Privacy Policy

Introduction

Welcome to Star Elements (“we,” “our,” or “us”). We are committed to protecting the privacy and personal information of our students, parents, guardians, and website visitors. This Privacy Policy explains how we collect, use, store, and protect your information when you use our digital learning and testing portal at www.starelements.ai and our tutoring platform at www.starelements.net (together, our “Services”).

By using either portal, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of our Services.

Definitions

Personal Data

Information that identifies or can identify a living individual, alone or in combination with other data we hold.

Usage Data

Data collected automatically from your use of our Services, such as pages visited, session duration, browser type, and device information.

Cookies

Small data files stored on your device by your browser when you visit a website.

Data Controller

Star Elements is the Data Controller for personal data collected through both portals.

Digital Portal

Refers to www.starelements.ai, our digital learning and adaptive testing platform for students.

Account Owner

The parent or legal guardian who creates and manages an account for one or more students.

Information We Collect

3.1 Information You Provide Directly

• Full name of parent or guardian and student
• Email address, phone number, and mailing address
• Billing and payment information (processed via Stripe or PayPal/Braintree — full card details never reach our servers)
• Academic information: grade level, subjects, learning goals, and test preparation needs
• Session notes and progress updates
• Digital learning progress data including quiz scores, module completion, time-on-task, and adaptive test results on starelements.ai
• For students under 13: verifiable parental consent records
• Support requests, feedback, and any other content you choose to send us
• Email addresses entered on our sign-up forms — including instances where a sign-up is started but not completed — retained to measure and improve our sign-up and checkout conversion funnel. This funnel data is used for internal analytics only and is not used to send you marketing emails unless you have separately opted in (see Section 6).

3.2 Usage Data Collected Automatically

• IP address (logged transiently for security and abuse-prevention purposes; not used to build a marketing profile)
• Browser type and version, pages visited, and time on page
• Date and time of visit, device type and operating system
• Sign-in events (timestamp + which portal — we deliberately do not log device fingerprints or browser/IP details with each sign-in)
• On starelements.ai: learning interaction data such as answer sequences, time per question, and module navigation used to personalize your experience

3.3 Information From Third Parties

• Booking and scheduling data via TutorBird
• Payment confirmation data from Stripe or PayPal/Braintree
• Aggregated analytics data from Google Analytics
• Ad-click and conversion data from Google Ads, collected only on our public marketing pages (see Section 4.5)
• Ad-click and conversion data from Google Ads, collected only on our public marketing pages (see Section 4.5)
• Adaptive assessment data generated within starelements.ai
• Public school directory information you choose to share with us

3.4 Information We Do NOT Collect

• Social Security Numbers, driver’s license numbers, or other government IDs
• Biometric data, voice recordings, or facial recognition data
• Precise geolocation (GPS) data
• Health or medical information
• Behavioral advertising profiles built from student educational activity — we never use lesson, quiz, or test data to target or measure ads. The limited conversion measurement on our public marketing pages is described in Section 4.5

Cookies & Tracking Technologies

We and our service providers use cookies on both portals. Cookies fall into four categories:

4.1 Strictly Necessary Cookies

Required for sign-in, security, and core platform function. Cannot be disabled without breaking the Services.

4.2 Functional Cookies

Preserve your preferences (theme, language, timezone) between visits.

4.3 Learning State Cookies (starelements.ai only)

Preserve your progress across lessons and assessments so you can pick up where you left off. If disabled, progress will not persist between sessions.

4.4 Analytics Cookies

Aggregated platform analytics via Google Analytics. Other than the conversion-measurement cookies described in Section 4.5 — which run only on our public marketing pages — we do not use cookies for advertising, retargeting, or building user profiles for sale, and we never place advertising cookies on the student learning or testing portals.

