Privacy Policy

Last updated: October 11, 2026 · Beta version · doc v2026-10-11

This policy explains how LearnersVoyage collects, uses, shares, retains, and deletes information, including data we receive from Google when you sign in with Google or connect Google Calendar, and from Microsoft when you sign in with a Microsoft account.

Who we are

LearnersVoyage is operated by the LearnersVoyage team and is reachable at admin@learnersvoyage.com. For the records your practice enters about students and families, your practice is the data controller and LearnersVoyage is the processor — we handle that data only to provide the service, under the instructions in your account settings and our Data Processing Agreement. For your own account and signup details, LearnersVoyage is the controller.

What we collect

LearnersVoyage stores the information practitioners enter to run their practice: student and family records, session schedules and notes, skill and assessment data, billing details, recorded consent acknowledgments, in-app messages between your practice and families, referral and booking-request details, trial signup details, and account credentials. When families use the parent portal, we store their sign-in and payment information (payment card details are processed by Stripe — we never see full card numbers). When a practice connects its own Stripe account to accept family card payments, the business-verification details Stripe requires (legal name, date of birth, tax ID, bank account) are collected by Stripe through its hosted onboarding — that information goes to Stripe and is not stored by LearnersVoyage.

When a practice enables public booking requests, the booking page collects only what the request needs: the student's name and grade, the guardian's name and contact details, and an optional free-text note. Booking pages are for parents and legal guardians — children never have accounts on LearnersVoyage.

How we use it

• To operate the practice-management features you signed up for.
• To send session invites, reminders, invoices, and receipts on your behalf.
• To generate the reports and AI-assisted insights shown inside your account.
• To respond to support requests.

We do not sell student, family, or practitioner data to anyone, and we do not use it for advertising.

Who can see it

Each practice's data is isolated in its own tenant. Within a practice, access follows the roles you set (practitioner, administrator, parent). LearnersVoyage staff access customer data only to provide support you request, to keep the service secure, or to operate the service, under access controls.

Who we share it with

We share data only with the service providers that help us run LearnersVoyage, and only as needed for them to perform that work for us:

• Render — cloud hosting and managed database. Your practice data is stored on Render's infrastructure on our behalf.
• Stripe — payment processing for platform billing (subscriptions and add-ons) and for family card payments. Family card payments are charged on the practice's own connected Stripe account — for those, Stripe processes under its agreement with the practice, which is the merchant of record.
• Google (Gmail) — our transactional email provider, used to send the invites, reminders, invoices, and receipts you trigger.
• AWS Bedrock (Amazon, Anthropic, NVIDIA, or OpenAI models) — generates the optional AI-assisted insights inside your account. Requests are sent only to produce a result for you. AWS Bedrock does not use customer request content to train or improve models under its service terms, and does not store request content. Google user data is never sent to an AI provider (see below).
• Microsoft — sign-in identity verification for practitioners who choose "Sign in with Microsoft" (name, email, and basic profile only).
• File storage — session-note attachments are stored on Render's infrastructure. An S3-compatible object store may be enabled for some accounts in future; if it is, the provider will be named here.
• GitHub — hosts our source code and deployment configuration only. No customer or student data is stored there.

We may also disclose data when required by law or valid legal process, or to protect the security of the service and its users. If LearnersVoyage is involved in a merger, acquisition, or sale of assets, we will notify you before your data is transferred, and Google user data will be transferred only with your explicit prior consent.

How we protect it

Data is encrypted in transit and at rest. Payment processing is handled by Stripe. We apply access controls and audit logging inside the application.

AI-assisted insights

AI features are off by default and must be enabled per practice in Settings. LearnersVoyage offers optional AI-assisted features (session-note summaries, progress flags, coaching suggestions) powered by Amazon, Anthropic, NVIDIA, or OpenAI models through AWS Bedrock — the only AI provider for this deployment. Requests contain only the information the feature needs. Student, parent, and referral-source names are replaced with pseudonymous tokens before requests leave our servers, dates of birth are never sent (only age in months is used), and free-text fields are scrubbed against the same token map as a catch-all. That scrub is based on the names we know about: other identifying details typed into notes — such as schools, teachers, doctors, or third parties you mention — may still be included in a request. AI output is a suggestion for the practitioner's professional judgment, not a decision, diagnosis, or assessment result, and never changes records or plans on its own. Under AWS Bedrock service terms, request content is not used to train or improve provider models and is not retained by the provider; we record only usage metadata (token counts, cost, status) — never the content of the request. Outputs are also post-checked against the student's actual assessment data before they are stored, so suggestions can't cite instruments the student never took. Google user data is never sent to an AI provider.

Sign-in providers

You can sign in with a LearnersVoyage password, with Google, or with Microsoft.

• Google sign-in requests the openid, email, and profile scopes and stores your name, email, and profile photo. Details are in the Google user data section below.
• Microsoft sign-in requests the openid, profile, email, and User.Read scopes to verify your identity. We store your name and email address in your account record; sign-in tokens are used only during login and are not retained. Microsoft sign-in does not grant us access to your Microsoft calendar, files, or other data unless a separate calendar-connect flow is offered and you complete it.

Document OCR

When you import a scanned document or image (for example, uploading a report to a session note), text extraction runs with Tesseract OCR on our own servers — the document is processed in place on LearnersVoyage infrastructure and is not sent to any third-party OCR or AI service.

Data retention and deletion

• We keep practice data for as long as your account is active, because you need it to run your practice.
• You can export your data yourself anytime in Settings → Data & Privacy, or ask us to delete it by emailing admin@learnersvoyage.com.
• When you cancel, you choose what happens to your practice data in Settings: immediate deletion, which we complete automatically within 48 hours; retention for a defined period you select (3, 6, or 12 months); or the default — full deletion three months after cancellation. We send reminder notices before a retention window ends, then permanently delete the practice's operational data and record a deletion certificate in the operator audit log.
• Payment, invoice, and billing records are retained under legal-hold obligations (tax and accounting law) for the period the law requires, then deleted.
• Deleted data may remain in encrypted database backups for up to 30 additional days until those backups expire and are overwritten.

