Privacy & Student Data Protection

What changed on October 13, 2026

We checked this statement against how the site works today. You do not need to do anything or agree to it again. Since the September 23, 2026 version:

• Subscriber drafting and lesson recording closed (October 13). The paid workspace that drafted resources with AI and recorded lessons has closed. It no longer sends anything to OpenRouter or any other model provider, and its sign-up, pricing and onboarding pages now lead to other pages. Records an account already holds stay under the retention rules below and are deleted or exported on request to our Privacy Officer (admin@milestoneteachers.ca), who will delete it or send you a copy.
• Ask the Atlas (added October 12). When the homepage search is unsure, the question you typed goes to our server and to a language model through OpenRouter. See Ask the Atlas below.
• Service providers are named. A new section, Service providers and what they receive, lists each company that processes data for us, what it receives and how long it is kept.
• Your choices. A new section explains how to unsubscribe from email, avoid the Ask the Atlas language-model step, opt out of analytics and reach our Privacy Officer.
• Report Card Studio and the Ontario Report Season Kit. The free Studio now suggests the Kit. The suggestion is fixed text. If you follow it, we record only which Studio place and page you were on, never a name, a rating or a comment.
• Purchase receipts. A resource receipt can now include one “Next for your class” suggestion, chosen from what you bought. It is not built from a profile and nothing about you is sent to anyone else. The email says how to stop suggestions and marketing email, and you still receive receipts and download links. If your address is on our unsubscribed list, the suggestion is left out.

Milestone Pass purchases

Stripe processes card and payment details. For delivery and support, Milestone Teachers stores the buyer email, Stripe transaction identifiers, offer, amount, payment status, accepted terms version and file-delivery record. We do not ask for student information to purchase a pass. Unpaid pending checkout rows are deleted after 30 days. Completed transaction records are kept for seven years after the latest payment, refund or dispute activity, unless a longer legal hold applies.

Privacy at a Glance

• Data minimization: no student emails required, no student accounts required for our teacher tools, and class-level prompts by default.
• Teacher review: student-facing drafts, report-card comments and IEP-style supports stay teacher-reviewed before sharing.
• Lesson Capture: lesson recording has closed. For any captures an account already holds, raw audio was not kept after transcription; stored transcripts and analysis are deleted or exported on request to our Privacy Officer (admin@milestoneteachers.ca), who will delete it or send you a copy.
• No sale or targeted advertising: student/class data is not sold, shared for ads, or used to build advertising profiles.
• Class-level memory: optional profile memory stores teacher-approved preferences and class-level signals, not private student records.

Regulations We Design For

Privacy laws vary by country, province, state, school board, and district contract. The list below is the practical compliance map we use for Milestone Teachers. It is not a substitute for your board or district legal review, but it gives reviewers the operating commitments we follow.

• PIPEDA Accountability, limited purposes, consent-aware collection, access/correction/deletion paths, safeguards, retention limits, breach response, and openness.
• Ontario MFIPPA + Education Act Our teacher tools are designed to keep school-board records class-level unless a school-approved workflow requires more. We avoid OSR-style records, medical details, and private IEP files in normal prompts.
• Quebec Law 25, Alberta PIPA, BC PIPA We use purpose limitation, clear notices, access/deletion support, service-provider controls, and no sale/share for advertising.
• FERPA + PPRA When used by a school, student education-record data is used only to provide the school-requested service. Sensitive survey-style data is not requested by our teacher tools.
• COPPA Milestone Teachers is teacher/school-facing, not a child-directed social app. Where school consent is relied on, data is used only for educational purposes, never behavioral ads.
• CCPA/CPRA and other U.S. state consumer privacy laws We provide notice, access, correction, deletion, opt-out posture for sale/share, and non-discrimination for privacy requests where those rights apply.
• GDPR and UK GDPR We support transparency, data minimization, purpose limitation, processor/subprocessor disclosure, access/correction/deletion, and regional routing review before EU/UK school deployment.

What We Collect

Teacher and account data

Name or email used for login, subscription/billing records, support messages, saved settings, optional teacher profile preferences, and usage/security logs.

Class-level teaching data

Grade band, subject, curriculum region, class-level readiness notes, timetable blocks, resource prompts, lesson transcripts, and teacher-reviewed analysis.

Limited student data when a teacher chooses it

Some legacy classroom tools may use first-name initials or private aliases, class codes, progress, or teacher-entered roster data. We ask teachers to avoid names and private records unless their school has approved that workflow.

Technical data

Device/browser data, IP-derived region, authentication/session logs, CSRF/security events, payment status, and aggregate product analytics.

