Privacy Policy
Effective Date: October 17, 2026
How we collect, protect, and use information across AIccommodate.
What changed on October 17, 2026
Two corrections and one improvement. Google Gemini also provides text-to-speech narration (the default read-aloud voice since September 30, 2026), now listed in Sections 5 and 6. Pictures attached in the Atticus assistant are now read on our server and only their de-identified text is sent to the AI provider unless you choose to send the picture itself (Section 5). The September 15, 2026 update added the Grammar Coach (Section 12), the family portal description (Section 7), the wording on how names are removed from typed text (Section 5), the school-consent basis for students under 13 (Section 12), and the access and disclosure log (Section 9).
1. Overview
AIccommodate LLC, a New York limited liability company ("AIccommodate," "we," "us," or "our"), operates an AI-powered educational accommodation platform designed for K-12 educators, available at www.aiccommodate.com (opens in a new tab). Our platform helps teachers transform educational content into accommodated materials for students with IEPs, 504 plans, and varying learning needs.
This Privacy Policy explains how we collect, use, protect, and share information when you use our platform. By accessing or using AIccommodate, you agree to the practices described in this policy. Please also review our Terms of Service, which govern your use of the platform.
2. Google User Data
Google API Services User Data Policy Compliance
AIccommodate's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.
Scopes We Request
When you choose to sign in with Google, we request access to the following OAuth 2.0 scopes:
email— Your email address, used to create and identify your accountprofile— Your display name and profile picture, used to personalize your accountopenid— Authentication verification (confirms your identity; no additional data is accessed)
What We Receive
From these scopes, Google provides us with your email address, display name, and profile picture URL. We do not request or receive any other Google data such as contacts, calendar events, Drive files, or browsing history.
How We Use Your Google Data
We use information received from Google APIs solely to:
- Create your AIccommodate account
- Authenticate your identity when you sign in
- Display your name and profile picture within the platform
We do not use your Google data for any other purpose.
How We Store Your Google Data
Your email address and display name are stored in our Supabase PostgreSQL database as part of your account profile, protected by encryption at rest and Row Level Security. Your profile picture URL is referenced for display but is not downloaded or stored separately on our servers.
Sharing & Transfer
We do not share, sell, transfer, or disclose your Google user data to any third party, except:
- Supabase (our database host), which stores your account profile as part of providing the service
- As required by law, regulation, or valid legal process
Prohibited Uses — We Do NOT:
- Sell Google user data to third parties, advertisers, data brokers, or information resellers
- Use Google user data for advertising, retargeting, or ad personalization
- Use Google user data for credit assessment, lending, or any form of financial evaluation
- Use Google user data for profiling unrelated to the educational services you have requested
- Transfer Google user data to any AI model training dataset
Retention & Deletion
Google-sourced account data (email, name, profile picture URL) is retained for as long as your account exists. Upon account deletion, all Google-sourced data is permanently deleted from our systems. You may delete your account at any time through your profile settings or by contacting hello@aiccommodate.com (opens in a new tab).
Revoking Access
You can revoke AIccommodate's access to your Google account data at any time:
- Go to your Google Account permissions page (opens in a new tab) (myaccount.google.com → Security → Third-party apps with account access)
- Find "AIccommodate" in the list of connected apps
- Click "Remove Access" to revoke all permissions
Revoking access will prevent future Google sign-ins but will not automatically delete your AIccommodate account or previously stored data. To delete your account and all associated data, use the account deletion feature in your profile settings or contact hello@aiccommodate.com (opens in a new tab).
3. Information We Collect
Account Information
When you create an account, we collect your email address, full name, password (hashed via bcrypt by Supabase Auth — we never store plaintext passwords), school name, and role. If you sign in using Google OAuth, Google provides your name, email address, and profile picture with your explicit consent. See Section 2 (Google User Data) for complete details on how Google-sourced data is handled, stored, and protected.
Student & Class Data
Teachers may enter the following student and class information into the platform:
- Student names and grade levels
- IEP and 504 plan status
- Primary diagnosis categories (e.g., ADHD, Autism, Dyslexia, Anxiety)
- Lexile reading levels
- Accommodation lists with effectiveness ratings
- Student interests (used for content theming)
- UDL (Universal Design for Learning) learner profiles
- Class names, subjects, and student rosters
- Parent access codes
Content Provided to AI Tools
When you use our AI tools, we process the educational materials you provide (lessons, worksheets, assignments) along with your configuration preferences (reading level targets, accommodation types, output formats). See Section 5 for details on how this content is handled.
Usage & Technical Data
We collect server logs and error reports via Sentry (with PII automatically stripped before transmission). We track general feature usage patterns to improve the platform. We do not use analytics cookies or third-party tracking services.
