Privacy Policy and Terms of Use

Edited October 8, 2026

2. Information We Collect

We only collect information necessary for the purposes described in this policy.

3. How We Use Your Information

4. Sharing Your Information

We do not sell your personal information. We may share it with technical providers, authorized educational institutions, and competent authorities when needed to deliver the service, maintain security, comply with the law, or protect our rights.

Depending on the feature used, Scolaro sends the data needed for processing to OpenAI or to an AI provider accessed through OpenRouter. Scolaro requires that these providers not use submitted prompts, documents, student responses or generated outputs to train their models.

When essay correction is used, the submitted text, relevant instructions and assessment rubric are sent by our server to the AI provider to assess content and language. An additional check may be performed when an assessment needs review. The Lotus assistant continues to use OpenAI, including for its knowledge base.

No use for training does not necessarily mean no retention. Limited retention may apply under the provider's terms, including to deliver the service, maintain security or comply with legal obligations.

For some spelling and grammar checks, the submitted text and selected language are also sent by our server to LanguageTool.

Lotus messages expire 30 days after each message was sent, calculated in UTC. New messages do not extend older messages. Use “Delete my history” in Lotus to delete your stored conversation content earlier; a new conversation alone does not delete the archive. Expired content becomes unavailable and is removed in bounded background cleanup batches. Necessary billing and security records remain subject to their separate retention rules. Provider and backup retention are separate from deletion in the active application.

In Settings → Lotus data, you can delete your conversations, AI uncertainty flags and associated incident content. During your current conversation, Lotus can privately flag uncertainty, vagueness, possible errors or missing information. An AI flag alone does not grant staff access. Review and report this conversation lets you preview the stored messages and explicitly submit an incident; only authorized support staff can then read those messages, with audited access. Later messages are excluded. Deleting your Lotus data also removes the incident content. This conversation recording applies to new messages after this feature is enabled, in teacher and school workspaces.

Scolaro's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Google Classroom data is not sold, transferred to advertising platforms, used for ad targeting, used to determine credit-worthiness, or used to create, train, or improve a generalized or non-personalized AI or machine learning model.

5. Data Hosting

Most data is stored in Montreal. Some data, such as login information or data used for certain technical processing, may be stored in the United States.

6. Your Rights Regarding Personal Information

If you need anything regarding your data rights, please contact us through the following form:

https://scolaro.app/contact.html

Deletion and backups

Account deletion concerns erasable personal data in the live service. Non-personal shared content and facts needed for billing, usage or audit may remain after references to the person are removed, subject to applicable obligations.

Database backups may still contain data recorded before deletion until those backups expire. Deleting an account does not immediately rewrite older backups. Backup retention is separate from retention in the live service. Contact us for the retention period applicable to your request.

7. Use of AI and Automated Decisions

Scolaro uses AI to generate questions, suggest corrections, and produce pedagogical feedback. These outputs are assistive only: the teacher or institution remains responsible for final decisions, and human review can be requested when needed.

8. Cookies and Analytics Tools

We use essential cookies to keep you signed in, secure the platform and remember preferences. Audience measurement and the applicable choices are described below.

Outside Europe, Scolaro uses Google Analytics automatically on public pages and signed-in pages, including student pages, to count visits and a limited set of actions. Collection is disabled when our hosting provider locates the request in Europe or cannot determine an eligible location. We use approximate country-level network location, not GPS; VPNs and network routing can affect this estimate.

We send fixed event and page-category labels, a random browser-session identifier, and limited browser/device information. We do not send names, email addresses, account identifiers, answers, grades, entered text, page content, raw page URLs or query strings. Google processes the connection IP address. These technical measurements are not anonymous. Google’s script runs with the website’s origin and can technically access page contents and browser storage.

Advertising consent is denied, Google Signals and enhanced measurement are disabled, and only allowlisted events are requested by Scolaro. An existing Google Ads account link remains; disabled advertising personalization is not a promise that no technical data can flow through Google’s linked services. Session cookies have no persistent expiry, although browser session restoration can retain them. Browser privacy signals and blocked storage are respected. This configuration provides no site analytics opt-in or opt-out control and does not change marketing-email consent.

