Privacy Policy

Edvancate (“Edvancate,” “we,” “us”) provides software that tutoring businesses use to manage students and draft parent communications. We are based in Vernon, British Columbia, Canada. This policy explains what personal information flows through Edvancate, how it is handled, and the choices and rights that apply. It is written to align with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia’s Personal Information Protection Act (PIPA).

Our role: service provider to tutoring firms

Most personal information in Edvancate — students, their guardians, and session records — is entered and controlled by the tutoring firm that uses Edvancate. In privacy terms, each firm is the organization responsible for that information (the “controller”), and Edvancate processes it on the firm’s behalf (a “service provider”). Firms are responsible for having the proper authority and consent to put that information into Edvancate — see our Terms & Firm Agreement.

Information we handle

• Account information for managers, tutors, and administrators: name, email address, and (optionally) a phone number used for sign-in security codes.
• Student records entered by firms: student name, grade, subject, guardian name, guardian email, and notes.
• Session records: dates, notes, and progress entries logged by tutors.
• Uploaded documents: files a firm attaches to a student (for example, worksheets or graded work).
• Generated content: AI-drafted parent emails and summaries created from the above.
• Technical data: standard security and operational logs needed to run and protect the service.

How information is used

We use personal information only to provide and secure the service: to draft and store parent emails, summarize sessions, track student progression, authenticate users, enforce firm-level permissions, and prevent abuse. We do not sell personal information, and we do not use student data to train AI models.

Artificial intelligence

Edvancate uses Anthropic PBC (Claude) as its AI provider, under Anthropic’s Commercial Terms of Service. When a feature runs, the permitted text (and any attached file a firm has allowed the AI to read) is sent to that provider to produce the output, then returned. AI output is a draft for human review— it can be wrong and should be checked before it is sent or relied upon.

What the AI may read is controlled by the firm, and enforced on our servers — never in the browser, and never on the model’s word. Access is decided in layers:

• Firm mode: the AI may read no students, only selected students, or all students. New firms start at none.
• Per-student: in “selected” mode, each student must be individually enabled.
• Per-field ceiling: a firm chooses which categories the AI may see at all — grade, subject, profile notes, session notes, progression, and documents.
• Per-student overrides can only narrow that ceiling, never widen it. A student can be made more private than the firm default, never less.
• Guardian contact details are never sent to the AI from any feature. Parent names and email addresses are stripped from every record before it reaches the model.

If a student ends up with no readable category, the AI is refused access outright rather than given a bare name. We do not use student data to train AI models, and student data is never shared with or made visible to another firm. Under our AI provider’s commercial terms, prompts and outputs are not retained at rest by default; limited retention can apply to particular models or features, and content flagged by that provider’s trust and safety systems may be held longer.

Where your information is stored (cross-border)

Edvancate runs on Supabase (database and file storage) and Vercel (application hosting). Your information is stored and processed in the United States — the database and uploaded files are hosted by Supabase in Oregon (US West), and the application is served by Vercel in the United States. Information stored outside Canada is subject to the laws of the country where it is held, and may be accessible to authorities there under those laws. By using Edvancate, firms and their users acknowledge this cross-border storage.

Neither PIPEDA nor BC PIPA requires personal information to be stored in Canada. Both instead require that we stay accountable for information we hand to service providers and secure a comparable level of protection by contract, which is what the safeguards and subprocessor terms below are for. Firms remain responsible for disclosing cross-border processing in their own privacy notices to students and guardians.

Service providers (subprocessors)

We use a small number of third-party providers to run the service. Each is bound to confidentiality and data protection obligations no less protective than our own, and we remain responsible for how they handle firm data. Our current subprocessors are:

• Supabase — database and file storage (United States, Oregon).
• Vercel — application hosting (United States).
• Anthropic — AI generation.
• hCaptcha — sign-in bot protection.
• Stripe — billing. Receives firm and payment details only; no student information.
• Twilio — SMS verification codes, where a firm enables them.
• Resend — email delivery, where enabled.

This list is kept current, and firms may request it at any time. We give firms at least 30 days’ notice before adding a subprocessor that will process student personal information, or before changing AI provider.

How we protect information

• Tenant isolation: database row-level security keeps each firm’s data separate, enforced at the database, not just the interface.
• Encryption in transit: all traffic uses HTTPS/TLS 1.2 or higher.
• Encryption at rest: the database and uploaded files are encrypted where they are stored.
• Access controls: role-based permissions; uploaded files are private and served only through short-lived signed links.
• Sign-in protections: CAPTCHA on sign-in, and optional phone/email verification codes for accounts.
• Least access: only authorized firm members can see their firm’s data, and access to production data is limited to people who need it to run or support the service.

No system is perfectly secure, but we work to keep protections strong and current.

Retention, export, and deletion

Personal information is kept while a firm’s account is active and for as long as needed to provide the service.

• Export: on written request, a firm can obtain a copy of its data in a commonly used machine-readable format within 10 business days.
• Deletion on request: on written request, and once the firm has had a reasonable opportunity to export, we permanently delete its data from live systems within 30 days, and from backups within the ordinary backup rotation cycle — no longer than 90 days. We confirm in writing when it is done.
• Deletion on closing an account: the same timelines apply, starting 30 days after the account ends, unless the firm asks us to delete sooner or needs a short extension to finish exporting.
• Exception: information we are required by law to keep. Anything held on that basis stays subject to the same confidentiality and security protections, and is deleted once the requirement ends.

Backups are held on a rolling cycle and are not retained indefinitely. Deleting a firm removes its students, sessions, documents, accounts, and related records from live systems permanently.

Children’s information

Edvancate is used by tutoring firms to record information about students, who are often minors. Edvancate does not have a direct relationship with students or their guardians. The tutoring firm is responsible for obtaining any required consent from a parent or guardian before entering a minor’s information, as set out in our Terms & Firm Agreement.

Your rights

Under PIPEDA and BC PIPA you may request access to the personal information we hold about you, ask us to correct it, and ask questions about how it is handled. We will respond within the timelines required by law — BC PIPA generally allows 30 days.

Requests about a student go through the firm. Because tutoring firms — not Edvancate — are responsible for student records, we refer requests from students, guardians, and tutors back to the firm that entered the record, and we do not answer them on the firm’s behalf without its instruction, unless the law requires us to. We assist firms with these requests at no charge, and respond to a firm’s request for help within 10 business days so it can meet its own 30-day deadline. If you are unsure which firm holds your record, contact us and we will point you to them.

Breaches

If we become aware of a confirmed breach of security safeguards affecting a firm’s data, we notify that firm without unreasonable delay and in any event within 72 hours, describing what we know: what happened and when, what categories of information were involved, what we have done about it, and who to contact. We update the firm as we learn more.

Where a breach creates a real risk of significant harm, we also notify the Office of the Privacy Commissioner of Canada and affected individuals where required, in line with PIPEDA, and assist firms with their own notification duties. We keep a written breach response plan and a log of all breaches, whether or not they meet that threshold.

Contact

Questions, access requests, or privacy concerns: privacy@edvancate.com, Edvancate, Vernon, British Columbia, Canada.

Changes

We may update this policy. Material changes will be reflected by the “last updated” date above and, where appropriate, communicated to firms.