Teacher's AideBack

Privacy Policy

Last updated: September 4, 2026

1. Who we are

Teacher’s Aide is operated by Josiah Loewen, carrying on business as Teacher's Aide, Manitoba, Canada, PO Box 474, Rosenort, MB R0G 1W0. That is the organisation accountable for the personal information described in this policy. We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Our privacy officer can be reached at the address in section 14.

2. What we collect, and why

  • Teacher account: name, email, province, division and school, role, language and display theme, readable account code, your answer to “does your school use PowerSchool?”, and, where present, the source of the link you signed up through. Purpose: to create and administer your account, tailor the Service to your province, and contact you about the account.
  • Student data: names, optional student number, grade, classroom, term, and the “Alternate Education Plan (AEP)” flag where the teacher ticks it. Purpose: to produce the teacher’s or division’s report cards, and nothing else. This data is entered by the teacher; we never collect it directly from a child or a parent. The AEP flag is sensitive information: it appears only on the report card and is never sent to the AI.
  • Pedagogical content: comments, grades, assembled blocks and their earlier versions. Purpose: the Service itself.
  • Security: password hashes (bcrypt), TOTP secrets, rescue codes, trusted devices, login history and audit logs (IP address, browser, timestamp, action). Purpose: to protect your account, detect abuse, and show what happened if there is an incident.
  • Billing: Stripe customer ID, plan, period dates, billing address and a tax number if you provide one. No card data is stored on our servers. Purpose: to bill you, collect applicable taxes and prevent fraud.
  • Technical: IP address and browser at the time of each request. Purpose: security, rate limiting and error diagnosis.

We do not use this information for any other purpose without telling you and, where the law requires it, obtaining your consent.

3. Encryption

Student names are encrypted at rest using AES-256-GCM. Passwords are hashed with bcrypt (cost 14). All traffic uses TLS 1.2 or higher.

4. Data location

Account and student data is stored in Canadian data centres (database and files, ca-central-1 region). The application servers that answer each request are hosted by Vercel in the United States: data passes through them in memory while a page or an export is produced, and is not stored there. Comment text sent to the AI assistant is processed by Anthropic in the United States (section 5). Email, payments and error monitoring also run through providers based in the United States (section 6). Information processed outside Canada may be subject to the laws of that country, including access by its authorities. For a Quebec organisation, this paragraph is the notice of communication outside Quebec required by the Act respecting the protection of personal information in the private sector.

5. AI and student data

We do not send the student name, student number or AEP flag you store in Teacher’s Aide to any AI model. Those fields are held encrypted and are never included in an AI request. When you use the AI assistant, what is passed to Anthropic Claude is the subject name, the grade level, and the comment text as you typed it.

The comment text is sent exactly as written. If you type a student’s name into a comment, that name is sent along with it — we do not detect or remove names from text you write. If you would rather no name reached the AI, leave names out of the comment box; you can add them when you print or export.

Anthropic does not use that data to train its models. Under its commercial terms it may retain requests and responses for up to 30 days for abuse monitoring, then deletes them. AI is optional: if it is switched off for your site, the comment bank, report cards, and exports all continue to work.

6. Providers we share data with

Each one processes data only to provide us the named service, under its commercial terms and data-processing agreement.

  • Supabase and AWS (Canada region) — database and file storage.
  • Vercel (United States) — application servers; data passes through without being stored (section 4). Vercel also provides cookieless, aggregated page-view analytics on our public pages only (section 9).
  • Anthropic (United States) — optional AI assist (comment text as written; the stored name, student-number and AEP fields are not sent).
  • Stripe (United States) — payment processing and tax calculation; receives your name, email and billing address.
  • Resend (United States) — transactional email delivery; receives your name and email.
  • Sentry (United States) — error monitoring; receives technical traces (page path, browser, error message). Request contents and cookies are stripped before sending.

We never sell your data! We disclose personal information to nobody else unless the law requires it.

7. Retention

Account data is retained for as long as your trial or subscription gives you access. If your access lapses (the trial ends or the subscription is not renewed), your students, classes, comments and custom subjects are permanently deleted 4 months after access ended, unless you are on approved leave. If you delete your account from Settings, it is closed at once and kept for a 30-day recovery window in case you change your mind; it is then permanently erased and the account record is anonymised.