The intended user/event retention is two months without reset on new activity; standard aggregate reports may remain longer. Google may process information outside Canada. Contact us through our contact page for data questions or historical deletion requests.

The iOS app uses Firebase Analytics for automatic app/session measurements and Firebase Crashlytics for production crash reports; Scolaro does not add account identifiers or custom activity events to these SDKs. Separately, web and iOS signup collect limited reliability diagnostics: an expiring random operation identifier, platform, method, stage, outcome, fixed error category and release version. No email, account identifier, entered content or persistent device identifier is included. Detailed diagnostics are kept for seven days and daily aggregates for 90 days in private Supabase storage. Only aggregate signup totals are exported to a separate Google Analytics diagnostics stream. Private operational alerts contain no student contact information. This operational reporting is independent of web audience measurement and marketing-email consent.

Public social links may carry a profile label (ig for Instagram, fb for Facebook, tt for TikTok or ys for YouTube) or a numbered ad label such as ig_00 or tt_01. Existing google_01 ad labels are also supported. Tagged home links open teacher registration without an access code. In that signup flow, the latest valid label may be remembered in the same browser for 30 days and saved privately with teacher registration without an access code so the signup notification can identify the source. This separate signup attribution is not sent to Google Analytics. Labels contain only a supported platform prefix and, for ads, an underscore followed by digits; no advertising click identifier or arbitrary URL content is stored as an attribution label.

9. Minors and School Context

Scolaro is used mainly in an educational setting. For minor students, the school or responsible teacher must ensure required authorizations are in place, and we limit collection to information necessary for the platform's educational use. Optional student notifications remain subject to school or parental authorization when required by law.

10. Information Security

We apply reasonable security measures such as encryption, access controls, and technical monitoring to protect your information. If a serious privacy incident occurs, we will follow the notification obligations required by law.

11. User Accounts

To use Scolaro, you must create an account with accurate information, keep your login details confidential, and update your information when needed. You are responsible for activity under your account and must promptly notify us of any unauthorized use. Teachers and institutions that create student accounts or add student data also confirm that they comply with applicable laws, obtain required authorizations when necessary, and only submit information needed for the Platform's educational use.

By using Scolaro, you also authorize us to use the email address associated with your account to help identify the school, educational institution, or organization connected to your use of the service, and to use that information in our communications or discussions with that institution when reasonably necessary to provide the service, clarify a situation, or resolve a matter related to the platform.

When an eligible teacher or school official tries to register while registration is closed or no spot is available for their institution, their email address, institution domain, and selected school information are added automatically to our waiting list if they agreed to receive emails from Scolaro. Otherwise, Scolaro asks for separate confirmation before adding them. A student's email choice never authorizes adding that student to this waiting list. Being added to the waiting list does not, by itself, subscribe the applicant to the newsletter and does not trigger an automatic email; Scolaro may contact them manually when a spot becomes available.

If you contact us, or if an institution associated with your account contacts us, regarding a problem, dispute, technical issue, billing matter, security concern, or any other service-related situation, you authorize us to investigate the matter and to access, review, and verify the data, account information, and related records reasonably necessary to understand, process, and resolve it.

If you connect Google Classroom, you confirm that you are authorized to use the relevant courses, rosters, assignments, materials, and grades in an educational context. You must not connect a course, import a roster, or post grades for a class you are not authorized to administer.

12. Acceptable Use

You must not use Scolaro for illegal, non-educational, abusive, or unauthorized purposes, attempt to bypass security measures, access data without permission, publish or store illegal or inappropriate content, infringe third-party intellectual property rights, or collect or export other users' data without authorization. If these rules are violated, we may suspend or terminate your account and take any appropriate action.