• Do not enter private student records into open prompts. That includes full names, addresses, medical details, diagnoses, report-card marks, private IEP files, OSR records, family contact details, or discipline records unless your school has approved the use and you have a lawful basis.

AI, OpenRouter, and Model Routing

AI drafting of resources, lesson insights and planning notes for subscribers ended on October 13, 2026. Where the site still uses AI, such as the Ask the Atlas fallback, our backend routes the request through OpenRouter so we can choose an appropriate model for the task.

• We do not intentionally enable OpenRouter input/output logging or OpenRouter use of inputs/outputs for improving OpenRouter with student or class data.
• OpenRouter and model providers may still process request metadata and may have their own retention rules. We review provider policies and can tighten routing for school or enterprise contracts.
• Prompts and outputs are not used to train advertising profiles, sold to data brokers, or used for targeted advertising.

Ask the Atlas (the homepage search)

The “What are you teaching next?” box on the homepage suggests a route through our own site: a free starting point, a teaching resource, a 1080 Learner check (in development) and Report Card Studio comments. It does not need an account.

• Most questions never leave your browser. The page reads your question with a fixed word list and builds the route from our catalogue on your device. To do that it also uses the date, your device’s time zone (to suggest a province or state), the page you came from on our site, campaign tags in the link, and, if you used the free Report Card Studio in this browser, only the place and grade it saved. Those values are not sent anywhere. The usage event described under Analytics records only which kinds of context shaped the route (for example, “time zone” or “season”), never the values themselves.
• When the page is unsure, your question goes to our server. If the page cannot read a question confidently, it sends the question text (up to 200 characters) to our own server at /api/atlas/intent. Our server lowercases it, strips accents and most punctuation, and asks a language model through OpenRouter to sort it into our fixed list of grades, subjects, skills, needs and places. Only those labels come back, and the page builds the route from our catalogue as before. This never happens on Report Card Studio pages, and our server refuses requests from them.
• What we keep. We do not write your question to our logs or to disk. To avoid asking twice, our server keeps recent questions and their labels in memory (at most 500, cleared whenever the server restarts). Our logs record only the outcome, how long it took and the labels. To limit how often one connection can ask, our server counts requests per IP address in memory; for this feature the address is not written to logs or to disk. Each server instance keeps a daily count of these requests and their monthly cost, without any question text.
• The model provider. The request to OpenRouter uses the same privacy controls as the rest of the site, including data_collection: "deny". OpenRouter and the model provider process the text to answer and may have their own retention rules, as described above.
• Analytics. Ask the Atlas sends first-party usage events (for example, that a route was shown, its grade range and subject, which kinds of context shaped it, and which step was clicked). These events never include the text you typed.
• No names or student data. The box is for what you teach, not who you teach. Please do not type student names or personal details. The model is told to ignore any names, but text in an unsure question is sent as typed (after the clean-up above).

Lesson Capture (Not Currently Offered) and Memory

• Lesson Capture, a lesson-recording feature, is not currently offered as a public tool. The rules below cover any captures an account already holds.
• Raw audio is not kept after the transcription request; provider retention depends on the routing configuration. Unreviewed captures are scheduled for deletion after 24 hours by default; a configured or written school policy may set another deadline. Reviewed captures remain until they are deleted on request to our Privacy Officer (admin@milestoneteachers.ca), who will delete it or send you a copy, or until a written school-pilot retention schedule requires earlier deletion.
• Profile memory is no longer offered. Where an account already holds it, it contains class-level preferences such as curriculum region, timetable blocks, language supports, and planning style.

No Sale, Ads, or Non-Educational Profiles

No sale or targeted advertising means we do not sell student data, share student data for cross-context behavioral advertising, target ads to students or families based on classroom data, or create non-educational student profiles. Product analytics are used to operate, secure, and improve Milestone Teachers.

Storage, Transfers, and Subprocessors

Data may be processed in Canada, the United States, or other locations used by hosting, database, authentication, payment, email, analytics, AI, and support vendors. Cross-border processing is protected through contractual, technical, and organizational safeguards. School or district deployments can require a data processing agreement, approved subprocessors, retention schedule, breach notice window, and regional routing review.

Service providers and what they receive

These companies process data for us. They process it to provide their service to us, and we do not sell personal information to them or to anyone else. Each one may process data in the United States or elsewhere outside Canada, as described under Storage, Transfers, and Subprocessors.

