Privacy Policy · LessonSmith
DRAFT (not legal advice). This is a working draft prepared to match the planned product. It is a template, not lawyer-drafted. Have a qualified lawyer (ideally one familiar with the Kenya Data Protection Act, 2019 and, if you serve EU/UK or California users, the GDPR/UK GDPR and CCPA/CPRA) review and finalize it before publication.
LessonSmith helps teachers generate lesson plans and Schemes of Work using AI. This policy explains what personal data we collect, why, who we share it with, and your rights.
1. Data we collect
We group the data we collect into the categories below.
A. Account and identity (via Clerk). Full name; email address; authentication identifiers and session tokens. If you sign in with Google, the basic Google profile Google shares with us (name, email, profile image). If you enter it, your TSC number (Teacher Service Commission registration number), a professional or government-issued identifier.
B. Profile and preferences. School name (shown on exported plans); school logo or badge image if you upload one; your teacher or display name; the app-interface language and the plan-output language (for example English or Kiswahili); theme choice; and your region and curriculum selection (a country or region plus a curriculum such as Kenya CBC, England National Curriculum, or IB). Region and curriculum is a preference you set yourself. It is not GPS or precise device geolocation, and we do not need your exact location to provide the service.
C. Lesson-plan generator inputs. Grade or class level; subject; strand and sub-strand; term (1, 2, or 3) and academic year; lesson date and time; roll (class size or number of learners); linked reference scheme of work; output template choice (CBC Standard, Compact, or Table); differentiation and inclusion preference; and the free-text notes or instructions you type for the AI.
D. Scheme-of-Work builder inputs.Subject, grade, language, and scheme scope (a full year or a specific term); additional notes; and the term calendar you set, meaning term opening and closing dates, holidays, labelled exception periods (for example "Sports week" or "KCSE mock"), and the teaching days of the week you select.
E. Content you generate and store. The lesson plans and Schemes of Work you generate, including both inputs and outputs; and your saved library, templates, and quick-topic chips.
F. In-app AI assistant. The messages you send to the in-app chat assistant and its responses, retained as your chat history.
G. Payment data (via Polar). Subscription and transaction status and limited billing metadata from Polar (the plan purchased and the renewal state). We never see or store full card numbers; Polar, using Stripe, handles card details.
H. Usage and analytics (via PostHog). Pages viewed, features used, generation counts, and similar product events; device and browser information; and approximate location (country or city) derived from your IP address.
I. Technical and log data. IP address, timestamps, and error diagnostics (for example via Sentry) needed to operate and secure the service.
About your prompts, your TSC number, and your students. Treat anything you type into a generation as potentially shared with our AI providers (Section 4). Your TSC number is a personal identifier you choose to provide. Do not enter students' personal data (names, admission numbers, photos, health details, or other sensitive details) into prompts. You are responsible for the content you submit.
2. How we use your data
- Provide and personalize the service (generate and store your plans and SOWs).
- Tailor subjects, grade bands, and AI output to the region and curriculum you select, so plans match your local curriculum.
- Authenticate you and keep accounts secure.
- Process subscriptions and enforce tier limits.
- Analyze and improve features and reliability.
- Communicate service, billing, and support messages (see Section 11 for marketing).
- Comply with legal obligations and prevent abuse and fraud.
3. Legal bases (where applicable, e.g. GDPR/Kenya DPA)
- Performance of a contract: to deliver the service you sign up for.
- Legitimate interests: security, analytics, and product improvement.
- Consent: non-essential analytics and marketing cookies and marketing email where required.
- Legal obligation: tax, accounting, and lawful requests.
4. AI processing (important)
To generate content, the text you submit is sent to our AI providers, OpenAI (GPT-4o-mini) as primary and Google (Gemini Flash Lite) as fallback, and processed under their API terms. We use their API tiers, which are not used to train their models by default. AI output may be inaccurate ("hallucinate"); review every generation before classroom use. We disclose our use of AI in-product and on our marketing pages so it is never hidden from you.
5. Sub-processors we share data with
We share the minimum necessary with vendors that process data on our behalf:
| Provider | Purpose |
|---|---|
| Clerk | Authentication & account management |
| Convex | Application database & backend functions |
| Polar | Payments (merchant of record; uses Stripe as the card processor) & subscription management |
| OpenAI (GPT-4o-mini API) | AI generation (primary) |
| Google (Gemini Flash Lite API) | AI generation (fallback) |
| PostHog | Product analytics |
| Vercel | Hosting / content delivery |
| Sentry (if enabled) | Error monitoring |
We do not sell your personal data. See Section 12 for how this is treated under California law (CCPA/CPRA).
6. International transfers
Some providers process data outside Kenya (for example in the EU or US). Where required, we rely on appropriate safeguards (such as standard contractual clauses) offered by those providers.
7. Data retention
We keep your account and content for as long as your account is active, and for a reasonable period afterwards to meet legal, tax, and security obligations. You can delete your content in-app or request account deletion (Section 9). Payment records may be retained as required by law. When you delete content or your account, we remove it from our live systems; residual copies may persist in encrypted backups and operational logs for a limited period until they are purged on our routine backup cycle, and we delete or de-identify the related analytics data.
8. Security
Secrets and API keys are kept server-side (never in client code); access to admin tools is restricted to authorized accounts; data is encrypted in transit (HTTPS). No system is perfectly secure, but we apply reasonable technical and organizational measures.
9. Your rights & control over your data
Subject to applicable law (Kenya DPA / GDPR), you may access, correct, delete, export, or restrict processing of your data, and object or withdraw consent. You can exercise the core rights directly in-app:
- Export my data: download your account and content.
- Delete my account: permanently remove your account and associated personal data (subject to records we must keep by law, e.g. payment records).
You may also email privacy@lessonsmith.ai and we will respond within the period required by law. You may complain to a supervisory authority. In Kenya, that is the Office of the Data Protection Commissioner (ODPC); in the EU/UK, your local data-protection authority.
10. Cookies & similar technologies
We use essential cookies to run the service (e.g. Clerk authentication) and analytics cookies (PostHog) to improve it. You can control non-essential cookies via your browser or our cookie controls where provided. For details, see our Cookie Policy.
11. Marketing & email communications
- We send service and transactional messages (billing, security, and account notices) as part of providing the service.
- We send marketing email only where permitted, and every marketing email includes a one-click unsubscribe, an honest subject line, and a valid postal address (consistent with CAN-SPAM and similar laws). Unsubscribing from marketing does not stop essential service messages.
12. California privacy rights (CCPA/CPRA)
If you are a California resident:
- We do not "sell" your personal information for money.
- We use analytics (PostHog) configured to avoid cross-context behavioral advertising. To the extent any analytics constitutes "sharing" under the CPRA, you may opt out via our cookie controls or a "Do Not Sell or Share My Personal Information" control where provided.
- You have rights to know, delete, correct, and opt out, and not to be discriminated against for exercising them. Use the in-app controls (Section 9) or email privacy@lessonsmith.ai.
13. Children
LessonSmith is intended for teachers and adults, not for use by children. Do not enter children's personal data into the service.
14. Changes
We may update this policy; material changes will be notified in-app or by email, and the "Effective date" will be revised.
15. Contact
Arc Intelligence("LessonSmith"), Nairobi, Kenya · privacy@lessonsmith.ai · A postal address is available on request by emailing privacy@lessonsmith.ai.