Draft · pending legal review · version 2026-10-27-draft
Privacy Policy
EXEYO is a learning coach for high school students. This policy explains what we collect, why, who can see it, and the choices parents, guardians and students have. Questions: [email protected].
Who can use EXEYO
EXEYO is for students aged 13 and older, in grades 9–12. We do not knowingly collect personal information from children under 13: our sign-up stops before saving anything when someone tells us they are under 13. A student’s account only unlocks once a parent or legal guardian approves it and agrees to this policy on the student’s behalf.
What we collect
- Parents and guardians: name, email address, a password (stored only as a one-way hash), the students you manage, and your agreement to our Terms and this policy, with the date and the network address it was given from.
- Students: name, email address, a password (hashed), grade, and birth month and year (never the full date of birth). As you use EXEYO: lessons opened, practice answers, and progress.
- Billing: handled by Stripe. We never see or store full card numbers; we keep Stripe’s customer and subscription references and your plan’s status.
- Technical: a single sign-in cookie that keeps you signed in, and the network address and browser type of each sign-in, used for security. We use no advertising or analytics trackers.
How we use it
To run EXEYO: to sign you in, teach and track progress, show parents their students’ progress, send account emails (such as confirmations, invites and password resets), bill for plans, keep the service secure, and meet legal obligations.
We never sell personal information, never use it for advertising, and never build advertising profiles of students.
Who can see a student’s information
- The student.
- The parent or guardian who manages the account: they see the student’s account details and progress. A student’s conversations with their coach (when the coach launches) stay private to the student.
- A small number of EXEYO staff, only when needed to run, support or secure the service.
Service providers
We use these providers to run EXEYO. They process data only on our instructions:
- Hetzner Online — servers and database, located in Helsinki, Finland (European Union).
- Cloudflare — network security and delivery, and sending our emails.
- Stripe — payments and billing.
Before we add the AI coach, we will update this policy to describe how coach conversations are processed, and ask parents to agree to the new version.
International transfer
EXEYO’s servers are in Finland. If you use EXEYO from the United States or elsewhere, your information is transferred to and stored in the European Union.
How long we keep it
- A student account that no parent approves within 14 days of sign-up is deleted, with everything in it.
- Active accounts are kept while the plan continues. Ask us and we delete an account within 30 days.
- Records of parental agreement are kept as long as needed to show the agreement was given.
Your choices and rights
Parents and guardians can review, correct, export or delete their student’s information, and withdraw agreement (which closes the student’s access). Students and parents can do the same for their own accounts. Email [email protected] from the account’s address and we will respond within 30 days. You may have additional rights under the laws where you live.
Security
Passwords and sign-in tokens are stored only as one-way hashes. Connections are encrypted, and access to production systems is limited to the people who run the service.
Changes
When this policy changes in a way that matters, we update the version above and ask parents to agree again before the change applies to their students.