Google user data

What we access

When you sign in with Google, we request the openid, email, and profile scopes to identify your account, and we store your name, email address, and profile photo so we can show them in your account. Sign-in tokens are used only to fetch this profile during login and are not retained.

Connecting Google Calendar is optional and separate from sign-in. If you choose to connect it, the calendar-connect flow requests the https://www.googleapis.com/auth/calendar.events scope and no other Google scopes.

How we use it

We use Google Calendar access only to:

• Create, update, and delete tutoring-session events on your primary calendar. Event titles show student initials by default — the practice can choose full names or a generic title with no student detail at all in Settings — and a link back to the session in LearnersVoyage; session notes are never written to your calendar. If your practice enables it, session events may include a Google Meet link, which Google generates as part of the event; that Meet link can also be included in the invite sent to the family when the practice turns that option on.
• Read your existing events so the scheduling view can show when you're busy. Your event details are shown only to you — other practitioners in your practice see a generic busy indicator, never the title or details of your events.

We do not use Google user data for advertising, sell it, use it to determine credit-worthiness, or use it for any purpose other than providing these user-facing sign-in and scheduling features.

How we store and protect it

We store only what is needed to keep the connection working and to keep your sessions in sync:

• Google OAuth tokens, encrypted at rest.
• Event identifiers for the session events LearnersVoyage creates on your calendar, stored with the matching session record so we can update or remove that event later.

We do not store copies of your other calendar events. They are fetched from Google when you open the scheduling view and used only to display your availability.

Sharing, transfer, and disclosure of Google user data

We do not share, transfer, or disclose Google user data to third parties, except:

• Render, our hosting and database provider, which stores the encrypted tokens and event identifiers described above on our behalf and has no right to use them for any other purpose.
• Google itself, when we send session events to your calendar through the Google Calendar API at your direction.
• When required to comply with applicable law or valid legal process, or when necessary to protect the security of the service.
• As part of a merger, acquisition, or sale of assets, and only with your explicit prior consent.

We never share Google user data with advertisers, data brokers, information resellers, or AI model providers. LearnersVoyage staff do not view your Google Calendar data unless you ask us to for a specific support request, it is needed for security purposes such as investigating abuse, or it is required by law.

AI and machine learning

LearnersVoyage does not use Google user data, including data obtained through Google Workspace APIs, to develop, improve, or train generalized or non-personalized AI or machine-learning models. Google Calendar data is not used by our AI-assisted insights features and is never sent to an AI model provider.

Retention and deletion of Google user data

• OAuth tokens are kept only while your Google Calendar connection is active. When you disconnect Google Calendar in Settings, we revoke the token with Google and immediately delete the tokens stored on our side. If you revoke access from your Google Account instead, we delete the stored tokens the next time we detect the revoked access, such as when Google's token endpoint reports the grant as invalid.
• Event identifiers are kept with the session records they belong to and are deleted when those sessions are deleted, or when your practice data is deleted under the retention terms above.
• Other calendar events read for the availability view are not stored, so there is nothing to retain.
• Sign-in identity data (name, email, profile photo) is kept as part of your account record and deleted when your account or practice data is deleted under the retention terms above.
• Account closure: if you close your account, we revoke and delete your Google tokens and delete event identifiers with the rest of your practice data under your selected retention schedule (an express purge within 48 hours, a defined period you choose, or the 3-month default). Deleted data may remain in encrypted backups for up to 30 additional days until those backups expire.
• Events LearnersVoyage created on your Google Calendar belong to you and stay on your calendar after you disconnect; you can remove them in Google Calendar at any time.

You can revoke LearnersVoyage's access at any time at myaccount.google.com/permissions. To request deletion of any Google user data we hold, email admin@learnersvoyage.com; we complete these requests within 48 hours.

Limited Use

LearnersVoyage's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Children's data and families

Practitioners record information about the students they teach, many of whom are children. We collect no data directly from children: the parent portal is operated for the student's parent or guardian, and the practice — not LearnersVoyage — determines what student information it records. Parents and guardians who want to see, correct, export, or delete information about their child should contact their practice directly; the practice controls the record. Practices may also share this policy with families, and we will assist any practice in responding to a family's request within the retention terms above.

Cookies and similar technology

We use a single session cookie to keep you signed in — it is required for the service to work and is not used for tracking or advertising. We do not use analytics or advertising cookies or third-party trackers. Fonts load from Google Fonts in the app and on the marketing site, which receives your IP address when a page loads, as any web request does. On signup and payment pages, Stripe's payment library sets its own cookies and collects device and activity signals to prevent fraud, as described in Stripe's privacy and cookie policies — we don't use those signals for analytics or advertising.

If something goes wrong

If we confirm a breach of the systems we operate that exposes your practice's data, we will notify the affected practice without undue delay — and in any event within 72 hours — with what we know about what was affected and what we're doing about it.

Your choices

Practices export their own data anytime from Settings → Data & Privacy (all of your records — attachment files are listed by name and details rather than copied as files — no request needed), request account closure, and set their post-cancellation retention choice in the same place. Parents can manage their own portal sign-in and payment methods. Practitioners can connect or disconnect Google Calendar at any time in Settings. For anything else, contact us.

Changes during beta

This policy may be refined as the product moves toward launch. Material changes, including any change to how we use Google user data, will be communicated to beta participants before they take effect.

Contact

Questions about privacy or data deletion: admin@learnersvoyage.com.