For school IT, procurement and privacy reviewers

Trust & student privacy for schools

Plain-language answers about the information Educated Designer stores, what we never do with it, how AI is used, and how to download or delete your data. Students don't need accounts.

Last updated October 26, 2026

Ask a privacy question

What we collect

Feature by feature: what is stored, whether it can include student information, who can see it, and how long we keep it.

What each feature stores
Feature	What we store	Student information	Who can see it	How long
Teacher account	Name, email address and password (stored only as a secure hash), or the Google account used to sign in.	None. Accounts are for adults (18+). Students under 18 don't sign up.	The teacher. Our support team when helping with the account.	Until the teacher deletes the account (Settings → Your data). Deleting it also ends every signed-in session.
Classroom workspace	School or classroom name and the school's address (street, city, state or region, postal code, country), and optionally a contact email, phone, logo, colours and a role such as "teacher". The address is private unless the school chooses to show it on public pages.	None.	Members of the workspace. The owner and admins can change the address.	Until the workspace is deleted. When its only owner deletes their account, the workspace is deleted or handed to another member they choose.
Two-step verification	The authenticator app set-up is held by our authentication platform. One-time backup codes are stored only as salted one-way hashes. A security log records when backup codes are made or used and every reset by our team, with the reason; never the codes.	None.	The teacher. Our support team can reset it for a locked-out teacher after confirming who they are; each reset is logged.	Backup codes until replaced or the account is deleted. The security log is kept without the link to the person once the account is deleted.
Colleagues and roles	Email addresses of invited colleagues and each member's role (for example admin, editor or view-only). Invite links expire after 14 days.	None.	Workspace owners and admins.	Until the member is removed or the workspace is deleted.
Designs, uploads and comments	Designs a teacher makes or edits, images they upload (kept in private storage and shown through short-lived signed links), and comments between colleagues.	Only what a teacher types into a design, such as first names on certificates or name tags.	Members of the workspace. Anyone with the link only if a teacher shares or publishes a design.	Until the teacher deletes it or the workspace is deleted.
Class certificates and "Make many"	A class list or spreadsheet is read in the browser to make one copy per student. We keep only the saved set-up: column names, settings and an optional Google Sheets link.	The list itself is not uploaded. Names end up stored only if the teacher saves a design that contains them.	Members of the workspace.	Saved set-ups: until deleted with the design or workspace.
Teaching kits	Grade, subject, topic, learning objectives, the lesson content and the kit's designs. A view-only share link, only if a teacher turns one on.	None. Requests that look like they name students are refused before anything is sent to AI.	Members of the workspace. A shared link shows lesson content only, with no school, class, teacher or student details.	Until the teacher deletes the kit or the workspace is deleted.
AI features (optional)	For each AI request: which feature, which model, token counts, whether it worked, and the workspace and user it was for. Not the request text.	None should be entered: see "AI use" below.	Our team, to run and pay for the service.	Kept as operating records. When an account is deleted, the link to the person is removed.
Help chat and contact form	Messages typed into the help chat or contact form, the email address given, the page it was sent from, and our replies.	None should be entered. We ask people not to share passwords, card numbers or student details.	Our support team.	Kept so we can follow up. Deleted when the person deletes their account.
Visit statistics	A random visitor ID kept in the browser (not a cookie), pages viewed, the referring website or campaign, time zone, device type and approximate city, region and country.	None. Not linked to a name or email; linked to an account or workspace only to record where a sign-up came from.	Our team.	No automatic deletion date yet. When an account is deleted, its link to these records is removed. The IP address is used once for the location estimate and never stored.
Abuse protection	Request counts per visitor, keyed by a salted one-way hash of the IP address.	None.	Our servers only.	Deleted after about two days.
Payments	Plan, payment status, amounts and receipts. Card details are handled by Stripe; we never see or store full card numbers.	None.	The workspace's owners, and our team for billing support.	Kept for tax and accounting after an account is deleted, without the link to the deleted workspace or person. No automatic deletion date yet.
Printed orders (optional)	The recipient's name, shipping address and the print files for an order a teacher places.	Only if a teacher prints a design that contains student names.	Our team and the print partner making that order.	The order record is kept for tax and accounting; the recipient's name and address and the design name are removed when the workspace is deleted.
Teacher verification	The result only: verified or not, the method (school email, invite from a school admin, a reviewed document, or a school purchase order), the date and when it expires (12 months). For a school email, the address and a one-way hash of the 6-digit code (the code expires after 15 minutes). For a document: the file, with hidden details such as location, camera and author removed on upload.	None.	The teacher sees their own status. Only our verification team can open a document, through a link that lasts 5 minutes.	Documents are deleted 30 days after our decision. The result is kept while the account exists and is deleted with it. A log of verification events (no document contents) is kept to prevent abuse.