• OpenRouter and the model providers behind it. Used for the Ask the Atlas fallback; no other visitor- or teacher-facing feature sends data to it. It receives the cleaned question text (up to 200 characters) and our fixed instructions, and nothing else: no name, email address, account or IP address. We keep no copy of the question on disk (see Ask the Atlas). Our request uses data_collection: "deny"; OpenRouter and the model provider may still apply their own retention rules.
• Stripe. Used for card payments. You type your card and billing details on Stripe’s own checkout page, so they never reach our servers. Stripe also receives your email address, the items and the amount. We keep the buyer email, Stripe identifiers, items, amount, payment status and the file-delivery record. For Milestone Pass purchases, unpaid pending checkouts are deleted after 30 days and completed records are kept for seven years after the latest payment, refund or dispute (see Milestone Pass purchases); other purchase records are kept while needed to deliver files, give support and meet accounting obligations. Stripe keeps its own records under its own privacy policy.
• Google (email and sign-in). Used to send our email from admin@milestoneteachers.ca (purchase receipts and download links, billing notices and resource emails you signed up for) and for Google sign-in. It receives the recipient address and the message, as any email provider does, and sent messages stay in that mailbox like any sent email. Google sign-in gives us your email address and, usually, your name, never your Google password.
• Google Analytics. Used to count visits. It receives the page address, the page you came from, device and browser details and an approximate region, with IP anonymization turned on. It is not loaded on admin pages, the teaching planner, Report Card Studio place pages, the purchase thank-you pages, or any page whose address carries anything other than a plain campaign tag. Google holds it under its own policies.
• Replit. Hosts the site and the Postgres database where accounts, purchase records, the email list and consent records are stored, along with ordinary server logs. Records are removed from the live database when we delete them; backups age out on their normal cycle.

Access, Correction, Portability, and Deletion

Teachers can request access, correction, export, or deletion of account/profile data. Parents, guardians, students, schools, or districts may request access or deletion through the school or directly through our Privacy Officer where applicable. We aim to respond to privacy requests within 30 days unless a law, school contract, identity-verification step, or security need requires a different process.

Retention and Deletion

• Teacher account and billing records are retained while needed to provide the service and meet legal/business obligations.
• Profile memory an account already holds is deleted or exported on request to our Privacy Officer (admin@milestoneteachers.ca), who will delete it or send you a copy.
• Classroom/roster data is retained while the class or school workflow is active and can be deleted according to teacher, school, or contract controls.
• Limited exceptions are handled separately: backups and security records may persist for their normal deletion cycles, and billing, contract, or legally required records may be retained for their applicable periods.

Your choices: opt out, access and contact

Write to the Privacy Officer at admin@milestoneteachers.ca for any of the following. We aim to answer within 30 days.

• Email (CASL). Receipts and download links for something you buy are sent when you buy; they are not marketing. Resource emails from our sign-up form are sent only if you ticked the consent box. We keep the exact wording you agreed to, the time and a one-way hash of your IP address as proof of consent. Resource emails and receipts that carry a suggestion name us (Milestone Teachers, 100 Harrison Garden Blvd, Toronto, ON M2N 3T1, Canada) and say how to opt out. Use the unsubscribe link, reply “unsubscribe”, or write to admin@milestoneteachers.ca; we act on it within 10 business days, as the law requires. After you unsubscribe we keep your address on a do-not-email list so we do not email you again. You will still receive receipts for purchases you make.
• Ask the Atlas. There is no setting to switch the language-model step off for one visitor. You can avoid it by using the site’s menus and search instead of the homepage box. A question the page can read confidently never leaves your browser, and Report Card Studio pages never send one.
• Analytics. The site works without Google Analytics. You can block it with your browser’s tracking protection, a content blocker or Google’s analytics opt-out browser add-on.
• Access, correction and deletion. Ask to see, correct or delete the personal information we hold about you, including purchase records and your place on the email list. Required accounting records may have to be kept, and we will tell you which.
• Complaints. If you are in Canada and not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner (see Contact Our Privacy Officer).

Security and Breach Response

We use HTTPS/TLS, authentication controls, CSRF protections, access boundaries, audit-friendly logs, server-side privacy checks, and role-aware routes. If a breach creates a real risk of significant harm or triggers a school/district notice obligation, we will notify affected customers and regulators as required by applicable law and contracts.

Contact Our Privacy Officer

For privacy questions, data access requests, deletion requests, school procurement reviews, DPA requests, subprocessor questions, or AI routing questions, contact us:

If you are in Canada and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or the relevant provincial privacy commissioner. U.S. schools should also use their district privacy/procurement channel for FERPA, PPRA, COPPA, and state student privacy review.

• Location: Ontario, Canada