← Back to VindicaOS

Privacy Policy

VindicaOS, a Seneca product, operated by [legal entity name] ("VindicaOS," "we," "us"). Last updated [date].

VindicaOS is a platform that SAT-prep academies and schools ("academies") use to run their programs. This policy explains what we collect, how we use it, and the choices you have. It covers our website and the VindicaOS application.

1. Two kinds of data, two roles

We handle two categories of information, and our role differs for each:

• Academy & account data: information about the academy and its staff who sign up and administer the service. Here we decide how the data is used, as described in this policy.
• Student data: assessment records, scores, and profiles that an academy uploads or generates for its students. We process this on the academy's behalf and under its instructions, to provide the service. The academy is responsible for its own legal obligations to its students; our handling of this data is governed by our Data Processing Agreement. We do not act as a school official.

2. What we collect

• Account & billing: name, email, academy name, role, and billing contact details. Payments are processed by Stripe; we do not store full card numbers.
• Student data (provided by the academy): name, grade level, school name, a parent/guardian contact where the academy provides one, assessment responses, scores, and teacher notes.
• Usage & technical: log data, device/browser information, and cookies needed to keep you signed in and to operate and secure the service.

3. How we use it

• To provide, operate, secure, and support the platform.
• To score assessments and generate diagnoses, prescriptions, and reports for the academy.
• To operate and improve our measurement models (Seneca), which learn from assessment data to make scoring and recommendations more accurate. We use data to run and improve the service; we do not sell it.
• To bill for the service and communicate with account holders about it.

4. We do not sell your data

We do not sell personal information, and we do not share it with third parties for their own marketing. We share data only with the sub-processors below, who act under contract on our behalf.

5. Sub-processors

We use a small set of vetted providers to run the service. Each is bound by data-protection terms.

Provider	Purpose
Supabase	Database, authentication, and file storage
Netlify	Web hosting, serverless functions, and content delivery
Google (Gemini API)	AI-generated explanations and report drafting
Resend	Transactional email (e.g. reports and notifications)
Stripe	Subscription billing

6. Security

We encrypt data in transit and at rest, isolate each academy's data at the database level so it is not accessible to other customers, and restrict access by role: students see only their own records, and staff only their own academy's. See our data & security overview for more.

7. Retention & deletion

We keep data for as long as the academy's account is active, and then delete or return it as described in the Data Processing Agreement, except where law requires retention. Academies can export or delete their data at any time from within the platform.

8. Your choices & rights

Depending on where you are, you may have rights to access, correct, or delete personal information. For student data, requests should go to the academy that controls it; we will assist the academy in responding. For account data, contact us at [privacy@vindicaseneca.com].

9. Children's data

VindicaOS is sold to academies and schools, not directly to students or children. Where an academy enrolls students under 13, the academy is responsible for obtaining any parental consent required (for example under COPPA), and we process that data solely on the academy's behalf. We do not use children's data for advertising, and we do not allow third-party advertising trackers on student-facing pages.

10. International transfers

We may process data in the regions where our providers operate. Where data crosses borders, we use an appropriate safeguard consistent with applicable law. [Specify residency commitments per region, e.g. Korea PIPA for international schools.]

11. Cookies

We use only the cookies needed to sign you in, remember your preferences, and keep the service secure. We do not use advertising cookies.

12. Changes & contact

We will post any material change here and update the date above. Questions? Contact kevinchoi@vindicaseneca.com.