Teacher account

What we store: Name, email address and password (stored only as a secure hash), or the Google account used to sign in.
Student information: None. Accounts are for adults (18+). Students under 18 don't sign up.
Who can see it: The teacher. Our support team when helping with the account.
How long: Until the teacher deletes the account (Settings → Your data). Deleting it also ends every signed-in session.

Classroom workspace

What we store: School or classroom name and the school's address (street, city, state or region, postal code, country), and optionally a contact email, phone, logo, colours and a role such as "teacher". The address is private unless the school chooses to show it on public pages.
Student information: None.
Who can see it: Members of the workspace. The owner and admins can change the address.
How long: Until the workspace is deleted. When its only owner deletes their account, the workspace is deleted or handed to another member they choose.

Two-step verification

What we store: The authenticator app set-up is held by our authentication platform. One-time backup codes are stored only as salted one-way hashes. A security log records when backup codes are made or used and every reset by our team, with the reason; never the codes.
Student information: None.
Who can see it: The teacher. Our support team can reset it for a locked-out teacher after confirming who they are; each reset is logged.
How long: Backup codes until replaced or the account is deleted. The security log is kept without the link to the person once the account is deleted.

Colleagues and roles

What we store: Email addresses of invited colleagues and each member's role (for example admin, editor or view-only). Invite links expire after 14 days.
Student information: None.
Who can see it: Workspace owners and admins.
How long: Until the member is removed or the workspace is deleted.

Designs, uploads and comments

What we store: Designs a teacher makes or edits, images they upload (kept in private storage and shown through short-lived signed links), and comments between colleagues.
Student information: Only what a teacher types into a design, such as first names on certificates or name tags.
Who can see it: Members of the workspace. Anyone with the link only if a teacher shares or publishes a design.
How long: Until the teacher deletes it or the workspace is deleted.

Class certificates and "Make many"

What we store: A class list or spreadsheet is read in the browser to make one copy per student. We keep only the saved set-up: column names, settings and an optional Google Sheets link.
Student information: The list itself is not uploaded. Names end up stored only if the teacher saves a design that contains them.
Who can see it: Members of the workspace.
How long: Saved set-ups: until deleted with the design or workspace.

Teaching kits

What we store: Grade, subject, topic, learning objectives, the lesson content and the kit's designs. A view-only share link, only if a teacher turns one on.
Student information: None. Requests that look like they name students are refused before anything is sent to AI.
Who can see it: Members of the workspace. A shared link shows lesson content only, with no school, class, teacher or student details.
How long: Until the teacher deletes the kit or the workspace is deleted.

AI features (optional)

What we store: For each AI request: which feature, which model, token counts, whether it worked, and the workspace and user it was for. Not the request text.
Student information: None should be entered: see "AI use" below.
Who can see it: Our team, to run and pay for the service.
How long: Kept as operating records. When an account is deleted, the link to the person is removed.

Help chat and contact form

What we store: Messages typed into the help chat or contact form, the email address given, the page it was sent from, and our replies.
Student information: None should be entered. We ask people not to share passwords, card numbers or student details.
Who can see it: Our support team.
How long: Kept so we can follow up. Deleted when the person deletes their account.