First-party site analytics (public marketing pages). On our public marketing pages we set a single first-party cookie (wa_session_id) that lets us measure which marketing sources bring families to our site and how visitors move through it. It is anonymous and first-party — it stores no name, email, or phone number, is never shared with third parties, and is never used for advertising. Because it is anonymous and used only to understand and improve our own site, we run it by default under our legitimate interest. You can opt out at any time in our cookie banner — choose “Reject all,” or open “Customize,” leave Analytics unticked, and Save. If, during the same visit, you submit a form — for example to book a free trial or request study materials — we may associate that submission with this site-activity session so we can see which sources lead to enquiries and improve our pages. We retain this site-activity data for up to 12 months, after which it is deleted automatically. You can opt out of this anonymous site analytics at any time via the cookie banner (“Reject all,” or untick Analytics under “Customize”), and deleting your enquiry removes the association.

4.5 Advertising & Conversion Measurement (Public Marketing Pages Only)

On our public, pre-login marketing pages — such as our homepage, pricing page, and sign-up pages — we use the Google Ads tag (gtag.js) to measure the effectiveness of our advertising, so we can see which ads lead to subscriptions and spend our marketing budget responsibly. When this tag loads, the following may be shared with Google: the address of the page you visited, the address of the page that referred you, an approximate location derived from your IP address (city or region level, not precise GPS), your browser and device type, and — if you arrived by clicking one of our Google ads — the ad-click identifier and whether you completed a purchase.

How to opt out: You can manage or turn off ad personalization at myadcenter.google.com, install the Google Analytics opt-out browser add-on, block third-party cookies in your browser settings, or use a tracker-blocking browser extension. Opting out does not affect your access to or use of our Services.

You may instruct your browser to refuse cookies; doing so may limit functionality, particularly progress tracking on starelements.ai. Our portals do not currently honor Do Not Track (DNT) signals because there is no industry consensus on how to interpret them, but we treat the spirit of DNT as the default: no behavioral advertising regardless of DNT settings.

How We Use Your Information

• To provide, maintain, and improve our tutoring, digital learning, and digital testing services
• To schedule and manage live tutoring sessions on starelements.net
• To track, personalize, and report on digital learning and test performance on starelements.ai
• To process payments and send receipts and invoices
• To share student progress updates with parents or guardians across both portals
• To provide customer support and respond to inquiries
• To improve platform functionality, adaptive learning algorithms, and service quality
• To detect, prevent, and address technical issues, fraud, and security threats
• To comply with legal obligations under COPPA, FERPA, GDPR, CCPA, and applicable US law
• To process educational prompts you submit to AI-powered features (Skye AI tutor chat, lesson generation, score predictions, retest practice suggestions) using trusted third-party AI service providers — see Section 7.1
• To send service-related communications — account activation, payment receipts, session reminders, password resets, security notices — which are not subject to marketing opt-out because they are necessary to provide the Service

Marketing Communications & Protections for Minors

Marketing emails (newsletters, promotions, new feature announcements) are sent only with your prior consent and you may opt out at any time using the unsubscribe link in any marketing email or by emailing info@starelements.net. Opting out of marketing does not affect service-related communications (Section 5), which are required to operate your account.

How We Share Your Information

We do not sell, rent, or trade your personal information. We share it only in the following limited circumstances:

7.1 Service Providers

We share necessary information with trusted third-party service providers, each bound by a Data Processing Agreement (DPA) or equivalent contract:

• TutorBird (Port 443 Inc.) — scheduling and student portal for live tutoring
• Stripe — payment processing (PCI-DSS Level 1)
• PayPal / Braintree — alternative payment processing (PCI-DSS Level 1)
• Resend — transactional email delivery (password reset, activation, receipts)
• Google Analytics — aggregated platform analytics
• Google Ads — conversion measurement on our public marketing pages only (never on student portals or with educational data)
• Google Ads — conversion measurement on our public marketing pages only (never on student portals or with educational data)
• Google Meet / Zoom — video conferencing for tutoring sessions
• Anthropic (and other trusted AI providers as added in future) — AI-powered learning features on starelements.ai, including the Skye AI tutor chat, lesson and content generation, AI-assisted progress analysis, and score-prediction estimates. Educational prompts you submit are processed to return responses but are not used by these providers to train or improve their underlying AI models. We do not send personally identifying information (full names, email addresses, phone numbers, payment data) to AI providers as part of these prompts.
• Supabase / Vercel — cloud database hosting, application hosting, and content delivery for starelements.ai

