LUCA – Privacy Policy

At LUCA Learning (“LUCA,” “our,” “us,” or “we”), we are committed to protecting the privacy and security of personal information of our users (“Users,” “you,” or “your”). This Privacy Policy (this “Policy”) describes how we collect, use, disclose, and protect personal information through our websites, the LUCA Reading Platform, and related products and services (collectively, the “Services”).

This Policy is intended to be read together with our Terms of Service, which govern your use of the Services. By accessing or using the Services, you acknowledge that you have read and understood this Policy and our Terms of Service and that you agree to be bound by both.

If you have any questions about this Policy, please contact us as set out in the “Contact Us” section below.

Information We Collect

We collect the following categories of personal information about Users.

Personally Identifiable Information (PII)

PII is information that identifies you or your child specifically, such as first and last name, school or district name, postal address, city or state, telephone number, email address, grade or an ID number assigned by your school or district, username, and account password. We collect PII when you register for an account, contact us for support, validate an ID number, send us feedback, or otherwise interact directly with us.

Technical and Usage Information

We and our third-party partners automatically collect certain usage information when you use the Services, read our emails, or otherwise interact with us. We usually collect this information through cookies and similar technologies. This may include IP address, browser type and version, Internet service provider, device type, operating system, date and time stamps, unique identifiers associated with your browser, device, or account, the site you visited before and after using the Services, the pages you view, links you click, frequency of access, interactions with emails, and other activity on the Services. When you use our Services on a mobile device, we may collect device identifiers, mobile carriers, device type, model, manufacturer, and mobile operating system. We may also use third-party analytics tools to help us understand usage patterns.

Cookies and related technologies allow us to remember information so that you do not need to reenter it, provide custom content, identify you across devices, monitor the effectiveness of the Services, diagnose or fix technology problems, and enhance our Services.

Reading Information and Audio

We collect reading related information, such as the books or passages you read, the number of items you complete, your responses to tasks, and information related to reading progress. Our Services may also capture audio or speech recordings from Users to detect which phonemes and words present challenges, using artificial intelligence and automatic speech recognition technology. This information is used to provide individualized feedback and to improve educational features. Voice recordings are treated as personal information and are handled consistently with this Policy.

Information from Others

We may receive information about you from others. For example, schools may provide us with student demographic or roster data to set up accounts and measure reading improvement. A parent or legal guardian may provide information about a child’s User when registering an account for that child.

Other Voluntarily Provided Information

We collect any other information you choose to provide to us, such as responses to surveys, support requests, or other communications.

How We Use Your Information

We may use information collected from you, including PII and other personal information, for the following purposes:

To provide, operate, and support the Services, including creating and managing accounts, authenticating users, delivering reading activities, reporting progress, and providing support.
To personalize and improve the Services, including through artificial intelligence, machine learning, analytics, and research, so that content, pacing, and feedback are tailored to each User’s needs.
To administer and manage accounts, including resetting passwords, responding to questions, and contacting you about your account or problems with your account.
To communicate with you about your account, updates to the Services, changes to our terms or policies, and other administrative messages.
To send marketing communications about LUCA products and services to adult Users such as parents, legal guardians, and educators. You may opt out of these communications at any time by following the instructions in the communication. LUCA does not send marketing communications directly to child Users.
To monitor, analyze, and understand usage and performance of the Services, including generating statistics and analytics regarding user engagement and learning outcomes.
To maintain the safety, security, and integrity of the Services, including detecting, preventing, and responding to fraud, security incidents, and misuse.
To comply with applicable laws, regulations, legal processes, and law enforcement requests, and to protect the rights, property, and safety of LUCA, our users, and others.

For Student Data and information collected from child Users under 13, LUCA uses personal information only to provide, maintain, and improve the educational Services requested by the school or parent or legal guardian, to support security and legal compliance, and for internal analytics. LUCA does not use Student Data or child User information to advertise or market to students or their families and does not allow third parties to do so.

De-Identified and Aggregate Data; Research and Efficacy Reporting

We may use and share de-identified or aggregate information for any lawful purpose, including to improve the Services, conduct research, and demonstrate the effectiveness of the Services. De-identified or aggregate information is information that does not reasonably identify an individual student, parent, legal guardian, family, or school.

Examples include overall reading growth statistics, accuracy rates, or usage of metrics across groups of Users. We may use this type of information in reports, case studies, marketing materials, and presentations to schools and the public.

If we share de-identified or aggregate information with research partners or similar organizations, we will require those organizations by contract not to attempt to re-identify the information and to use it only for the agreed research or evaluation purposes.

Any audio or speech recordings that are used outside the product experience, including demonstrations or marketing, will be processed so that the speaker cannot reasonably be identified. This includes removing associated personal identifiers and altering the audio signal, such as voice modulation, so that the voice is not recognizable as belonging to a specific student.

We do not sell or rent User PII or other personal information. We disclose personal information only in the following circumstances:

Service providers. We may share information with trusted third-party vendors, consultants, and other service providers who work on our behalf and need access to information to perform their work for us, such as hosting, analytics, and customer support. These third parties are bound by confidentiality and security obligations and may use the information only as instructed by LUCA.
Other users associated with an account. We may share information with other users associated with your account where appropriate, such as a parent, legal guardian, teacher, school administrator, or other authorized school representative, to support educational use of the Services.
Schools and districts. For school and district implementations, we share Student Data with authorized school or district personnel as directed by the school or district and in accordance with our Data Privacy Agreement and applicable law.
Research using de-identified data. We may share de-identified or aggregate information with universities, research institutions, and similar organizations to support research in literacy and speech recognition. We do not disclose Student Data or other PII for independent research without explicit written authorization from the relevant school or parent or legal guardian.
Legal and safety. We may disclose information when we believe in good faith that disclosure is necessary to comply with laws or legal processes, to enforce our Terms of Service or other agreements, or to protect the rights, property, or safety of LUCA, our Users, or others.
Business transfers. We may share information in connection with a corporate transaction such as a merger, acquisition, reorganization, sale of assets, or bankruptcy. Any successor will be bound by this Policy or a policy with protections like this Policy with respect to personal information already collected.
With your consent. We may share information with your consent or at your direction, including when you choose to use third party applications or integrations with our Services. The use of information by a third-party application will be governed by that third party’s privacy policy.
Aggregate or anonymous form. We may use and share information in aggregate or anonymized form that does not reasonably identify an individual or school, such as to study and improve our Services and product offerings.

