Legal
Privacy Policy
Last updated 2026-07-05
This document is a plain-language draft prepared for launch. It has not yet been reviewed by outside counsel — treat it as representative of our practices, not as finalized legal advice.
This policy explains what personal information LumenBoard collects, why, who we share it with, how long we keep it, and the choices you have — including the extra protections that apply when a student is a child.
1. What we collect
- Account info: name, email, role (tutor/student/parent/org), and — for students — date of birth (used only to determine which consent rules apply, never shown publicly).
- Session content: whiteboard drawings, chat messages, and — when recording is included on your plan — video/audio recordings of sessions.
- AI-derived content: only for rooms where a student (or, per child, a parent) has opted in — a transcript and AI-generated lesson notes.
- Billing info: for paid plans, your billing contact and subscription status. Full card numbers are held by Stripe, not us.
- Technical data: a salted hash of your IP address (used only for sign-up rate limiting/abuse prevention — we don’t store the raw address), and basic device/browser info.
2. How we use it
To run the classroom (video, whiteboard, chat), to generate AI lesson notes and answer study questions when that feature is turned on, to process payments, to send account and billing emails, and to keep the Service secure. We do not sell personal information, and we do not use lesson content to train AI models.
3. Who we share it with
We use the following subprocessors to operate LumenBoard. Each only receives the data needed to perform its function.
| Service | Purpose | Data shared |
|---|---|---|
| Supabase | Database, authentication, and realtime sync | Account info, room/session records, whiteboard content, chat messages |
| LiveKit Cloud | Live video and audio during a session | Live audio/video streams (not stored by LiveKit beyond the session) |
| Cloudflare (R2 storage + Turnstile) | Recording storage and bot-protection on sign-up | Recording files (video/audio), sign-up CAPTCHA verification |
| Resend | Transactional email (account activation, welcome, receipts) | Email address, name, message content |
| Groq | Speech-to-text transcription of recorded sessions | Session audio (only for rooms with AI features turned on) |
| Google (Gemini API) | AI-generated lesson notes and the ask-the-notes chatbot | Session transcript + whiteboard content (only for rooms with AI features turned on) |
| Stripe | Payment processing and subscription billing | Billing contact info and payment details (Stripe never shares full card numbers with us) |
We don’t share your information with anyone else, except when required by law.
4. How long we keep it
- Recordings on a Tutor plan are kept for 30 days, then permanently deleted.
- Recordings on Tutor Pro and organization plans are kept for 365 days.
- The free plan doesn’t include recording, so nothing is retained beyond the live session.
- We email a warning a few days before a recording is deleted so you have time to download anything you need.
- Account and profile data is kept until you delete your account (see Section 7).
5. Children's privacy (COPPA)
LumenBoard is used by students of all ages under the direction of a parent or tutor. We take extra care for children under 13:
- We do not create an account for a child under 13 until a parent has given verifiable consent — a typed confirmation on a dedicated consent screen that a parent completes as part of their own account setup.
- Until a parent consents, the child’s account is not created and no personal information about them is collected beyond what’s needed to request that consent.
- A parent can review what we’ve collected about their child, revoke consent, and request deletion at any time from their Account page — this immediately stops further collection and deletes the child’s account and content.
- For students 13–17, a parent email is required at sign-up so a parent is always aware of the account, and a parent can turn AI lesson notes on or off for their child at any time.
Questions about a child’s data specifically: privacy@lumenboard.net
6. Recording notice
Sessions on a plan that includes recording are recorded automatically — this is disclosed to every participant before they join a room. Recording captures the whiteboard and audio; it does not capture a shared screen. Only the tutor, the student(s) in that room, and (for a minor) their parent can view a recording.
7. Your choices and rights
- Access: you can see your own recordings, notes, and profile info from your dashboard.
- Opt out of AI: a student (or a parent, per child) can turn AI lesson notes off at any time — this is off by default.
- Delete your account: request deletion from Account settings. We delete your profile, recordings, transcripts, and notes, and remove you from any rooms. Some records (like billing history required for tax/legal purposes) may be retained as required by law.
- Correct your info: update your name and profile from Account settings at any time.
8. Security
See our Security page for how we protect your data.
9. Changes to this policy
We’ll update the “Last updated” date above when this policy changes, and notify account holders by email for material changes.