7.2 Tutors

Your assigned tutor will have access to your student’s name, grade level, subject needs, and session history solely for delivering effective tutoring. Tutors are contractually required to handle this information confidentially.

7.3 Between Portals

If a student uses both portals, relevant educational progress data may be shared across both platforms to provide a unified learning experience, subject to the same protections described in this Policy.

7.4 Legal Requirements

We may disclose personal data when required by valid legal process (subpoena, court order, lawful regulatory request), to protect our rights or property, or to protect student safety. We will, where lawfully permitted, notify you before disclosing your data in response to a legal request.

7.5 Business Transfer

If Star Elements is involved in a merger, acquisition, or asset sale, your Personal Data may be transferred. We will provide notice before your data becomes subject to a different Privacy Policy and you will retain the right to delete your data if you do not agree.

Payment Information

All payments are processed through Stripe and/or PayPal/Braintree, both PCI-DSS compliant. Star Elements does not store your full credit card number, CVV, or banking details on our own servers. This applies to tutoring packages on starelements.net and paid Digital Portal subscriptions on starelements.ai.

Children’s Privacy — COPPA Compliance

Star Elements is committed to full compliance with the Children’s Online Privacy Protection Act (COPPA) across both portals.

• We do not knowingly collect personal information from children under 13 without verifiable parental consent.
• All accounts for students under 18 must be created and managed by a parent or legal guardian who is at least 18 years of age.
• On starelements.ai, any account for a child under 13 requires affirmative parental consent before account creation and data collection begin.
• We verify parental consent by requiring the parent to create the account first, confirm their email, and acknowledge our policies in a separate step before adding any student under 13.
• Parents may review, request correction of, or request deletion of their child’s personal information at any time by contacting info@starelements.net.
• If you believe we have inadvertently collected information from a child under 13 without consent, please contact us immediately at info@starelements.net and we will delete that information promptly.

Student Education Records — FERPA Compliance

Educational records generated through our Services — including tutoring session notes, digital learning progress, and assessment results — are treated as confidential education records in accordance with the Family Educational Rights and Privacy Act (FERPA), to the extent applicable.

• Parents and eligible students (aged 18 or older) have the right to inspect and review education records maintained by Star Elements.
• Star Elements will not disclose education records to third parties without written consent from the parent or eligible student, except as permitted by FERPA (school officials with legitimate educational interest, compliance with judicial order, health and safety emergency, etc.).
• Requests to inspect or correct education records may be submitted to info@starelements.net. We will respond within 30 days.
• Star Elements does not designate any element of education records as “directory information.” All education records are treated as non-public by default.

GDPR Compliance — EEA & UK Users

If you are located in the European Economic Area (EEA) or United Kingdom (UK), the GDPR and UK GDPR grant you the following rights:

• Right of Access — request a copy of the personal data we hold about you
• Right to Rectification — request correction of inaccurate or incomplete data
• Right to Erasure (“right to be forgotten”) — request deletion of your personal data, subject to legal retention requirements
• Right to Restriction of Processing — request limits on our use of your data
• Right to Data Portability — request your data in a structured, commonly used, machine-readable format
• Right to Object — object to processing based on legitimate interests or for direct marketing
• Right to Withdraw Consent — where processing is based on consent, you may withdraw at any time without affecting the lawfulness of earlier processing
• Right to Lodge a Complaint — with your local supervisory authority

Our lawful bases for processing include: performance of a contract (Article 6(1)(b)), compliance with legal obligations (Article 6(1)(c)), our legitimate interests (Article 6(1)(f)), and where required, your explicit consent (Article 6(1)(a)). International transfers from the EEA or UK to the US are conducted using Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent UK-approved mechanisms. To exercise any right, contact info@starelements.net. We will respond within 30 days.