How We Protect User Information

We maintain administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction. Personal information is stored electronically on controlled servers, and access is limited to employees and service providers who require it to perform their job functions and who are bound by confidentiality obligations.

However, no security measures can guarantee complete security. If we learn of a security breach or other unauthorized disclosure of personal information, we will take reasonable steps to investigate and mitigate the incident and, where required by law, will notify affected Users, schools, or parents and legal guardians without undue delay and in accordance with applicable legal requirements.

User Choices and Rights

You can access and update your personal information at any time by logging into your account and changing your profile information or by contacting us as set out in the “Contact Us” section. We encourage you to keep your information current.

We may send marketing emails from time to time. These communications may include information about new and existing Services or other products that may be useful to you. You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in the email.

You may request deletion of your account and personal information by contacting us. For parent or legal guardian managed accounts, if you request deletion, we will delete or de-identify personal information in our active systems within a reasonable period, subject to legal retention requirements. After deletion or de-identification, we will not be able to restore the child’s profile or progress history.

For school accounts, requests relating to Student Data should generally be directed to the relevant school or district. We will assist the school or district in responding to such requests as required by FERPA, applicable state law, and our Data Privacy Agreement with the school or district.

Children’s Privacy

We do not knowingly collect information from children under the age of 13 (or the applicable age of consent in a local jurisdiction) unless and until we have received appropriate consent from a parent or legal guardian or from a school acting on behalf of parents for educational use, as permitted by law.

If you are a minor, you must obtain parental or legal guardian consent before using our Services. If you believe we have collected personal information from a child without appropriate consent, please contact us so that we can delete such data as soon as reasonably possible. For School Users, see the Terms of Service for details about school consent under the Children’s Online Privacy Protection Act (COPPA).

Student Data and FERPA

When we provide Services to schools, school districts, or other educational institutions (collectively, “School Users”), we may receive Student Data that is part of a student’s education record.

For these purposes:

The relevant school or district (the local education agency or “LEA”) owns and controls Student Data and remains responsible for it.
LUCA acts as a “school official” under the Family Educational Rights and Privacy Act (FERPA), with a legitimate educational interest in the Student Data, and handles Student Data only in accordance with our agreements with the LEA and applicable law.
LUCA uses Student Data only to provide, maintain, and improve the educational Services for the LEA, to support security and legal compliance, and for de-identified analytics and research as permitted by those agreements and applicable law. We do not use Student Data to advertise or market to students or their families, and we do not sell Student Data.
The LEA controls access to Student Data and is responsible for responding to parent and eligible student requests to access, review, or correct education records. We will support the LEA in fulfilling those requests by providing access to Student Data that we store on the LEA’s behalf.

Student Data is further governed by a separate Data Privacy Agreement between LUCA and the LEA. If there is a conflict between this Policy and that agreement regarding Student Data, the Data Privacy Agreement will be controlled.

Data Retention and Deletion

We retain personal information for as long as it is reasonably necessary to provide the Services and to fulfill the purposes described in this Policy unless a longer retention period is required or permitted by law.

For school and district customers, we retain Student Data for the term of the applicable agreement with the LEA. Upon written request from the LEA, we will return or transfer Student Data in a commonly used electronic format and will delete or de-identify Student Data in our active systems within sixty days, subject to any legal obligations to retain records. If the agreement terminates and the LEA does not provide additional instructions, we will delete or de-identify Student Data in our active systems within a commercially reasonable period after termination. We may retain De-identified Data consistent with this Policy and applicable law.

For parent or legal guardian managed accounts, we retain personal information while the account is active. If you request deletion of your account, we will delete or de-identify personal information in our active systems within a reasonable period, subject to legal retention requirements. After deletion or de-identification, we will not be able to restore an individual User’s profile or progress history.

Copies of personal information may remain in system backups and logs for a limited period after deletion. These copies are automatically deleted or overwritten in the ordinary course of business.

State-Specific Privacy Rights and Governing Terms

Certain states provide residents with specific rights regarding their personal information. To the extent those laws apply to LUCA and to you, you may have additional rights such as the right to request access to or deletion of certain personal information, or to appeal to a decision regarding a privacy request. If you are a resident of such a state and wish to exercise any rights available to you, please contact us at privacy@luca.ai and we will respond consistently with applicable law.

When we provide Services to schools and districts, we also comply with applicable state student data privacy statutes that may apply to those institutions, including laws that restrict targeted advertising based on student data, prohibit the sale of student data, and regulate the creation of profiles for non-educational purposes.

This Policy is interpreted in accordance with the governing law set out in our Terms of Service.

Changes to This Privacy Policy

We may modify or revise this Privacy Policy from time to time. We will notify Users of any changes by posting the revised Privacy Policy with an updated date of revision on our website and may provide additional notice where appropriate. We encourage you to review this Policy periodically to stay informed about our privacy practices.

Contact Us

If you have any questions or concerns about this Privacy Policy or wish to exercise any privacy rights that may be available to you, please contact us at:

Email: privacy@luca.ai