Privacy Policy

1. Scope

This policy explains how Wizzist LLC ("Wizzist," "we," "our," or "us") handles information when you use our website, accounts, AI tutoring, learning tools, and Team features (the "Service"). It applies to learners, parents, teachers, Team leads, and website visitors.

2. Information We Collect

Account and support information

• Name, email address, sign-in records, plan, and account or Team role
• Optional profile details such as grade band, goals, preferences, or organization
• Messages sent through our contact form or directly to Wizzist support

Learning and content information

• Tutor messages, prompts, answers, notes, tasks, and files you choose to provide
• Lessons, quizzes, attempts, study plans, mastery signals, and progress records
• Team messages, assignments, challenges, and shared work

Technical and transaction information

• IP address, device and browser details, request logs, and security events
• Session, preference, and funnel cookies used to operate and improve the Service
• Subscription status and payment references from Stripe; Wizzist does not store full card details

3. How We Use Information

• Provide accounts, tutoring, lessons, quizzes, planning, progress, and Team features
• Personalize the next useful learning step and preserve relevant session context
• Process subscriptions, send account messages, and answer support requests
• Protect accounts, enforce product rules, diagnose failures, and prevent misuse
• Measure feature usage and improve the reliability and usability of Wizzist
• Meet legal obligations and protect users, Wizzist, and others

Wizzist does not sell personal information, serve behavioral advertising, or use student work to train a Wizzist foundation model.

4. AI Model Providers and Other Processors

Wizzist sends information needed for a requested AI workflow to configured model APIs from OpenAI, Anthropic, or Google. The provider can vary by feature, account settings, availability, and fallback configuration.

We also use service providers for functions such as:

• Hosting, storage, security, and content delivery
• Stripe subscription and payment processing
• Resend transactional and support email delivery

We may disclose information when required by law, to protect safety or rights, or as part of a business transaction subject to appropriate protections.

5. Classrooms, Ownership, and Visibility

Students keep their rights in work they create. Paying for or assigning a classroom seat does not transfer ownership of a student's account or unrelated personal work to a teacher or school. A school may control a separate education-record copy of classroom submissions, grades, and related records under its agreement and recordkeeping rules.

Current authorized teachers see work submitted to their classes and the class progress needed for their role. Joining one class does not share unrelated personal notes, private tutor conversations, family information, or another class's work. Private tutor session transcripts are not presented as an automatic teacher or parent feed.

6. Children's Privacy

A child under 13 cannot create a standalone Wizzist account through the self-service signup flow. Child-data processing requires a current reviewed school authorization for the school-limited purpose or applicable parent or guardian authority. A teacher role, payment, invitation, or adult checkbox alone does not establish that authority. Adults responsible for a child may contact us to review, correct, export, clear, or request deletion of the child's information.

An invited student reads and acknowledges the current classroom privacy notice before joining. If joining is optional, the student chooses whether to join. If the school directs participation under reviewed authority, the acknowledgment confirms receipt of the notice; it is not described as optional consent. Personal AI, family sharing, and personal account continuation require their own applicable choices and authority.

7. Security

Wizzist uses HTTPS in transit, signed sessions, authentication and role checks, provider credentials kept outside source code, and operational logging. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur.

8. Retention and Your Choices

We assign retention by record category and trigger. Private export archives expire after seven days. Invitation links currently expire after seven days and will not exceed the approved 14-day limit; unaccepted invitation contact and profile details are deleted after 30 days. A reviewed account-deletion request targets live erasure within 30 days. When the last classroom sponsorship ends, the departure window for export, recovery, continuation, or closure is no more than 90 days. School-controlled records follow the shorter applicable school agreement or schedule unless a documented legal requirement applies.

A deletion record distinguishes completed live work from narrowly retained school records or holds, processor work, and backup expiry. Provider, mixed-record, and backup items stay pending until a reviewer records evidence. The backup target is no more than 90 days after live deletion. We identify items that are still pending instead of describing an unverified provider or backup copy as erased.

• Privacy & data provides a free export of available Wizzist data and available permitted original files without requiring a paid seat or active classroom. The archive manifest identifies unavailable or restricted categories.
• Available controls can clear saved learning or memory data without closing the account.
• Leaving a class ends live classroom access but does not automatically delete the login, unrelated personal data, or another valid membership.
• Account closure revokes sign-in sessions and credentials and clears supported personal data. Any school record, hold, processor copy, or backup that remains is tracked separately.
• You may request access, correction, deletion, or account recovery from Privacy & data, including after a paid seat ends.