California Residents — CCPA Compliance

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA grants you the following rights:

• The right to know what personal information we collect, use, and disclose — across both portals
• The right to request deletion of your personal information
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of your personal information — Star Elements does not sell or share personal information as those terms are defined under CCPA
• The right to limit use and disclosure of sensitive personal information — we do not use sensitive personal information beyond the limited purposes permitted under CCPA
• The right to non-discrimination for exercising your CCPA rights

To submit a CCPA request, contact info@starelements.net. We will respond within 45 days and may verify your identity (e.g., confirm account email + at least one other matching detail on file) before acting on requests involving sensitive data.

Your Rights Summary & How to Exercise Them

Depending on your location, you may have rights to access, correct, delete, or port your personal data, or to opt out of marketing. FERPA rights apply to education records (Section 10). GDPR rights apply to EEA/UK users (Section 11). CCPA/CPRA rights apply to California residents (Section 12).

To exercise any right, contact info@starelements.net with the subject line “Privacy Request — [Right You Are Exercising].” We will respond within 30 days (45 for CCPA) and may verify your identity before acting on the request. There is no charge for a first request in any 12-month period.

Data Retention

We retain your personal data only for as long as necessary for the purposes described in this Policy — generally:

• Active customers: for the duration of your subscription or tutoring engagement, plus the data needed to honor warranties and refunds
• Inactive accounts: up to 3 years after your last session or Digital Portal activity, to comply with legal and tax obligations
• Payment records: 7 years per applicable US tax retention requirements
• Education records: per FERPA retention guidance

You may request deletion at any time by contacting info@starelements.net, subject to applicable legal retention requirements. Where deletion is requested but retention is legally required (e.g., tax records), we will isolate that data and stop using it for any operational purpose.

Data Security

We implement appropriate technical and organizational measures to protect your personal data across both portals:

• Encryption in transit — all traffic served over TLS 1.2 or higher
• Encryption at rest — database storage encrypted using AES-256
• Row-Level Security (RLS) — database tables containing user data are protected by Postgres RLS policies; only authenticated users can access their own rows
• Service-role isolation — privileged backend access is restricted to specific server-side endpoints and never exposed to client code
• Access controls — Star Elements personnel can access user data only on a need-to-know basis with audit logging
• Secure third-party processors — all service providers are SOC 2 Type II or equivalent
• Regular security review — we periodically review access controls, dependencies, and surface area for changes

No method of internet transmission or electronic storage is 100% secure. We strive to protect your data using commercially reasonable means, but cannot guarantee absolute security.

Data Breach Notification

To report a suspected security issue or vulnerability, contact info@starelements.net with the subject line “Security Report.” We do not currently operate a bug bounty program but take all good-faith security reports seriously.

International Transfer of Data

Your information may be transferred to and maintained on computers outside your jurisdiction, including the United States, where data protection laws may differ from those in your country. For EEA/UK users, such transfers are conducted using Standard Contractual Clauses (SCCs) or equivalent safeguards per Section 11.

Third-Party Links

Both portals may contain links to third-party websites not operated by us. We have no control over and assume no responsibility for the content or privacy practices of any third-party sites. We recommend reviewing the privacy policy of any third-party website you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date and, for material changes, notify you by email or by posting a prominent notice on our website before changes take effect. Continued use of our Services after the effective date constitutes acceptance.

Contact Us

For TutorBird platform questions: support@tutorbird.com

This policy is provided for informational purposes. For legal advice specific to your situation, please consult a qualified attorney.