Visit statistics

What we store: A random visitor ID kept in the browser (not a cookie), pages viewed, the referring website or campaign, time zone, device type and approximate city, region and country.
Student information: None. Not linked to a name or email; linked to an account or workspace only to record where a sign-up came from.
Who can see it: Our team.
How long: No automatic deletion date yet. When an account is deleted, its link to these records is removed. The IP address is used once for the location estimate and never stored.

Abuse protection

What we store: Request counts per visitor, keyed by a salted one-way hash of the IP address.
Student information: None.
Who can see it: Our servers only.
How long: Deleted after about two days.

Payments

What we store: Plan, payment status, amounts and receipts. Card details are handled by Stripe; we never see or store full card numbers.
Student information: None.
Who can see it: The workspace's owners, and our team for billing support.
How long: Kept for tax and accounting after an account is deleted, without the link to the deleted workspace or person. No automatic deletion date yet.

Printed orders (optional)

What we store: The recipient's name, shipping address and the print files for an order a teacher places.
Student information: Only if a teacher prints a design that contains student names.
Who can see it: Our team and the print partner making that order.
How long: The order record is kept for tax and accounting; the recipient's name and address and the design name are removed when the workspace is deleted.

Teacher verification

What we store: The result only: verified or not, the method (school email, invite from a school admin, a reviewed document, or a school purchase order), the date and when it expires (12 months). For a school email, the address and a one-way hash of the 6-digit code (the code expires after 15 minutes). For a document: the file, with hidden details such as location, camera and author removed on upload.
Student information: None.
Who can see it: The teacher sees their own status. Only our verification team can open a document, through a link that lasts 5 minutes.
How long: Documents are deleted 30 days after our decision. The result is kept while the account exists and is deleted with it. A log of verification events (no document contents) is kept to prevent abuse.

Cookies and browser storage

We use the browser's own storage to keep people signed in, remember preferences, count visits with a random ID and remember which website first brought someone to us (for 90 days). There is one first-party cookie, which remembers whether the app's sidebar is open. We don't use advertising cookies, third-party analytics or tracking scripts.

What we never do

Never: sell data
We don't sell or rent personal information, and we don't share it for cross-context advertising.
Never: show ads to students
There are no ads in Educated Designer, and no advertising cookies or third-party trackers.
Never: train ai on student work
We don't use teacher or student content to train AI models.
Never: require student emails
Students don't need accounts or email addresses. They only see what a teacher prints or chooses to share.
Never: build profiles of students
Student information a teacher adds is used only to provide the service, never for profiling or marketing.
Never: share without a reason
We share information only with the service providers listed below, and only what each needs to do its job.

AI use

AI is optional. Ready-made teaching kits, classroom templates, and the maths, vocabulary and notes kit makers don't use AI at all.
When a teacher uses an AI feature, the request text is sent to Google's Gemini models through Lovable's AI gateway to produce the result. For design suggestions, the workspace name, website and brand colours are sent too; phone numbers, email addresses and the street address are replaced with placeholders first and filled back in on our server.
Our policy is no student personal information in AI requests. Before a custom teaching kit request is sent, email addresses, phone numbers and long ID-like numbers are removed, and requests that look like they name students or list a class are refused.
The help chat is an AI assistant. What someone types there is sent to the AI provider to answer and is saved so our team can follow up.
We don't use content to train AI models. How the AI provider may use requests is set by its business terms; if your review needs them, ask us. We keep a log of each AI call (feature, model, token counts), not the request text.
A teaching kit made with AI can be reused, at no cost, by another teacher who asks for the same grade, subject and topic. Only the lesson request and content are reused, never who asked or which school.
AI can make mistakes. Teachers should review AI-made lesson content before using it with a class.

Service providers (subprocessors)

Companies that process data for us to run the service, what they receive and when. We share only what each needs.

Service providers
Provider	What for	Data it receives	When
Lovable (Lovable Cloud)	Website hosting, database, file storage and sign-in (built on Supabase), service emails, error logs, and the gateway for AI requests.	All account and workspace data described on this page.	Always.
Supabase	The database, file storage and authentication platform underneath Lovable Cloud.	All account and workspace data described on this page.	Always.
Google (Gemini models)	AI features and the help chat, reached through Lovable's AI gateway.	The text of an AI request (scrubbed for teaching kits); for AI photo edits, the scaled-down photo.	Only when someone uses an AI feature or the help chat.
Google (sign-in)	"Continue with Google" sign-in.	Name and email address from the Google account.	Only if a teacher chooses Google sign-in.
Stripe	Subscription payments, one-time purchases and refunds.	Payer name, email and card details (entered directly with Stripe).	Only when someone pays.
MaxMind	Estimating a visitor's city and region from their IP address.	The IP address, for a single lookup. We never store it.	Once per visit, when the hosting edge hasn't already provided a location.
Print partners: Gelato, Printful, Prodigi	Printing and shipping physical products.	Recipient name, shipping address and print files for that order.	Only when a teacher orders prints.
Google Fonts and jsDelivr	Delivering fonts and some code libraries (for example the PDF tools) to the browser.	Standard web request details such as the IP address, as with any website.	When pages or tools that use them load.
Free photo libraries (Pixabay, Pexels, Openverse, NASA and museum collections)	Searching free photos in the editor.	The search words. Some searches go straight from the browser, so the library sees the visitor's IP address.	Only when someone searches for photos.

Data is stored with our hosting provider, Lovable Cloud, which runs on Supabase. If your review needs the hosting region, ask us and we'll confirm it in writing. We'll update this list before adding a provider that receives school data.

Retention and deletion

Teachers can delete designs, uploads, teaching kits and share links at any time. Turning off a share link stops it working straight away.
Any account holder can delete their account themselves in Settings → Your data (type DELETE to confirm). It happens straight away, not after a waiting period.
If others use a workspace you're the only owner of, you choose: make one of them the owner (the workspace stays), or delete it for everyone.
A paid plan on a workspace being deleted is cancelled immediately, so it isn't charged again.
An account can't be deleted while any payment is pending: an unpaid or open invoice (including a school purchase-order invoice), a paid plan whose payment is past due, unpaid or incomplete, a checkout for printed copies, a download or AI credits started in the last 24 hours, a designer-marketplace order that is pending or disputed, an open marketplace dispute, or an amount owed to the marketplace. The delete screen lists what's pending, with a link to pay or to contact support.
Printed orders that are still being made or shipped also stop deletion until they arrive.
A workspace with any designer-marketplace purchases or sales is deleted with a person's help, because buyers' licences and designer payouts depend on those records. Contact support@educateddesigner.com.
Our team uses the same rules when deleting an account on request. Going ahead despite a pending payment needs a written reason, which is kept in our deletion audit log.
Request counts used for abuse protection are deleted after about two days. Live "who's online" records are cleared after a day.
Visit statistics and AI usage logs don't contain names or email addresses. They don't have an automatic deletion date yet.

"Delete my account" removes

Your sign-in account and every signed-in session.
Each workspace you're the only member of, with its designs, uploaded files, catalogs, products, customers, orders, invoices, teaching kits, brand kits, comments and saved "Make many" set-ups.
Your help chat and contact form messages, and our replies to them.
Your membership of other workspaces. Their content stays with the team; your name is removed from comments and from "created by" records.
The link between you and AI usage logs, visit statistics and download records.

What we keep

Payment records (subscription invoices, one-time purchases, AI credit purchases, print orders and partner commissions), for tax and accounting. They lose their link to the deleted workspace and person; print orders also lose the recipient's name and address and the design name. There's no automatic deletion date for these yet.
Copies in our hosting provider's backups aren't removed straight away. Ask us how long backups are kept.

Security

The measures that are in place today. We don't hold security certifications or third-party audits.