Audit logs (IP address, browser, action, timestamp) may be retained for up to 7 years: the time needed to investigate a security incident, answer a dispute within Manitoba’s limitation periods, and meet the six-year requirement to keep tax records. After an account is erased those logs point to an identifier that no longer names anyone.

8. Your rights

  • Access: export your students and comments from Settings. For a copy of everything we hold about you (including login history and logs), write to the privacy officer in section 14: we respond within 30 days, at no charge.
  • Correction: edit directly in the app; write to us for anything else.
  • Deletion: from Settings, with a 30-day recovery window.
  • Portability: CSV / PDF export.
  • Withdrawing consent: at any time, by deleting your account; some features will then no longer be available.

A parent or student who contacts us about a report card is directed to the school or division, which has custody of the student record.

9. Cookies and analytics

We use only essential cookies (authentication session, language and theme preferences). No advertising or tracking cookies. On our public pages (home, pricing, help) we measure visits with a cookieless tool that produces aggregate totals only; it is not active inside the app once you are signed in.

10. Minors

The Service is intended for adult teachers. Teachers enter data about minor students in the course of their professional duties. We never communicate with students or parents and collect nothing directly from a child. The contractual relationship remains between us and the teacher (or the school division for institutional subscriptions).

Our services for homeschooling families and independent schools are not yet available. This policy will be updated before they launch, because a parent entering their own child’s data is a different situation.

11. Schools, school boards and public-sector privacy law

A school or school board is a public body under the privacy statute of its own province or territory: FIPPA in Manitoba and British Columbia, the FOIP Act in Alberta, LA FOIP in Saskatchewan, MFIPPA and the Education Act in Ontario, the Act respecting access to documents held by public bodies in Quebec, RTIPPA in New Brunswick, FOIPOP and PIIDPA in Nova Scotia, FOIPP in Prince Edward Island, ATIPPA, 2015 in Newfoundland and Labrador, and the ATIPP Acts of Yukon, the Northwest Territories and Nunavut. PIPEDA, cited above, governs our business; the school’s statute governs the school.

Where a school or board holds the subscription, the school or board retains custody and control of student personal information. Teacher’s Aide acts as an information-management service provider, processing that information on the board’s behalf and under its direction. We do not use it for any purpose of our own, we do not sell it, and we do not use it to train models.

Student data is stored in Canada (see section 4 for where it is processed). The one processing step that leaves Canada is the optional AI assistant, which sends the comment text a teacher is working on to Anthropic in the United States. A school or division administrator can turn it off for all of their accounts themselves (School → Organisation settings), or ask us to and we confirm that in writing; for a Nova Scotia public body, whose PIIDPA restricts access to personal information from outside Canada, it is off as a condition of the agreement. We will sign a written data-processing agreement with a school or board on request — write to the address below.

Individual subscriptions: your school or board may have rules about external tools. Please check them before entering student information; that decision rests with you and your employer, whose obligations under its own statute continue to apply.

12. Security breaches

PIPEDA requires reporting any breach of security safeguards that creates a real risk of significant harm. If such a breach affected your data or your students’, we commit to:

  • telling you without unreasonable delay, and no later than 72 hours after we become aware of it;
  • telling the school or division as well, for an institutional subscription;
  • reporting to the Office of the Privacy Commissioner of Canada where the law requires it, and notifying any other organisation that can reduce the harm;
  • saying what happened, what data was involved, what we are doing, and what you should do;
  • keeping a record of breaches for 24 months, as PIPEDA requires.

13. Changes

We will notify you of any material change to this policy by email at least 30 days before it takes effect, if possible. The date at the top of this page identifies the version in force.

14. Contact and complaints

Privacy officer: privacy@teachersaide.ca — Josiah Loewen, carrying on business as Teacher's Aide, PO Box 474, Rosenort, MB R0G 1W0

If you believe we have not handled your information properly, write to the privacy officer first. We investigate every complaint and answer within 30 days. If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada. In British Columbia and Alberta, where the provincial Personal Information Protection Act governs private organisations, the complaint goes to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Information and Privacy Commissioner of Alberta; in Quebec, to the Commission d’accès à l’information.