Payment Information
Payment processing is handled entirely by Stripe (opens in a new tab). We never see or store your full card number, expiration date, or CVV. We receive only your Stripe customer ID and subscription status (active, trial, canceled, or expired).
4. How We Use Information
We use the information we collect to:
- Provide and operate the platform services
- Process educational content through AI tools to generate accommodated materials
- Manage your account and subscription
- Improve platform functionality and user experience
- Communicate service-related notifications (not marketing)
- Ensure platform security and prevent abuse
Important:
- We do NOT sell personal information or student data to anyone.
- We do NOT use student data for advertising or marketing purposes.
- We do NOT create student profiles for non-educational purposes.
5. AI Data Processing
How Your Content Is Processed by AI
- What gets sent: Educational content you provide (lesson text, assignment content, configuration preferences such as target reading level and accommodation type), and on the student tools and the family portal, what the student or parent types (see Sections 7 and 12).
- PII protection: Student names are stripped from content before it is sent to AI providers. When a teacher is signed in, this uses the teacher's own class roster plus pattern-based name detection. On the student tools and the family portal, where no teacher is signed in, de-identification is pattern-based and best-effort, so students and parents should avoid typing full names or other identifying details. Diagnostic categories (e.g., "ADHD") are used for accommodation context and are treated as sensitive student data — encrypted at rest, access-restricted, and never sent to AI providers in a form linked to an identifiable student. All user-provided content is wrapped in safety tags (
<user_content>) with anti-injection instructions to prevent prompt manipulation. - Anthropic (primary AI): Anthropic does not train on data submitted through their API. See Anthropic's Privacy Policy (opens in a new tab) for details.
- Secondary AI providers: Google Gemini and OpenAI are used for specific features (image generation, video generation, text-to-speech narration, speech-to-text, alternative processing, and the Grammar Coach). They are not sent student records, and text you enter is automatically de-identified before transmission — student-identifying details are removed. Voice recordings are transmitted as you provide them, so do not include student personally identifiable information in audio. Images uploaded to the import tools are transmitted as provided; a picture attached in the Atticus assistant is read on our server and only its de-identified text is sent, unless you choose “Send picture” — which is refused when the picture appears to carry a student name or other identifying details.
6. Third-Party Services
We use the following third-party services to operate the platform. Each service is subject to its own privacy policy, and we encourage you to review them.
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Authentication & database hosting | Account information, student/class data, generated materials |
| Anthropic (Claude) | Primary AI content processing | Educational content (PII stripped before transmission). This includes what students type to the AI Tutor and what parents type to the family portal helper, which are de-identified on a best-effort basis before transmission (see Sections 5, 7, and 12). A picture attached in the Atticus assistant is read on our server and only its de-identified text is sent, unless you choose to send the picture itself. |
| Google Gemini / Veo | Image & video generation; text-to-speech narration (the default read-aloud voice since September 30, 2026) | Content descriptions and teacher-provided text to narrate only (no student data) |
| OpenAI | Speech-to-text, image generation, alternative AI processing & the Grammar Coach | Educational content as you provide it — no student records transmitted; typed text is automatically de-identified before transmission. For the Grammar Coach, the writing and questions a student types are sent to OpenAI to generate the coaching reply, de-identified on a best-effort basis, with request storage turned off (see Section 12). Voice recordings and uploaded images are transmitted as provided — do not include student PII in audio or images. |
| ElevenLabs | Text-to-speech audio generation | Teacher-provided content only (lesson text you choose to convert to audio) — student records are never sent to this service |
| Stripe | Payment processing | Payment details (handled entirely by Stripe) |
| Sentry | Error tracking & monitoring | Error logs with PII automatically stripped |
| Google OAuth | Sign-in authentication | Email, name, profile (with your explicit consent) |
| Railway | Application hosting | Server logs, application data in transit |
| Canvas LMS | LMS integration (optional, user-authorized) | Assignments, courses (only what you authorize) |
| Google Classroom | LMS integration (optional, user-authorized) | Courses, assignments (only what you authorize) |
| Google Drive | Document import/export (optional, user-authorized) | Files you explicitly select |
7. Student Data & FERPA
Our Commitment to Student Data Protection
Protecting student data is central to everything we do. We understand that educators entrust us with sensitive student information, and we take that responsibility seriously.
Data Isolation
All student and class data is strictly scoped to individual teacher accounts. This isolation is enforced at both the application layer (every data query requires the authenticated teacher's ID) and the database level, where PostgreSQL Row Level Security policies independently restrict each teacher's access to their own records. One teacher can never access another teacher's student data.
FERPA Compliance
AIccommodate operates under the school official exception to FERPA (the Family Educational Rights and Privacy Act), as described in 34 CFR § 99.31(a)(1). This permits schools and districts to designate service providers as "school officials" with a "legitimate educational interest" in accessing education records, provided the service is under the direct control of the school with respect to the use and maintenance of those records.
Our Student Data Commitments
- We will never sell student data.
- We will never use student data for advertising or marketing.
- We will never build non-educational profiles of students.
- Student names are stripped from content before AI processing (best-effort on text typed by students and parents; see Section 5).
- Student data is deleted upon teacher request.
- Access to student data is limited to the teacher who entered it.
Family Portal (Parents and Guardians)
Teachers can give a parent or guardian a 12-character family access code for one student. With that code, the parent can open the family portal without creating an account. The portal shows a plain-language view of that one child only: first name and grade, the supports the teacher has set up (described in everyday language), interests and learning preferences the teacher recorded, IEP status and review dates, and short "what we adjusted" notes on recent assignments. It never shows diagnoses, IEP goals, service minutes, clinical narratives, other students, or the teacher's raw materials.
- Questions to the family helper: Parents can ask questions about the supports shown. Answers are generated by our AI provider (Anthropic). The helper receives only the de-identified support descriptions and assignment notes, never the child's name, grade, or IEP status, and the parent's question is de-identified on a best-effort basis before it is sent. Questions and answers are not saved.
- Notes to the teacher: A parent can send the teacher a short observation note. The note is encrypted at rest, is visible only to that child's teacher, and is kept until the student record is deleted.
- Sessions and codes: Family portal sessions expire after 24 hours. Codes are generated by the platform and can be rotated or revoked by the teacher at any time, and each use of the portal is recorded in our access and disclosure log.
- Review and correction: Requests to review or correct a student's information are handled through the student's school, which can verify the requester's identity.
Teacher Responsibilities
Teachers are responsible for ensuring they have proper authorization from their school or district to enter student data into the platform. We recommend schools establish Data Processing Agreements (DPAs) where required by institutional policy or state law. If your school or district requires a DPA, please contact us at hello@aiccommodate.com (opens in a new tab).
8. Data Security
We implement a comprehensive set of security measures to protect your information:
- Encryption in transit — All data is transmitted over HTTPS/TLS with HTTP Strict Transport Security (HSTS) enforcement
- Encryption at rest — Database hosted on Supabase (PostgreSQL) with encryption at rest. Student-identifying fields — names, IEP and accommodation content, and family/parent-portal data — receive an additional layer of field-level encryption (AES-256-GCM) before they are ever written to the database
- Authentication — JWT-based authentication with secure token handling via Supabase Auth
- Access control — Role-based access control with Row Level Security (RLS) at the database level
- Input validation — Rate limiting (30 requests/minute per user on AI endpoints), CSRF protection, SSRF prevention, and XSS sanitization (DOMPurify)
- Monitoring — Continuous error tracking via Sentry and structured JSON logging with correlation IDs
- Testing & auditing — More than 5,000 automated backend tests with a CI/CD gate that blocks deployment if any test fails, plus regular internal security audits
While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your information using commercially reasonable measures. If you become aware of a security vulnerability, please contact us immediately at hello@aiccommodate.com (opens in a new tab).
9. Data Retention
We retain your data only for as long as necessary to fulfill the purposes described in this policy or as required by law.
| Data Type | Retention Period |
|---|---|
| Account information | Until you delete your account |
| Google account data (via OAuth) | Until you delete your account or revoke access via Google Account settings; deleted permanently upon account closure |
| Student & class data | Until deleted by you or upon account closure |
| Generated materials | Materials saved to your account and assignment outputs persist until you delete them; the quick materials library auto-expires unpinned items after 7 days |
| AI Chat conversations | Until deleted or archived by you |
| MetaCognAI student sessions | Live tutoring sessions expire after 24 hours; session records and end-of-session summary reports are retained (encrypted) under the supervising teacher's account until deleted |
| Grammar Coach student sessions | Nothing is saved: the student's writing and the coaching conversation live only in server memory during the session and are discarded when the session ends or after 24 hours |
| Family portal | Parent sessions expire after 24 hours; questions asked of the family helper are not saved; observation notes a parent sends to the teacher are stored (encrypted) under the teacher's account until the student record is deleted |
| Access and disclosure log | Seven years. Records who accessed or changed student records (including family-portal and student-tool sessions), with the actor's role, the record involved, the IP address, and the time. Kept to support schools' FERPA recordkeeping |
| Payment records | As required by law and Stripe's data retention policy |
| Error logs (Sentry) | 90 days |
| Server logs | 90 days |
10. Your Rights
You have the following rights regarding your personal information:
- Access — You can view your account information and all data you have entered at any time through the platform, including your profile, student records, class data, and generated materials.
- Correction — You can update your profile information (full name, school name) through your account settings at any time. Student and class data can be edited directly in the platform.
- Deletion — You may request complete deletion of your account and all associated data. Individual student records, class data, and conversations can be deleted at any time through the platform. Account deletion is available in your profile settings and requires password re-verification.
- Export — You can download your generated materials in PDF, DOCX, or PPTX format directly from the platform.
- Withdraw Consent — You can revoke Google OAuth authorization at any time by visiting your Google Account permissions page (opens in a new tab) (Security → Third-party apps with account access → Remove AIccommodate). Canvas LMS authorization can be revoked through Canvas Settings → Approved Integrations. See Section 2 for full details on Google data revocation.
To exercise any of these rights, contact us at hello@aiccommodate.com (opens in a new tab). We will respond to all requests within 30 days.
12. Children's Privacy
AIccommodate is designed for use by educators. Teachers use the platform to create accommodated educational materials. Students do not create accounts or use the main platform. Two student tools, described below, can be used by students of any grade with a code from their teacher: the MetaCognAI AI Tutor and the Grammar Coach.
MetaCognAI Student Portal
AIccommodate includes a separate feature called MetaCognAI, where students can interact with a Socratic AI tutor to build metacognitive skills. This portal is designed with children's privacy at the forefront:
- No account creation required — Students access the portal via a teacher-generated access code, with no sign-up process
- Time-limited live sessions — Live tutoring sessions automatically expire after 24 hours
- What is kept afterward — When a session ends, a summary report is saved to the supervising teacher's account so the teacher can follow up. Session records and any name a student volunteers are protected with field-level encryption at rest, and are deleted through the teacher's account controls and our student-data erasure process
- Minimal data collection — Students are never asked to provide personal information; anything a student voluntarily shares in conversation is protected as described above. When a teacher issues a per-student code, the tutor is given the student's teacher-entered supports and interests as short structured tags only — never the student's name and never diagnosis information
- Teacher-controlled access — Access requires a teacher-generated code: either a 6-character class code that expires after 30 days, or a 12-character per-student code the teacher can rotate or revoke at any time (revoking immediately ends that student's live sessions). Codes are generated by the platform — students never choose them
- Rate-limited — To prevent abuse, starting a session is rate-limited per IP address and chat messages are rate-limited per session
Grammar Coach
The Grammar Coach helps a student improve the mechanics of their own writing (grammar, punctuation, spelling, and sentence structure). It is designed to point, ask, and explain rather than write or rewrite the student's sentences. It uses the same teacher-generated codes as the AI Tutor and the same protections:
- Nothing is saved — The writing a student pastes and the coaching conversation are held only in server memory for the live session and are discarded when the session ends or after 24 hours. Nothing is reported to the teacher beyond a count of the day's exchanges.
- What is sent to AI — The student's pasted writing and questions are sent to OpenAI to generate the coaching reply, after best-effort de-identification. Each request is sent with storage turned off, and OpenAI does not use API data to train its models; under OpenAI's API policies a request may be kept briefly for abuse monitoring. Students are asked not to include last names. The coach is never given the student's name or any diagnosis.
- Read-aloud and dictation — Reading a reply aloud and dictating use the browser's own built-in speech features, which may be provided by the browser maker; AIccommodate does not receive audio through them.
- Daily limits — Use is limited per day, per device and per class. To apply the per-device limit, a random identifier is stored in the browser; it identifies the browser, not the student.
- Free for teachers — The Grammar Coach remains available to teacher accounts after the free trial ends, with a lower daily limit.
COPPA Notice: Students under 13 may use the AI Tutor and Grammar Coach only through a code issued by their teacher. Under the Children's Online Privacy Protection Act (COPPA), a school may consent on parents' behalf to a provider's collection of personal information from students, solely for the school's educational purposes. We rely on that school consent, confirmed in our written agreement with the school, and we collect from students only what those tools need to work, as described above. We never use children's information for advertising, marketing, or non-educational profiling, and a school that requires direct parental consent can elect that in its agreement with us. If you believe a child has provided us with personal information outside these tools, please contact us at hello@aiccommodate.com (opens in a new tab) and we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to our practices, technologies, legal requirements, or other factors. When we do:
- The updated policy will be posted on this page with a revised effective date at the top.
- For material changes affecting student data practices, data sharing, or your rights, we will provide at least 30 days advance notice via a prominent notice on the platform.
- Your continued use of the platform after changes take effect constitutes your acceptance of the updated policy.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
14. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Email: hello@aiccommodate.com (opens in a new tab)
- Platform: https://www.aiccommodate.com (opens in a new tab)
We aim to respond to all privacy-related inquiries within 30 days.