Privacy Policy

CustomAILab Learning Systems Inc. (“CustomAILab,” “we,” “us”) respects your privacy and is committed to protecting personal information in accordance with Canadian privacy laws, including PIPEDA and applicable provincial requirements.

What We Collect

We collect only the information necessary to provide AI-supported tutoring services, including:

• Student first name only (no last name collected for Minor accounts)

• Parent or guardian name and email address, for Minor accounts

• Grade level, enrolled courses, and learning preferences

• All interactions with Cal, including queries and responses, complete conversation logs, session times, and token usage

• Documents uploaded to your child's Personal Knowledge Base, including associated metadata

• Progress evaluation data, including Cognitive Development Index (CDI) scores generated by The Dean

• Safety data, including queries flagged by our moderation system and records of parent notifications

• Basic technical data (device type, IP address, session logs)

We do not collect student last names, email addresses for Minor accounts, health records, or government ID numbers. Payment information is collected and stored by Stripe, not by CustomAILab.

How We Use Information

Personal information is used to:

• Deliver and personalize tutoring support

• Align instruction with Ontario and out-of-province curricula

• Monitor learning progress and improve our services

• Communicate with parents/guardians as needed

• Meet legal and regulatory obligations

Student data is not sold, rented, or used for advertising.

AI and Data Use

Student interactions are used only within CustomAILab’s secure system to support learning. Student data is not used to train public or third-party AI models.

The Dean and Progress Reporting

• CustomAILab includes a component called The Dean, which periodically reviews your child's conversation logs with Cal. The Dean is an AI auditing tool that generates progress reports for parents, including a Cognitive Development Index (CDI) score. The CDI assesses the quality of your child's engagement — for example, whether they are asking follow-up questions, demonstrating reasoning, and building on prior knowledge — rather than simply measuring correct answers.

• Progress reports are delivered to the parent or guardian email address on file, on a schedule determined by your subscription tier. The Dean does not interact with students directly.

Data Storage & Canadian Sovereignty

• All student data is stored exclusively on servers in Montreal, Canada, using Google Cloud infrastructure and Supabase database services. Stored data never leaves Canada.

• Our infrastructure is designed to comply with Quebec's Law 25 (An Act to modernize legislative provisions as regards the protection of personal information), Ontario's Bill 194 (Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024), and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

• Some processing takes place outside Canada:

• Tutoring: Cal’s responses are generated by Google’s Gemini models on Google’s global endpoint, because the model capabilities Cal requires are not yet available in Montreal. We will move this processing to Montreal when they are.

• Progress reports and quality review: The Dean’s reports and our reviews of tutoring sessions are generated by Anthropic’s Claude models, with Claude on Google’s global endpoint as a backup.

• Safety screening: every student query is screened by OpenAI’s moderation service before reaching Cal.

• Research: when Cal looks something up, a short search query generated from the student’s question, without account details, is sent to the Tavily search service.

• None of this data is used to train AI models, and each provider processes it under its own commercial or data processing terms.

Who We Share Information With

We do not sell, rent, or share student data for marketing or advertising purposes. We share data only with the following categories of parties:

Service providers required to operate the platform:

• Google (Gemini AI models for tutoring; Montreal cloud infrastructure)

• Supabase (database services, Montreal)

• Stripe (payment processing — subject to Stripe's own privacy policy; Stripe does not receive student interaction data)

• OpenAI (safety moderation screening only — query content, not student identity)

• Anthropic (progress reports and quality review — conversation logs and learning profile)

• Tavily (research searches — search queries only, not student identity)

Parents and guardians: Progress reports generated by The Dean, safety notifications, and account information are shared with the parent or guardian on file. Parents may also request access to their child's full conversation logs.

Legal requirements: We may disclose information where required by law, court order, or to protect the rights and safety of our users.

Educational institutions: With appropriate authorization in cases involving academic integrity investigations.

Children and Consent

• CustomAILab serves students in Grades 7–12. For any student under the age of 18, a parent or legal guardian must provide explicit written consent before the student account is activated. This consent is collected via our Parental Consent Form, which describes in plain language what data is collected, how it is used, and what rights parents hold.

  • Student accounts remain inactive until parental consent is on file. Parents may withdraw consent at any time by contacting the privacy officer, which will result in suspension of the student account.

  • When a student query is flagged by our content moderation system, an automated email notification is sent directly to the parent or guardian on record. This notification includes the text of the flagged message so that families can address concerns privately. These notifications are not forwarded to CustomAILab staff.

Data Retention

• While a subscription is active, we retain all account and interaction data. After cancellation or account closure, data is held for one year and then permanently deleted, unless you request earlier deletion or export. Financial records are retained for seven years as required by Canadian tax law. Aggregated, anonymized data (not traceable to any individual student) may be retained indefinitely for service improvement purposes.

• To request deletion or export of your child's data before the standard retention period, email the privacy officer with the subject line "Data Deletion Request" or "Data Export Request." We will respond within 30 days.

Security

• We use administrative, technical, and physical safeguards to protect personal information. No system is 100% secure, but we take reasonable steps to minimize risk.

Contact

For privacy questions or requests:

Privacy Officer
CustomAILab Learning Systems Inc.
📧 andy@customailab.ca
📍 Ontario, Canada