Encryption in transit: the site and every connection to our database and providers use HTTPS (TLS).
Row-level security in the database: each workspace's designs, kits and comments can only be read by members of that workspace. Sensitive tables can't be read from the browser at all and are reached only through server code.
Private file storage: uploaded images and print files are in private storage and shown through short-lived signed links.
Admin access is limited to a single team account and requires two-step verification (an authenticator code) on every admin session.
Two-step verification with an authenticator app is available to every account and is required for everyone in a school workspace, after a grace period with reminders. School workspace pages and their server actions need a session that has entered the code. One-time backup codes are stored only as salted hashes.
Rate limits on public forms, AI features, data downloads, account deletion and other costly endpoints, keyed by a salted hash of the IP address so IP addresses aren't stored.
Passwords are stored only as secure hashes by the authentication platform. Card details stay with Stripe.
View-only share links use long random tokens and can be turned off at any time.
Account deletions are recorded in a server-only log with the date, counts and a one-way hash, never names or email addresses.

Accessibility

Public pages use real headings, labelled buttons and form fields, keyboard-reachable controls, and respect the "reduce motion" setting.
The design editor is a visual canvas, which is harder to use with a screen reader. Ready-made kits and templates can be downloaded as PDFs and images for use in other tools.
We haven't completed a formal accessibility audit. If something gets in your way, tell us and we'll help and fix it.

Our student privacy pledge

These are Educated Designer's own commitments to schools, teachers and families. They are our promises, not membership of an outside program.

1We collect only what we need to run the service for teachers and schools.
2We use student information only to provide the service a school or teacher asked for.
3We never sell student information or use it for advertising, including targeted advertising.
4We never build profiles of students.
5We never use student information or student work to train AI models.
6We don't require students to create accounts or give an email address.
7Teachers can download or delete their data themselves at any time, from Settings.
8We tell schools clearly what we collect, why, and who our service providers are, and update this page when that changes.
9We keep the security measures listed on this page in place.

FERPA and COPPA

Educated Designer is designed with FERPA and COPPA in mind. Here is what that means in practice:

Students under 18 don't create accounts, and we don't knowingly collect personal information directly from children under 13.
Student information a teacher adds is used only to provide the service: never for advertising, profiling or selling, and never to train AI models.
The school and its teachers decide what student information, if any, goes into the service, and can delete it at any time.
We don't have a standard data processing agreement yet. Schools that need one can contact support@educateddesigner.com.

How to download or delete data

Download: in Settings → Your data, choose "Download my data". You get a ZIP with your account, your own records and the full content of workspaces you own. Uploaded files are included, or listed with links valid for 24 hours when there are too many.
Delete: in Settings → Your data, choose "Delete my account" and type DELETE. See "Retention and deletion" above for exactly what is removed and kept.
Can't sign in, or need help for a whole school? Email support@educateddesigner.com with the school or district and the account email. A person will help.

A privacy question for our team

Goes straight to our support inbox. We reply by email.

Questions from schools

Do students need accounts or email addresses?

No. Accounts are for adults (18 or older). Students don't sign up, and Educated Designer never asks for student emails.

Is student work used to train AI?

No. We don't use teacher or student content to train AI models.

Which AI provider do you use?

Google's Gemini models, reached through Lovable's AI gateway. AI is optional, and our policy is no student personal information in AI requests.

Do you have a data processing agreement (DPA)?

Not yet. Schools that need one can contact support@educateddesigner.com.

Do you have a FERPA or COPPA certification or seal?

No. We don't hold any FERPA or COPPA certification, seal or audit, and we don't claim to. Educated Designer is designed with both laws in mind, and this page lists exactly what we do.

How do we delete our data?

Each teacher can delete their account in Settings → Your data. It happens straight away and removes workspaces they're the only member of, once nothing is left to pay (open invoices, including school purchase-order invoices, or a past-due plan must be settled first). Payment records are kept for tax, without personal details.

Can we get a copy of our data?

Yes. In Settings → Your data, "Download my data" gives a ZIP of the account and the full content of workspaces the person owns.

Where is data stored?

With our hosting provider, Lovable Cloud, which runs on Supabase. Ask us if you need the hosting region for a review.

Contact

Privacy and security questions, or help downloading or deleting data: support@educateddesigner.com. Educated Designer is operated by Mangalam Distribution LLC, 2900 Adams St, Unit C-38, Riverside, CA 92504, USA.

Also see the privacy policy, the terms of service and the short For schools & IT overview.