1. Introduction

LabFlow (“we,” “our,” or “us”) is a classroom lab management platform designed for educational institutions. This Privacy Policy explains how we collect, use, disclose, and safeguard student and educator information in compliance with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and the Student Online Personal Information Protection Act (SOPIPA).

2. Information We Collect

We collect the following information to provide our educational services:

• Name and email address (provided at account creation)
• Role within the institution (teacher, student, administrator)
• Lab work, data entries, and reflection responses submitted during labs
• Help chat conversations (processed by Anthropic's Claude AI — see Section 5)
• Class enrollment and assignment records

3. FERPA Compliance

LabFlow acts as a “school official” under FERPA with a legitimate educational interest in student education records. We do not sell, share, or disclose student education records to third parties except as permitted by FERPA. Students and parents have the right to inspect, review, and request corrections to education records. To exercise these rights, contact your school administrator.

4. COPPA — Children Under 13

LabFlow is intended for use in K-12 educational settings under the oversight of schools. If your institution enrolls students under the age of 13, the school provides consent on behalf of parents pursuant to COPPA's school consent exception. We do not collect personal information from children under 13 beyond what is necessary to provide educational services. Parents may request access to or deletion of their child's data by contacting the school administrator.

5. Third-Party AI Processing

When students use the AI Help feature, their lab context and questions are processed by Anthropic's Claude API. We do not send personally identifiable information (name, email) to Anthropic — only the lab step content and the student's question. Schools should review Anthropic's privacy policy and execute a Data Processing Agreement before enabling this feature. The AI Help feature can be disabled per organization by a school administrator.

6. Data Retention & Deletion

Student data is retained for the duration of the school's subscription. School administrators may request deletion of individual student records at any time through the Admin Panel. Upon school request or contract termination, all student data is deleted within 30 days.

7. Security

We implement industry-standard security measures including row-level security, role-based access controls, encrypted data transmission (TLS), and audit logging of access to student records. We store data using Supabase (PostgreSQL) hosted in secure data centers.

8. SOPIPA Compliance

We do not sell student information, use it for targeted advertising, or build profiles for non-educational purposes. Student data is used solely to provide the LabFlow educational service.

9. Contact

For privacy questions, FERPA requests, or data deletion requests, contact your school administrator or reach us at: [INSERT CONTACT EMAIL]