Privacy Policy
Effective date: July 27, 2026 · Last updated: July 27, 2026
This Privacy Policy explains how Novastone AI LLC ("Novastone," "we," "us," or "our") collects, uses, and protects information when you use the PlanZero service at lessonplanningforteachers.com (the "Service"). PlanZero is an AI-assisted lesson planning tool for K-12 educators built on a zero-data retention architecture.
1. Information We Collect
1.1 Account Information
- Email address (used for sign-in, account recovery, and essential service notices)
- Password (stored only as a cryptographic hash by our authentication provider; we never see or store your actual password)
- If you sign in with Google or Microsoft: your name, email address, and basic profile identifier as returned by that provider
1.2 Payment Information
Payments are processed entirely by Stripe, Inc. We never see, collect, or store your card number, bank details, or billing address. We receive from Stripe only a customer identifier, subscription status, and transaction confirmation.
1.3 Usage Counts
To enforce plan limits (for example, weekly free-tier limits), we store a simple numeric count of how many lesson plans your account has generated in the current period. These counts contain no content, no timestamps beyond a period start date, and no information about what you planned.
1.4 Technical Information
Like most web services, our hosting and infrastructure providers (Vercel, Supabase) may temporarily process standard technical data such as IP addresses, browser type, and request logs for security, abuse prevention, and operational purposes. We do not use this data for advertising or profiling.
2. Information We Do NOT Collect
The Service is architecturally designed so that the following never touches our database:
- Lesson plans and generated content. Plans are generated in response to your request, transmitted to your browser, and exist only in your browser session. They are never written to our servers’ storage.
- Your prompts and inputs. The standards, topics, and notes you type are used transiently to generate your plan and are then discarded.
- Student data. We do not request, require, or store student names, identifiers, education records, IEP details, or any student personally identifiable information. The Service is designed to function fully without any student data.
- Advertising or behavioral tracking data. We do not run advertising trackers, third-party analytics profiles, or cross-site tracking pixels.
3. How Lesson Generation Works (Transient Processing)
When you request a lesson plan, your input (state, grade, subject, standard, topic, and optional classroom notes) is sent over an encrypted connection to our large language model subprocessor (currently Fireworks AI) solely to generate the response. Under our configuration and their API terms, inputs are not used to train models and are not retained by the provider beyond transient processing and short-lived abuse-prevention logs. The generated plan is returned to your browser and is discarded on our side. Closing or refreshing your browser tab permanently destroys the session copy.
4. How We Use Information
We use the limited information we hold only to:
- Authenticate you and maintain your account
- Process subscriptions and enforce plan limits
- Send essential service communications (receipts, security and account notices, material changes to these policies)
- Prevent fraud, abuse, and security incidents
- Comply with legal obligations
We do not sell personal information. We do not rent personal information. We do not use personal information for targeted advertising. We do not build advertising or behavioral profiles of teachers or students.
5. Student Privacy: FERPA, COPPA, and State Laws
5.1 FERPA
The Family Educational Rights and Privacy Act (20 U.S.C. § 1232g) governs how schools share education records with vendors. The Service is designed so that schools and teachers can use it without disclosing any FERPA-protected records to us: we do not request, receive, or store education records or student personally identifiable information. If a user nevertheless includes student-identifying information in an input, that information is processed transiently as described in Section 3 and is not retained. Districts may request our standard Data Processing Addendum at legal@lessonplanningforteachers.com.
5.2 COPPA
The Service is directed to educators, not children. Only adults may create accounts, students never log in, and children never interact with the AI system. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at privacy@lessonplanningforteachers.com and we will delete it.
5.3 State student privacy laws
Our practices align with state student privacy statutes modeled on SOPIPA (including California SOPIPA, New York Education Law § 2-d, and similar laws): no sale of student data, no targeted advertising, no non-educational profiling, and no retention of student information. Because the Service retains no student data at all, most obligations these laws impose on vendors are satisfied by architecture rather than by policy alone.
6. Third-Party Service Providers (Subprocessors)
| Provider | Role | Data they handle |
|---|---|---|
| Supabase, Inc. | Authentication and database hosting | Account email, hashed credentials, usage counts, entitlement records |
| Stripe, Inc. | Payment processing | Payment details (collected directly by Stripe); we receive status only |
| Fireworks AI | AI model inference | Lesson request inputs, processed transiently; not used for model training |
| Vercel, Inc. | Application hosting | Standard technical request data |
| Google LLC / Microsoft Corp. | Optional sign-in providers | Basic profile information you authorize during sign-in |
We may also disclose information if required by law, regulation, or valid legal process, or to protect the rights, safety, and security of the Service and its users.
7. Cookies
We use only strictly necessary cookies: authentication session cookies that keep you signed in. We do not use advertising cookies, analytics trackers, or third-party marketing pixels.
8. Data Retention
| Data | Retention |
|---|---|
| Lesson plans, prompts, generated content | Never stored. Destroyed when your browser session ends. |
| Account information (email, hashed password) | Until you delete your account. |
| Usage counts | Rolling periods only; purged within 14 days of period end. |
| Subscription and entitlement records | Duration of subscription plus the period required by tax and accounting law. |
9. Your Rights and Choices
Depending on your jurisdiction (including under GDPR, UK GDPR, CCPA/CPRA, and similar laws), you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Because we hold so little data, most requests are simple:
- Access or export: email us and we will provide your account record within 30 days.
- Correction: update your email through your authentication provider or contact us.
- Deletion: email privacy@lessonplanningforteachers.com to delete your account. Deletion removes your email, credentials, usage counts, and entitlement records (subject to legally required financial record keeping).
We do not sell or share personal information for cross-context behavioral advertising, so no opt-out of sale is necessary. California residents: we have not sold personal information in the preceding 12 months.
10. Security
We use encryption in transit (TLS), hashed credential storage, row-level security on our database, and least-privilege access controls. Our primary security control, however, is architectural: sensitive content is never stored, so it cannot be breached. No method of transmission or storage is 100% secure, but we have minimized what exists to attack.
11. International Users
The Service is operated from the United States and is intended for US educators. If you access it from elsewhere, you understand that your limited account information will be processed in the United States.
12. Changes to This Policy
If we make material changes, we will notify you by email or a prominent notice in the Service at least 14 days before the change takes effect. We will never retroactively weaken the zero-data retention commitment for content generated before a policy change.
13. Contact
Novastone AI LLC
Email: privacy@lessonplanningforteachers.com
Website: lessonplanningforteachers.com
For district procurement and Data Processing Addendum requests: legal@lessonplanningforteachers.com