Privacy Policy
Lit-Levels is committed to protecting student privacy and is designed to support schools' FERPA-related responsibilities.
Last Updated: October 11, 2026
Privacy at a Glance
What We Collect
- • Student usernames and grade levels
- • Reading performance data
- • Adventure progress and achievements
- • Student photos: upload currently disabled
How We Protect It
- • Data handling designed with FERPA in mind
- • Role-based access control
- • Encrypted data transmission
- • Secure AWS S3 storage
Who Has Access
- • Students: Own data only
- • Teachers: Their students only
- • Parents: Their child's data only
- • Admins: School-wide data
Your Rights
- • Request data access
- • Request data deletion
- • Opt out of photo features
- • Control data sharing
1. Introduction
Welcome to Lit-Levels, an AI-powered K-12 reading intervention platform operated by ERM-Educational Services ("we," "our," or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard student information when you use our educational platform.
Commitment to Student Privacy: We are committed to protecting the privacy of students. Lit-Levels uses privacy and access practices designed with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and applicable state student privacy laws in mind. Lit-Levels does not claim third-party certifications as its own, and schools remain responsible for evaluating their own legal and policy requirements.
By using Lit-Levels, schools, teachers, parents, and students agree to the terms outlined in this Privacy Policy.
2. Information We Collect
2.1 Student Information
We collect the following information about students:
- Account Data: Student name (as provided by the school), username or school-issued login, grade level, character selection, preferred pronouns (optional), state location
- Academic Data: Reading performance metrics (Lexile scores, accuracy rates, time-on-task), adventure progress, question responses, vocabulary interactions
- Engagement Data: Achievement badges earned, reading streaks, house points, floor completion rates
- Optional Data: Student photos (new uploads currently disabled; see Section 6.2), annotation notes, personal story preferences
Important: We do NOT collect student home addresses, phone numbers, or Social Security numbers. Schools may provide a student's name and a school-issued username or login so teachers can identify their students; we use this information only to provide the service. We do not require student personal email addresses.
2.2 Teacher Information
- Name, email address, school affiliation
- Class roster data (student names and usernames linked to teacher accounts)
- Teaching preferences (state standards selection, grading settings)
- Usage analytics (dashboard views, report generation)
2.3 Parent Information
- Name, email address (for account access)
- Photo permission flags recorded with previously uploaded photos (photo upload is currently disabled)
- Communication notes from teachers
2.4 Administrator Information
- Name, email address, role designation
- School/district information
- Admin action logs (for audit trail compliance)
2.5 Technical Information
- IP addresses (for security and rate limiting)
- Browser type and version
- Device information (for responsive design optimization)
- Session cookies (for authentication only)
- Page-performance measurements collected by our hosting network (see Section 10)
3. How We Use Information
We use the information we collect for the following educational purposes:
- Personalized Learning: Generate adaptive reading passages aligned to student grade level, state standards, and performance history
- Progress Tracking: Calculate Lexile scores, track skill mastery, identify struggling areas
- Teacher Support: Provide class analytics, intervention recommendations, AI-powered coaching plans
- Parent Engagement: Share progress reports, family missions, and teacher communications
- Platform Improvement: Analyze aggregated, de-identified data to improve content quality and user experience
- Security: Detect and prevent unauthorized access, fraud, or abuse
- Compliance: Maintain audit logs for FERPA and administrative oversight
Educational Purpose Only: We do NOT use student data for marketing, advertising, or any non-educational commercial purposes.
