Student Privacy Notice (U.S.)

CLAN Platform ("CLAN") is an education platform for students, parents/guardians, teachers, mentors and staff. This notice explains how we handle student education records and personal information in line with the U.S. Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Act (COPPA), and complements our Colombian data protection policy (Ley 1581 de 2012).

• Identity and contact: name, username, email, phone/WhatsApp number, date of birth, grade level, guardian contact details.
• Education records: enrollment, attendance, grades, submissions, teacher feedback, learning plans, behavior and commitment records.
• Health and wellness notes voluntarily reported by families (used only to protect student safety).
• Photos, video and audio of student activities, only with guardian authorization.
• Basic technical data needed to keep accounts secure (login sessions, rate limiting).

We do not knowingly collect personal information from a child under 13 without verifiable consent from a parent or legal guardian. Accounts for younger students are created by the school, not by the child, and the guardian consents at enrollment. A parent may at any time review, correct or request deletion of their child's information and withdraw consent by contacting us (section 9). We do not sell children's data or use it for advertising.

• Parents (and students who are 18 or older) may inspect and review education records.
• They may request correction of records they believe are inaccurate or misleading.
• We disclose education records only with consent, or to school officials with a legitimate educational interest, or as otherwise permitted by law.
• They may file a complaint with the U.S. Department of Education's Student Privacy Policy Office.

We use third-party providers only to run the platform, under the school's direction and control:

• Database, authentication and file storage (Supabase, Cloudflare R2), hosting (Vercel), video delivery (Mux), messaging (WhatsApp).
• AI services (via OpenRouter and model providers). Course-content generation does not include student personal data. Guided tutoring processes only the text a student writes. Progress summaries for families may include the student's name, grades and mentor comments. Health data and medical details are never sent to AI providers.

Providers may not use student data to train their models or for their own purposes.

Access is limited by role (students, guardians, mentors, leaders, administrators) and enforced at the database level. Staff can use two-step verification. Changes to grades are recorded in an internal audit history showing who changed what and when. No system is perfectly secure; if a breach affecting personal information occurs we will notify affected families and authorities as required by law.

Academic records (transcripts, final grades, credits) are kept for as long as required by applicable education regulations. Other personal data is kept while the student is enrolled and deleted or anonymized on request once no longer required by law or school policy.

Data may be processed in the United States and other countries by the providers listed above. By using the platform, guardians and adult users consent to this processing for the purposes described here.

To review, correct or delete information, withdraw consent, or ask questions, contact the school's support team through the official support email or main WhatsApp line. We respond to verified requests within 45 days.