked and scrubbed); and server logs (which carry no student names and expire after 30 days). Cookies and similar storage keep you signed in and remember settings; we do not use advertising cookies.

What not to upload. Co-Teacher does not need, and you should not provide, a student’s date of birth, home address, contact information, government or student ID numbers, Individualized Education Program or Section 504 documents, or any health, disability or disciplinary information. If an uploaded image happens to contain such information, we treat the image as student data, store nothing from it as a separate field, and delete it on the same schedule as everything else.

A teacher can start using Co-Teacher before their school has signed our agreement. At the first scan, the teacher confirms that, until the school signs, they will upload work with no student names on it: a code, a made-up name, or nothing. Co-Teacher does not block or flag an upload that has a name on it. Because handwriting and content can in some cases be identifying, we protect every upload with the same security whether or not it carries a name. From the same screen, a teacher can send the agreement to their school leader, or a leader can send it to themselves. When the school signs, the agreement covers everything its teachers have uploaded, and teachers can use student names.

• To analyze student work and generate materials for the teacher or parent who uploaded it, and to match work to the right student and class.
• To run, secure, support and improve the Service, and to send service notices.
• To bill paid plans and prevent payment fraud.
• To comply with law and with a school’s instructions.
• To improve accuracy using de-identified work samples, as Section 8 describes, and to produce aggregate statistics from which no student, teacher or school can be identified.

• Sell or rent personal information, or share it for advertising.
• Use student data for advertising, or to build a profile of a student for any purpose other than the Service.
• Use student work, teacher prompts or generated output to train or fine-tune an AI model, ours or anyone else’s.
• Let any vendor use data we send it for its own purposes.
• Allow anyone under 13 to create an account.
• Use student data for any purpose other than providing the Service to the teacher, school or parent who uploaded it.

Co-Teacher sends uploaded work, with the context the teacher provides, to outside AI model providers to produce analysis and materials. As of the effective date, those calls run through Vercel AI Gateway with zero data retention turned on for our account: the gateway stores no inputs or outputs and routes only to providers that have agreed to zero-retention terms. The providers that receive student work are Google (Gemini models), OpenAI and Anthropic (Claude models), and the same models can be served by Amazon Bedrock or Google Vertex AI when a primary provider is unavailable. TypeSafe AI receives student names as text only, never the work itself, and matches a name read from a paper to the teacher’s class list. Translation of family-facing materials runs through Google Cloud Translation under our own account, which holds text in memory only while translating it and does not store it or use it for training. We do not use provider features that would store student data, such as prompt caching or provider-hosted evaluation tools. All AI processing takes place in the United States. The current list, with each provider’s terms, is at co-teacher.com/legal/subprocessors.

Co-Teacher’s scores, flags, groupings and materials are instructional analysis for the teacher. They are not grades of record, and Co-Teacher does not enter anything in a gradebook, student record or report card. Our analysis can be wrong. The teacher (or parent) decides what to do with it, and we make no automated decision that has a legal or similarly significant effect on a student.

Improving accuracy. We may keep copies of student work from a school’s accounts, from which the student’s name and every other direct identifier have been removed, including the original handwriting, and use them inside Simovia to check and improve the accuracy of our prompts, analysis and materials. We use these samples for no other purpose: never to train a model, never outside the company, never in marketing. A school can ask us to exclude its samples at any time.

• With the vendors that run the Service, listed with their roles, locations and retention terms at co-teacher.com/legal/subprocessors. Each is bound by contract to use data only to provide services to us. Signed schools get 30 days’ notice before we add or replace a vendor that will process student data.
• Within a school. Authorized staff of a signed school can see the data in their school’s accounts, as the school directs.
• With families, only as the school decides. Nothing from a school’s accounts is shared with a parent.
• With people a parent invites. A parent account holder may invite a trusted person (a tutor, a family member) to view the child’s work in that parent’s account. Invited people cannot invite others.
• Legal process. If we receive a subpoena, court order or other legal demand, we disclose only the minimum it requires, and for school data we notify the school first unless the law prohibits it.
• Safety and enforcement. To protect the safety of users or the public, or to enforce our Terms.
• Change of control. If Simovia is acquired or sells substantially all of its assets, the buyer is bound by this policy and by every signed school agreement, and the transaction is not a sale of student data. Signed schools receive written notice and may terminate.

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
• Access to student data limited to the people who need it to operate the Service, under role-based permissions and unique accounts, with multi-factor authentication for administrative and production access.
• Row-level access controls in the database, and logging of administrative activity in our cloud infrastructure, kept for 90 days.
• Storage and processing in the United States only, including at our AI providers.
• Privacy training for every person with access to student data, before access and annually.
• A written security program aligned to the NIST Cybersecurity Framework, summarized in Schedule 2 of the School Data Privacy Agreement.
• Cyber and data risk insurance with limits of $1,000,000 for each claim and $1,000,000 in the aggregate.