9. Users in the European Economic Area, United Kingdom, and Switzerland

If you use Wizzist from the EEA, the UK, or Switzerland, this section applies in addition to the rest of this policy. Wizzist is the controller of the personal data described here, except where a school uses Wizzist under a reviewed school authorization. In that case the school is the controller of the school-directed classroom records and Wizzist processes them on the school's instructions.

Legal bases

• Performance of a contract: providing accounts, tutoring, lessons, planning, progress, classroom, family, and subscription features you or your school request.
• Legitimate interests: securing accounts, preventing misuse, diagnosing failures, and measuring feature usage to keep Wizzist reliable. We balance these interests against your rights and do not use them for behavioral advertising.
• Consent: optional choices such as personal AI memory for a child, family sharing, email nudges, and any non-essential cookies. You can withdraw consent at any time without affecting processing that happened before withdrawal.
• Legal obligation: keeping transaction records, responding to lawful requests, and honoring privacy requests.

Your rights

You may request access to your personal data, correction, erasure, restriction of processing, and a portable copy, and you may object to processing based on legitimate interests. Privacy & data handles export, correction, clearing, and deletion requests for a signed-in account; you may also contact us using section 11. We respond within one month and will tell you if we need more time. If a school is the controller, we will forward your request to the school and help it respond. You may also lodge a complaint with your local supervisory authority, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner.

International transfers

Wizzist operates from the United States, and the processors listed in section 4 process data there. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with the security measures in section 7.

Automated decisions

AI features suggest next learning steps and may draft feedback or practice scores. Official classroom grades are returned by an authorized teacher. Wizzist does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

10. California and Other U.S. State Privacy Rights

This section applies to residents of California and of other states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas, and Oregon. It describes our practices for the preceding 12 months and how to exercise your rights.

Categories of personal information

• Identifiers: name, email address, account and sign-in records
• Customer records and commercial information: plan, subscription status, and Stripe payment references
• Education information: classes, assignments, submissions, attempts, progress, mastery signals, and classroom records
• Content you provide: tutor messages, notes, tasks, homework photos, and uploaded files
• Internet and device activity: IP address, browser and device details, request logs, and cookie data
• Inferences: suggested next steps and mastery estimates derived from learning activity
• Sensitive personal information: account credentials and, where a role requires it, an age band or age evidence. We use sensitive information only to provide the Service, verify authority, and keep accounts secure.

We collect this information from you, from a parent, teacher, or school acting with authority for you, and from the service providers in section 4. We use it for the purposes in section 3 and disclose it to the service providers and contractors in section 4.

No sale or sharing

Wizzist does not sell personal information and does not share it for cross-context behavioral advertising, has not done so in the preceding 12 months, and does not sell or share the personal information of anyone under 16. Because we do not sell or share personal information, an opt-out preference signal such as Global Privacy Control does not change how we process your data, and we do not use sensitive personal information for purposes that would give rise to a right to limit.

Your rights

• Know and access: the categories and specific pieces of personal information we hold, the sources, purposes, and the categories of recipients
• Correct inaccurate personal information
• Delete personal information, subject to exceptions such as completing a transaction, security, legal obligations, and school-controlled education records
• Portability: a copy of your data in a usable format
• Non-discrimination: we will not deny service, charge a different price, or provide a different quality of service because you exercised a right

A signed-in user exercises these rights from Privacy & data, which verifies identity through the account. Otherwise, contact us using section 11 and we will verify your request by matching it to information we already hold. An authorized agent may submit a request with your written permission, and a parent or guardian may submit a request for a child under their authority. We respond within 45 days and will tell you if we need an additional 45 days. If we decline a request, you may appeal by replying to our decision; we will answer the appeal within 45 days and tell you how to contact your state attorney general if you disagree with the result.

Student records

Where a school directs classroom use, Wizzist acts as the school's service provider for school-controlled records under section 5 and applicable state student-privacy laws, including California's Student Online Personal Information Protection Act. We do not use those records for targeted advertising, do not build a profile of a student except to support the school's educational purpose, and delete or return them as section 8 and the school agreement describe.

11. Changes and Contact

We may update this policy as the Service changes. The date above shows the latest version. Wizzist LLC operates the Service and is the controller and operator described in this policy. For privacy questions or requests, contact: