Privacy Policy

Effective June 2026 · Working draft pending legal review · Governing law: the State of Minnesota, United States

This policy explains what JadeOS ("Jade OS", "we") collects when you use Jade OS Labs, why, and the rights you have. Schools acting as our customer should also read our Data Processing Addendum (DPA).

1 · Who we are

Jade OS Labs is an interactive, browser-based learning platform operated by Oliver T. Cummins, sole proprietor doing business as (d/b/a) JADEOS, located at 13804 52nd Avenue North, Plymouth, Minnesota 55446, United States ("Jade OS", "we"). This policy is governed by the laws of the State of Minnesota, United States. For students enrolled through a school, the school is the data controller and JadeOS acts as the data processor on the school's instructions (see the DPA). For individuals who sign up directly, JadeOS is the controller for the data needed to run your account.

2 · What we collect

Account: your name, email, and a securely hashed password. We never see or store your actual password.
Learning records: lab progress, module completion, quiz/mastery scores, and certificates — so your work is saved and resumable.
AI tutor conversations: messages you exchange with in-lab AI instructors (e.g. Ask Jade), retained on a 90-day rolling basis unless you save them.
Payments: processed entirely by Stripe. We store order status and amount only — never card numbers.
Technical: a login session token stored in your browser, and basic security logs (IP, timestamps) kept 24 hours to 30 days.

3 · Legal bases (GDPR / UK GDPR)

We process personal data on these bases: contract (to provide the labs you signed up for), legitimate interests (platform security, preventing abuse), legal obligation (tax/accounting records), and consent (for direct family sign-ups of children, and any optional communications). You may withdraw consent at any time.

4 · How we use it

Only to run the platform: save your progress, personalise instruction, issue certificates, process purchases, and keep accounts secure. We do not sell personal data. Ever. We do not use student data for third-party advertising, and we do not include identifying details in AI prompts beyond what a lab task requires.

5 · Who processes data on our behalf (subprocessors)

AI providers (Anthropic, OpenAI, Google) — generate in-lab instructor responses from lab content.
Stripe — payment processing.
MongoDB (managed hosting) — encrypted database storage.
Resend — transactional email (receipts, certificates, notifications).
Emergent object storage — durable media (e.g. uploaded demo/recording assets), where applicable.

A current subprocessor list is available on request. Schools are notified of material changes under the DPA.

6 · International transfers

Our subprocessors may process data outside your country (including the United States). Where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses. Specific transfer mechanisms are confirmed in the DPA. [Transfer mechanism detail to be finalised by counsel.]

7 · How long we keep it

Account & learning records: while active, then 12 months after last activity, then deleted or anonymised (or per your school's instruction).
Login sessions: auto-purged after expiry. Security logs: 24 hours to 30 days.
AI tutor conversations: 90-day rolling window. Any uploaded photos are processed in memory and not retained unless you save them.
Payment records: retained as required by tax law (typically up to 7 years) — status and amount only.

8 · Your rights

You (or, for a child, their guardian) can access and export your data, correct it, restrict or object to certain processing, and permanently delete your account and records. Email shearperfection369@gmail.com and we aim to respond within 30 days. EU/UK residents have rights under the GDPR/UK GDPR and may complain to a supervisory authority; California residents have rights under the CCPA/CPRA; US students' education records are handled in the spirit of FERPA (see the DPA for school-controlled records).

9 · Children (COPPA)

For students under 13, accounts are created either under a school's authority via roster codes, or through a family path requiring a parent/guardian's verifiable consent. For children we collect only what a lab needs (first name, guardian email, learning progress). We never show advertising to children, never sell their data, and a guardian may review, export, or delete their child's data at any time.

10 · Security

Encryption in transit (HTTPS) and at rest, hashed passwords, role-based access (students never see other students' data), brute-force protection, and access logging. If a breach affects your data, we will notify you promptly and, for children, their guardian, as required by law.

11 · Cookies & local storage

We use only what's needed to run the app — chiefly a login session token in your browser's local storage. We do not use third-party advertising or cross-site tracking cookies.

12 · Changes & contact

We may update this policy; material changes will be announced in-app. Questions or requests: shearperfection369@gmail.com.

© JadeOS · Jade OS Labs, operated by Oliver T. Cummins, sole proprietor doing business as (d/b/a) JADEOS. This policy is a working draft prepared for legal review and is not legal advice. Have your counsel confirm the final terms before publication.