4. Data Sharing and Disclosure
4.1 Within Your School/District
Student data is shared with:
- The student's assigned teacher(s)
- School administrators (for oversight and reporting)
- Parents/guardians (via Parent Portal)
4.2 Service Providers and Technology
We use a limited set of service providers to operate Lit-Levels, and we share only the information needed to deliver the service:
- AWS (Amazon Web Services): Private cloud file storage (S3) for files used by the service, such as cached read-aloud audio, staff-uploaded documents, and a small number of student photos uploaded before photo upload was disabled
- Abacus.AI: The hosting environment for the application and its database; AI services (story generation, answer feedback, recommendations, and drafting), which receive the text needed for the task, such as passage and question text, a student's answer, and in some features the student's first name; and delivery of some notification emails (recipient email address and message content)
- Cloudflare: Network delivery and security for our hosting environment, and the page-performance measurement described in Section 10. Receives standard connection information such as IP address, browser type, and the page address requested
- Resend: Email delivery. Used when Lit-Levels sends an account, invitation, password-reset, or notification email. Receives the recipient's email address, the message content, and delivery information (such as whether the message was delivered). Required for these emails to be sent.
- Microsoft (read-aloud voice): Text-to-speech for the optional read-aloud accessibility feature. Used only when a user chooses to have text read aloud. Receives the text being read aloud (for example, passage or question text, which in personalized stories can include the student's first name) so it can be returned as audio. Optional.
- Google Fonts: Font files loaded only when a certificate is opened for printing. Google receives standard connection information (such as IP address and browser type); no student data is sent.
- Google Drive (encrypted backups): Stores encrypted copies of our database backups in a private, owner-only folder. The files are encrypted before upload and the encryption key is not stored with them.
- Hugging Face (AI avatar): AI image processing for the optional photo-based AI avatar feature. This feature is currently unavailable because student photo upload is disabled (see Section 6.2); no photos are sent to this provider while upload is disabled.
Our application database uses PostgreSQL, an open-source database technology operated within our hosting environment. It is a technology we use, not a separate recipient of student data.
- We do not permit service providers to sell student data or use it for advertising
- Where applicable and mutually agreed, Lit-Levels may enter into appropriate data protection agreements with schools or organizations
4.3 Legal Compliance
We may disclose student information if required by law, such as:
- In response to valid subpoenas or court orders
- To protect the safety of students or others
- To comply with FERPA audit requirements
4.4 What We Do NOT Do
- ✓ We do NOT sell student data to third parties
- ✓ We do NOT share data with advertisers or marketers
- ✓ We do NOT use student data to build marketing profiles
- ✓ We do NOT display targeted ads to students
5. Data Security
We implement industry-standard security measures to protect student data:
- Encryption: All data transmission uses HTTPS/TLS encryption. Passwords are hashed using bcrypt.
- Access Controls: Role-based permissions ensure users can only access appropriate data (teachers see their students, parents see their children, etc.)
- Authentication: Secure session-based authentication with NextAuth.js
- Rate Limiting: Protection against brute-force attacks on login and signup endpoints
- Audit Logging: Administrative actions are logged for compliance and security monitoring
- Regular Updates: We maintain current security patches and monitor for vulnerabilities
- Secure Storage: Student photos stored in AWS S3 with private access controls
Note: While we implement robust security measures, no system is 100% secure. We continuously monitor and improve our security practices.
6. Student Rights and Parental Consent
6.1 FERPA Rights
Under FERPA, parents and eligible students (18+) have the right to:
- Inspect and review student education records
- Request correction of inaccurate or misleading data
- Control disclosure of personally identifiable information
- File a complaint with the U.S. Department of Education
6.2 Student Photos
Student photo upload is currently disabled:
- Students cannot upload new photos; the upload feature is turned off in the app and refused by our servers
- A verified parent/guardian consent workflow has not yet been implemented; photo upload will not be re-enabled until one exists
- A small number of photos uploaded before this change are retained in private storage and are not shared externally
- Cartoon avatars are generated within Lit-Levels; no student name or identifier is sent to an outside avatar service
- Parents, guardians, or schools may request removal of a previously uploaded photo by emailing [email protected]
6.3 Data Access Requests
To request access to or deletion of student data, contact your school administrator or email us at [email protected].
