Legal Document

Privacy Notice

Effective April 8, 2026  ·  aesopacademy.org

📋 Special notice for parents and guardians AESOP AI Academy is used by learners of all ages, including children under 13. We take our COPPA obligations seriously. This notice explains exactly what we collect from your child, how it is used, and how you can access or delete it. Jump to the children's privacy section →

Contents

  1. Who We Are
  2. What Information We Collect
  3. How We Use Your Information
  4. Special Protections for Children Under 13 (COPPA)
  5. Third-Party Services
  6. How Long We Keep Your Data
  7. How We Protect Your Data
  8. Your Rights
  9. Contact Us

1. Who We Are

AESOP AI Academy is an AI literacy curriculum operated at aesopacademy.org. The platform provides structured courses teaching learners of all ages how artificial intelligence works, how to use it responsibly, and how to think critically about its impact on society.

For questions about this notice, contact us at scott@aesopacademy.org.

2. What Information We Collect

Data TypeExamplesPurposeRequired?
Account informationDisplay name, email address, date of birth (age range only)Create and manage your accountYes
Course progressCompleted lessons, quiz scores, current moduleRemember where you left off; unlock next lessonsYes
Usage dataPages visited, time spent, device typeImprove curriculum quality; identify broken pagesAutomatic
For under-13 learnersParent/guardian name and emailSend and record COPPA parental consentRequired by law

We do not collect: social security numbers, payment information, photos, precise location, or any sensitive health information.

3. How We Use Your Information

We never use your information for advertising, never sell it to third parties, and never use it to build advertising profiles.

4. Special Protections for Children Under 13 (COPPA)

The Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §6501) requires us to obtain verifiable parental consent before collecting personal information from children under 13. Here is exactly how we handle that:

Age gate Every new user enters their date of birth during sign-up. Users under 13 are routed to our parental consent flow before any account is created. We do not collect information from under-13 users before consent is received.
Parental consent process We send a verifiable parental consent (VPC) email to the parent or guardian email address provided. The email contains a unique, time-limited link. Clicking the link constitutes verifiable parental consent. We record the consent with a timestamp and the parent's email. Module access beyond Module 0 is blocked until consent is confirmed.

What we collect from children under 13:

What we do NOT collect from children under 13:

Parental rights (COPPA §312.6): At any time, parents and guardians may:

To exercise these rights, visit our Parent Portal or email scott@aesopacademy.org.

5. Third-Party Services

We use the following third-party services. We do not share personal data with any advertising networks.

ServicePurposeData SharedCOPPA Status
Firebase (Google) User authentication, course progress storage, usage analytics Email, display name, usage events Firebase Analytics runs in child-directed mode (no advertising IDs collected). Google is a COPPA Safe Harbor participant.
fal.ai AI-generated video content in select lessons Text prompts only (no personal information) Prompts are sanitized before transmission. No user PII is sent.
Mocahost Web hosting and email delivery Server logs (standard) Standard web hosting; no special data access.

6. How Long We Keep Your Data

Data TypeRetention Period
Account data (name, email, progress)While account is active, plus 90 days after deletion request
Analytics data (Firebase)14 months (Firebase default, reduced to 2 months on next configuration update)
Parental consent records3 years from date of consent (FTC guidance requirement)
Server access logs30 days (Mocahost standard)

When an account is deleted, all associated personal data and course progress is permanently deleted within 90 days. Parental consent records are retained for 3 years as required by FTC guidance, but all personally identifiable information beyond the consent timestamp is removed.

7. How We Protect Your Data

Security measures in place: All data is transmitted over HTTPS (TLS encryption). Passwords are managed by Firebase Authentication (industry-standard hashing). Parental consent tokens are single-use, time-limited (72 hours), and stored server-side. We do not store plaintext passwords.

No method of data transmission or storage is 100% secure. If you believe your account has been compromised, contact us immediately at scott@aesopacademy.org.

8. Your Rights

You have the right to: Access a copy of your personal data · Correct inaccurate information · Request deletion of your account and data · Withdraw consent (for under-13 learners, parents may do this) · Receive a copy of your data in a portable format

To exercise any of these rights, email scott@aesopacademy.org or visit the Parent Portal. We will respond within 30 days.

We do not discriminate against users who exercise their privacy rights.

9. Contact Us

Privacy Questions & Requests

For any questions about this Privacy Notice, to exercise your rights, or to submit a parental access or deletion request:

Email: scott@aesopacademy.org

Parent Portal: aesopacademy.org/parent-portal.html

We will respond to all privacy requests within 30 days. For urgent requests involving children's data, we aim to respond within 5 business days.