Privacy Policy & Terms of Service

CASTLE Privacy & Data Security Policy

Last Updated: 03/17/2026

At CASTLE, we are homeschoolers first. We understand that your child’s educational data is sensitive and deeply personal. This policy outlines how we collect, use, and protect your information, with a specific focus on our compliance with the Children’s Online Privacy Protection Act (COPPA).

1. Our Commitment to COPPA Compliance

CASTLE is designed for use by parents (the "Primary Account Holder") to document their children's education. Because our users include children under the age of 13, we adhere strictly to COPPA regulations:

Parental Consent: We do not collect personal information from children without the express consent and initiation of a parent or legal guardian.

Parental Control: Parents have the right to review, edit, or delete any information provided by or about their child at any time.

Minimal Data Collection: We only collect the information necessary to provide our assessment services. We do not "nudge" children to provide more data than required for their portfolio.

2. Data Collection & Usage

We collect two types of information:

Account Information: Name, email, and billing details provided by the parent to manage the subscription.

Educational Artifacts: Photos, videos, audio recordings, and written work uploaded by the family to demonstrate academic progress.

Usage Data: Non-identifiable information (IP addresses, browser types) used strictly to improve the app’s performance and security.

3. Third-Party Infrastructure & Limitation of Liability

To provide world-class security, CASTLE utilizes industry-leading third-party "Infrastructure Providers" (such as cloud hosting, database management, and AI processing).

The Backbone: While your data is housed within high-security environments, these environments are maintained by third-party vendors.

No Direct Liability for Vendor Breaches: CASTLE selects vendors based on their compliance with international security standards (e.g., SOC 2, ISO 27001). However, CASTLE does not own, control, or maintain the physical hardware or the primary security layers of these third-party providers.

Limitation of Exposure: By using CASTLE, you acknowledge that while we employ rigorous encryption and access protocols, CASTLE cannot be held liable for data compromises resulting from a security breach of our third-party infrastructure providers, provided that CASTLE has maintained reasonable internal security practices. Your recourse in such events lies with the respective provider’s terms of service.

4. AI and Data Processing

CASTLE utilizes trained large language models to provide expert-level feedback.

Anonymized Processing: When data is processed for feedback, we strip away personally identifiable markers where possible.

No Data Selling: We do not sell your family’s data or your child’s artifacts to third parties for advertising or any other purpose. Your data is used solely to facilitate your child's educational assessment.

5. Data Retention & Deletion

You Own Your Data: You may export your reports and artifacts at any time.

The "Right to be Forgotten": Upon request or account cancellation, CASTLE will purge your data from our active databases within [e.g., 30-60] days, subject to the data retention and "garbage collection" cycles of our third-party cloud providers.

6. Security Protocols

We employ "Bank-Level" encryption (SSL/TLS) for data in transit and at rest. We utilize multi-factor authentication (MFA) options for account holders to ensure that access to the "Digital Sanctuary" remains in the parent's hands.

7. Contact Our Privacy Officer

If you have questions regarding this policy or wish to exercise your rights under COPPA, please contact: Privacy Officer, CASTLE [Insert Email Address] [Insert Physical Address]

Legal Strategy Notes for the Founder:

The "Pass-Through" Defense: Section 3 is critical. It clarifies that you are a user of a cloud service, not the cloud service itself. If a trillion-dollar company has a breach, your small business cannot be the primary target for a class-action suit.

Parental Consent Flow: Ensure that your app’s sign-up flow requires the parent to click "I Consent" to the COPPA disclosure before they can create a profile for a child.

Terms of Service (ToS) Link: This Privacy Policy should be paired with a "Terms of Service" document that includes a "Mutual Indemnification" and a "Cap on Damages" (e.g., limiting liability to the amount paid for the subscription in the last 12 months).

Would you like me to draft the "Terms of Service" section that specifically limits financial damages in the event of a system-wide outage or data issue?