6.4 Account Deletion
When a student account is deleted:
- Personally identifiable information associated with the account is removed
- Academic data may be retained in de-identified, aggregated form for research
- Photos are deleted from AWS S3 storage
- Deletion timing is coordinated with the requesting school or family
- Copies in encrypted backups are not restored for use and expire on the backup schedule in Section 7
7. Data Retention
- Active Accounts: Data is retained while the student account is active or as directed by the school
- Deletion Requests: Student data is deleted upon a verified request from the school or a parent/guardian
- End of a School Agreement: Student data is returned or deleted as set out in the school's agreement or as the school directs
- Administrative and Security Logs: Retained as needed for security, audit, and operations. Audit records of who accessed or changed student data are kept so schools can review that activity
- Backups: Database backups are encrypted. Daily backups are replaced on a rolling basis, and weekly off-site copies are kept for about eight weeks before they are deleted. Data deleted from the service may therefore remain in encrypted backups for up to about eight weeks; backups are used only to restore the service after a failure
- De-identified Data: Aggregated, de-identified data may be retained for research and platform improvement
We are finalizing a detailed retention schedule for each type of record. Until it is published, a school's written agreement sets specific retention and deletion terms, and schools may request deletion at any time. Contact [email protected] with questions.
8. COPPA Considerations (Children Under 13)
For students under 13 years old:
- Schools act as the parent's agent in providing consent for educational use
- We collect only information necessary for educational purposes
- Parents can review their child's data via the Parent Portal
- Parents can request deletion of their child's account at any time
- We do not require students to provide more information than necessary to use the platform
9. State-Specific Privacy Laws
Our practices are designed with state student-privacy laws in mind, including:
- California: SOPIPA (Student Online Personal Information Protection Act)
- New York: Education Law § 2-d
- Georgia: Student Data Privacy, Accessibility, and Transparency Act
- Other States: We work to comply with applicable state-specific student privacy requirements where we operate
If your state has specific student data privacy requirements, please contact us at [email protected].
10. Cookies and Tracking Technologies
Cookies We Use:
- Authentication Cookies: NextAuth.js session cookies (required for login)
- Preference Cookies: Theme settings (dark mode), dashboard preferences
We Do NOT Use:
- ✓ Third-party advertising cookies
- ✓ Behavioral tracking cookies
- ✓ Social media tracking pixels
Hosting Network Page Measurement:
Our hosting network, Cloudflare, adds a small page-performance script (Cloudflare Web Analytics) to our pages. It measures how quickly pages load and records the page address, the referring page, and browser type. It does not set cookies or use local storage, and Cloudflare states that it does not track individuals across sites or build profiles. Cloudflare uses the IP address only to estimate the visitor's country. This script is added by the hosting network, not by Lit-Levels code, and the measurements are not used for advertising.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes:
- Where practicable, we will notify schools via email at least 30 days in advance; shorter notice may be given only where needed to comply with law, address a security issue, prevent fraud or abuse, or provide urgent operational protection
- We will update the "Last Updated" date at the top of this policy
- We will provide a summary of key changes
- Continued use of the platform after notification constitutes acceptance of the updated policy
12. Contact Information
For questions, concerns, or requests regarding this Privacy Policy or student data:
Privacy Officer
Email: [email protected]
Compliance Team
Email: [email protected]
Mailing Address:
ERM-Educational Services
10632 Claude Freeman Drive
Charlotte, NC 28262
For faster handling of privacy requests, email [email protected].
Response Time: We aim to respond to all privacy inquiries within 10 business days.
13. Additional Resources
For more information about student privacy laws:
- FERPA: U.S. Department of Education - Family Educational Rights and Privacy Act
- COPPA: Federal Trade Commission - Children's Online Privacy Protection Act
- Student Privacy Pledge: Future of Privacy Forum
Questions About Privacy?
We're here to help. Contact our Privacy Team for any questions about how we protect student data.