To report a suspected vulnerability, write to security@co-teacher.com. We acknowledge reports within two business days.

• Signed schools. We keep student data while the school’s accounts are active. On the school’s request, at any time including mid-year, or within 30 days after the agreement ends, we delete the school’s student data, including at our vendors, and purge backup copies within 30 days after that. We provide a written Certificate of Deletion on request, and an export of the school’s data before deletion if the school wants one.
• Teacher and parent accounts. You can delete your account in the app at any time; everything you uploaded is deleted within 30 days, with backups purged within 30 days after that. An account that has been inactive for 12 months is deleted, with notice to its email address.
• Individual requests. A teacher, parent or school may ask us to delete specific data at privacy@co-teacher.com. We complete the deletion within 30 days.
• What we keep longer. Billing records we are required to keep by law; server logs for 30 days; work a teacher emails in, held by our email vendor for 30 days; de-identified work samples described in Section 8, which carry no direct identifiers.
• Non-payment. We never delete student data because a bill is unpaid. If a school’s fees are overdue, we may suspend access after notice, and the school’s data stays available for export for at least 60 days before any deletion.

If we become aware of unauthorized access to, disclosure of, or loss of personal information, we notify affected schools and account holders without undue delay and no later than 72 hours after becoming aware, with what we know, what we have done, and a named contact. For a school, the school is the point of contact for families, and we notify parents directly only if the school or the law requires it. This is faster than any state law requires of us, including the seven calendar days under New York Education Law 2-d.

Accounts are for adults, meaning teachers, school staff and parents, and for students aged 13 or older using an account of their own. Children under 13 do not create accounts, and we do not knowingly collect personal information directly from a child under 13. Student work reaches us only through a teacher or a parent. When a school uses Co-Teacher, the school authorizes our handling of student records as a “school official” under FERPA, and, for a student under 13, provides the consent the Children’s Online Privacy Protection Act requires on the parent’s behalf for this educational purpose, as the Federal Trade Commission’s guidance for schools permits. When a parent uses Co-Teacher for their own child, the parent provides and controls that information. If we learn that a child under 13 has created an account, we close it and delete its data.

• Data in a school’s accounts belongs to the school. Parents and eligible students who want to inspect, correct or delete education records contact the school, which has those rights under FERPA; we assist the school.
• Your own account. You can view and update your account information in settings, export the materials you have generated, delete individual uploads, and delete your account.
• State privacy laws. If a state consumer privacy law applies to you as a teacher or parent (these laws generally do not cover FERPA-protected student records), you may ask us at privacy@co-teacher.com to access, correct or delete your personal information, or to receive a copy. We do not sell personal information or share it for targeted advertising, and we will not treat you differently for exercising your rights. We may need to verify your request; an authorized agent may write to the same address with proof of authority.

• Florida. As an operator under section 1006.1494, Florida Statutes, we do not engage in targeted advertising, do not profile students except for school purposes, do not sell or rent student information, collect no more than is reasonably necessary, maintain reasonable security, and delete a school’s data on request within 30 days, which is shorter than the statute requires. Co-Teacher is teacher-facing; a school’s students do not log in to it or provide information to it.
• Texas. As an operator under Texas Education Code Chapter 32, Subchapter D, we make the same commitments and delete covered information within 30 days of a school’s request, shorter than the 60 days the statute allows.
• New York. For a New York educational agency, we comply with Education Law 2-d and 8 NYCRR Part 121. Our New York Attachment, including the supplemental information for the school’s Parents’ Bill of Rights for Data Privacy and Security, is at co-teacher.com/legal/school-agreement/new-york. Parents may address complaints about possible breaches to their school and to the New York State Education Department’s Chief Privacy Officer at privacy@nysed.gov.
• Other states. We comply with the student privacy laws of each school’s state as they apply to us, and sign state-specific terms a school reasonably requires.

The Service is operated from the United States and all data is stored and processed there. If you use it from elsewhere, you understand that your information is processed in the United States.

We may update this policy. The effective date at the top shows the current version. For material changes we notify account holders by email or in the app at least 30 days before the change takes effect; a signed school’s agreement changes only as that agreement provides.

Privacy questions and requests: privacy@co-teacher.com. Security reports: security@co-teacher.com. The School Data Privacy Agreement: co-teacher.com/legal/school-agreement. Our vendors: co-teacher.com/legal/subprocessors. A plain-language overview for school leaders: co-teacher.com/legal/for-school-leaders/privacy.

Simovia, Inc., a Delaware corporation, 2423 SW 147th Ave #2225, Miami, FL 33185.