Privacy Policy

Effective date: [date, set when approved]

This policy says what Yellow Cells collects, why, who else handles it, and how long we keep it. We are [legal entity], [address] ("we", "us"). You can reach us at support@yellowcells.com.

1. The short version

• We collect what we need to run accounts and bill for them: user names and email addresses, the district's name, and billing records.
• We do not collect student-level data. Tool entries stay in your browser, and files you import are read in your browser and never uploaded.
• Card numbers go to Stripe and never touch our servers.
• We do not sell personal information, and we do not use it for advertising.
• You can ask us to delete your data.

2. What we collect

Account information

For each user: an email address, a password, and a first and last name if you give them. A password is stored only as a hash, never as text. For each district: its name, who belongs to it and in what role (administrator or member), and the email addresses of the people it invites.

Billing information

Stripe handles payment. When you pay by card, you enter the card on Stripe's pages and the number never reaches our servers. Stripe tells us about your customer record, subscription, invoices and payments (for example amounts, dates and status), and we keep those records to run your subscription.

When you pay by invoice, you give us the district's legal name, a billing contact's name and email address, an optional purchase order number and an optional mailing address. We send them to Stripe, which creates and emails the invoice, and we keep the invoice record.

Messages

If you email us, we keep your message and our reply.

Technical records

Like any website, our hosting and our application keep standard request logs: the IP address, the time, the page requested and the browser type. We use them to keep the service secure and working.

3. What we do not collect

• Student-level data. Yellow Cells does not ask for it and does not receive it. Please do not email us student-level files.
• Your tool entries. A tool keeps what you type in your browser, on your computer. It is not sent to our servers, so we cannot see it.
• Your imported files. A file you import into a tool is read in your browser and is never uploaded.

4. How we use information

We use it to create and secure accounts, sign users in, send invitations and other account email, take payment and manage the subscription, answer support requests, keep the service secure and working, and meet our legal and tax obligations. We do not sell personal information. We do not use it for advertising or share it with advertisers.

5. Who else handles it

These companies handle information for us, only to provide their service to us:

• Stripe for payments, invoices and the customer portal. Stripe's own privacy policy governs what it holds.
• Mailgun to send our email: invitations, confirmations, sign-in codes and password resets.
• Heroku to host the application and its database.

We may also disclose information when the law requires it.

6. Cookies

The site sets two cookies, and both are needed for it to work: a session cookie that keeps you signed in, and a security cookie that protects forms from forgery. We do not set analytics or advertising cookies. The tools keep your entries in your browser's local storage on your computer. That data does not leave your computer.

7. How long we keep it, and deletion

We keep account and billing information while the subscription is active. After it ends we keep it only as long as we need to, for [to confirm: period], then delete it, except billing records we must keep for tax and accounting.

You can ask us at any time to delete a user's account, or the district's account and the personal information in it. Email support@yellowcells.com and we will confirm when it is done.

8. Security

The site is served over HTTPS. Passwords are stored as hashes. Card data is handled by Stripe. Access to the production systems, including the admin tool that lets us see an account as its user sees it when we help with a support request, is limited to the people who run the service. No system is perfectly secure; if we learn of a breach of account data, we will notify the affected district as the law requires.

9. Children

The service is for adults who work for school districts. Students do not have accounts, and we do not knowingly collect personal information from children.

10. Your requests

To see, correct, export or delete the personal information we hold about you, email support@yellowcells.com. A district's account owner can also see its users, and invite or remove them, on the Team page.

11. Changes to this policy

We will post changes on this page and email the account owner at least [30] days before a material change takes effect. [to confirm: notice period]

12. Contact

[legal entity], [address], support@yellowcells.com.