Privacy Policy

EvAAL ("EvAAL," "we," "our," or "us") respects your privacy and is committed to protecting the personal information you and your students share with us. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. By using the EvAAL website, platform, assessments, tools, reports, and related services (collectively, the "Services"), you agree to the practices described here.

Who This Policy Applies To

EvAAL is intended for use by adult educators, assistive technology professionals, speech-language pathologists, school personnel, and parents or legal guardians acting on behalf of a student. We do not knowingly collect personal information directly from children under 13. All student information entered into the Services is provided by the adult evaluator using the platform.

Information We Collect

Account information you provide: name, email address, organization, license tier, and billing details.

Student information you enter: first name (optional), grade level, disability area, and the responses, observations, and outputs generated during an evaluation. EvAAL does not require entry of full student names, dates of birth, or other directly identifying information.

Technical information: standard server logs, IP address, browser type, device type, and pages visited, used for security, abuse prevention, and service reliability.

Cookies: we use cookies that are strictly necessary for authentication and session management, plus analytics cookies set by Google Analytics 4 to measure aggregate usage of the Services (pages visited, conversion events, general device and browser characteristics). We do not use third-party advertising cookies and do not pass student evaluation responses or personally identifiable student information to Google.

How We Use Information

• To provide the evaluation tools, generate reports, and deliver AT recommendations
• To authenticate users and secure accounts
• To process payments for license purchases
• To send transactional communications (verification emails, password resets, receipts, service announcements)
• To improve and maintain the Services, debug issues, and prevent abuse

How Student Evaluation Data Is Protected

Student evaluation responses are encrypted at rest using AES-256-GCM before being stored in our database. Data in transit is encrypted with HTTPS. Access to evaluation records is limited to the evaluator who created the evaluation and authorized personnel within the licensed account.

FERPA and Student Records

When EvAAL is used by a school, district, or educational service provider, we act as a "school official" or service provider with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA). Student data entered into the Services remains the property of the school or evaluator and is used only to perform the evaluation functions for which the Services were engaged. We do not sell student data and do not use student data to build profiles for advertising or marketing purposes.

Service Providers We Use

To operate the Services we rely on the following subprocessors, each of which is bound by their own privacy and security obligations:

• Supabase — database hosting and authentication
• Cloudflare — website hosting, DNS, and edge security
• Stripe — payment processing (payment card data is collected and stored by Stripe; EvAAL does not store card numbers)
• Resend — transactional email delivery
• Google Analytics 4 — aggregate usage analytics (pageviews, conversions, device/browser stats). IP addresses are anonymized before reporting. We do not transmit student names, evaluation responses, or evaluation IDs to Google.

We do not sell personal information to third parties.

Data Retention

Evaluation records and account data are retained for the active term of your license and for a reasonable period afterward to support reporting, audit, and legal obligations. You may request deletion of your account or specific evaluation records at any time using the contact information below; we will fulfill such requests except where retention is required by law.

Your Rights and Choices

You may request to access, correct, export, or delete the personal information associated with your account by contacting us at the email below. Depending on where you live, you may have additional rights under applicable law (such as the California Consumer Privacy Act). We will respond to verified requests within a reasonable time.

Children's Privacy (COPPA)

EvAAL is designed for use by adults on behalf of students. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information to us directly, please contact us so we can investigate and remove the information.

Security

We use industry-standard administrative, technical, and physical safeguards to protect personal information, including encryption at rest for evaluation data, encrypted transport (HTTPS), and access controls. No system is perfectly secure; if we become aware of a security incident affecting your information, we will notify you as required by applicable law.

Changes to This Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of the page indicates when the most recent changes were made. Material changes will be communicated through the Services or by email.

Contact

For questions about this Privacy Policy or to make a request about your data, contact us at info@evaaltools.com.