13. Content and Intellectual Property

You retain rights to the content you create or upload to Scolaro, subject to any pre-existing third-party rights, but you grant us a limited, non-exclusive, royalty-free license to host, process, display, reproduce, and technically adapt that content as needed to operate, improve, and develop the service. This license includes all uploaded files as well as exam questions created, imported, generated, modified, or used in Scolaro, only to the extent needed to provide, maintain, and improve requested features. It does not authorize training internal models from uploaded files or student responses. This license does not allow us to sell your content as standalone content or commercially exploit it outside Scolaro without your agreement. The Platform, its interface, code, structure, logos, predefined texts, and AI technology remain Scolaro's protected property, and no ownership rights are transferred to you beyond the licenses expressly stated in these Terms.

By accepting these Terms, you also grant Scolaro a non-exclusive, royalty-free license to reuse, reproduce, adapt, and incorporate into its educational resources the curricula, course plans, teaching progressions, and pedagogical instructions you provide and are authorized to license, and to make those adapted resources available to other teachers within Scolaro. This permission is granted through the Terms, without a separate programme submission or sharing checkbox. It does not turn contributions into official curricula and does not cover personal information, student responses, or third-party content for which you lack the necessary rights. Any shared resource must exclude personal information. Content previously collected with a promise of confidentiality or separate sharing consent does not become shareable merely because of this update. The restrictions above on internal model training and exploitation outside Scolaro continue to apply.

14. Role of AI and Automated Decisions

Scolaro uses AI as an assistance tool to generate content, suggest corrections, and produce pedagogical analysis. Official decisions remain the responsibility of the teacher or institution, and human review can be requested when an important decision relies on automated processing.

15. Lotus AI Assistant

The Lotus AI assistant uses a knowledge base to answer questions and guide users. Lotus may however make mistakes or inaccuracies, and nothing it states has any legal value. Conversations may be retained in Scolaro and reviewed under controlled access for support, security, and service improvement. Account identity is used only when necessary for those purposes, including following up on an error report.

16. Third-Party Services (Supabase, OpenAI, OpenRouter, Analytics, etc.)

Scolaro relies on certain third-party services, including:

• Supabase for hosting, authentication, and database
• Google Classroom / Google OAuth for Classroom connection, course imports, reference rosters, course materials, draft assignments, and draft grades
• AI Providers: OpenAI or providers accessed through OpenRouter for AI features, including assisted generation and correction, subject to the requirement against using data for training described in section 4
• LanguageTool: spelling and grammar checks on submitted text, depending on the correction feature used
• Analytics Tools (e.g., Google Analytics) to measure and improve Platform usage

The use of these services is governed by contractual agreements aimed at protecting personal information. Some of these services may be located outside of Quebec or Canada.

As part of service security and reliability, we may also log certain technical events related to authentication and account creation, including failed sign-up attempts when an email address is already associated with an account. These events may be recorded in our secure technical logs, including the Supabase database, used to measure error rates and detect unusual spikes in our routine health checks, and may trigger an internal alert email when reasonably necessary to investigate, protect the Platform, or resolve an incident.

Audience measurement outside Europe is described in the Cookies and Analytics Tools section. Browser privacy controls remain respected.

17. Google Classroom OAuth and Google Data

The Google Classroom integration is optional and intended for authorized teachers. Google OAuth may request permissions related to courses, student rosters, Classroom profile email addresses, assignments, and course materials. These permissions are used only for the Classroom features visible in Scolaro, such as course imports, reference roster imports, selecting materials for test generation, creating draft assignments, and sending draft grades.

You can disconnect Google Classroom from profile settings. Scolaro then attempts to revoke the Google token and deletes the local integration record. Classes, tests, or results already created in Scolaro may remain in Scolaro as ordinary educational content until deleted under the applicable tools and rules.

18. Liability, Termination, and Governing Law

Scolaro is provided "as is" to the extent permitted by law. We may suspend or terminate access in cases of misuse or breach of these Terms. These Terms are governed by the laws of Quebec and the applicable federal laws of Canada, and any dispute will be submitted to the courts of Montreal, subject to mandatory applicable rules.

19. Updates to This Document

This page combines the Privacy Policy and the Terms of Use. We may update it to reflect changes to the service, our practices, or legal requirements. The date shown at the top of the page is the current version date.

© 2026 Studio Scolaro inc. All rights reserved.