Privacy Policy

Last Updated: January 6, 2026
Effective Date: January 6, 2026

1. Introduction

Welcome to String (formerly STEAM Hub), a Digital Learning Environment (DLE) and AI-driven educational platform operated by STEAM Hub Software Corp, a Delaware Corporation ("Company", "we", "us", or "our").

We respect your privacy and are committed to protecting the personal information of our users—specifically the schools, teachers, and students who use our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access our website (String.education) and our SaaS application (the "Service").

CRITICAL NOTE FOR SCHOOLS & PARENTS:

String acts as a "School Official" under FERPA (Family Educational Rights and Privacy Act). We process Student Data solely for educational purposes at the direction of the School/District. We do not sell Student Data.

2. Information We Collect

We collect information in three categories: Visitor Data, Student/School Data, and Third-Party Integrations.

A. Visitor & Account Data (Marketing & Admin)

  • Who: Site visitors, School Administrators, Teachers signing up.
  • Data: Name, email address, job title, school name, billing information, IP address.
  • Purpose: To schedule demos, process payments, and manage school accounts.

B. Student Data (Educational Records)

  • Who: Students using the platform (rostered by the School).
  • Data:
    • Identifiable Info: Name, email (usually school-issued), grade level, class enrollment.
    • Performance Data: Grades, assignment submissions, quiz results.
    • AI Behavioral Data: Interaction logs, learning patterns, time-on-task, and "Learning DNA" insights generated by our algorithms.
  • Purpose: Strictly to provide the educational service, generate learning insights, and assist teachers.

C. Third-Party Sign-In (Google)

  • Google Login: If you choose to register or log in using your Google Workspace for Education account ("Google Log In"), we collect your name, email address, language preference, and profile picture directly from Google.
  • Limited Use: Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use Artificial Intelligence (AI)

String utilizes proprietary AI and machine learning algorithms to analyze learning patterns and generate "Learning DNA" profiles.

  • No Public Training: We DO NOT use personally identifiable Student Data to train open/public AI models (like ChatGPT).
  • Internal Improvement: We may use de-identified and anonymized data to refine our internal algorithms and improve the accuracy of our educational insights.
  • AI Accuracy: While we strive for precision, AI-generated insights (such as "Learning DNA") are probabilistic estimates. They should be used to support—not replace—professional educator judgment.

4. How We Share Your Data

We do NOT sell, rent, or trade Student Data to third parties. We only share data in the following strict circumstances:

  • Service Providers (Sub-processors): We use trusted third-party vendors to help run our infrastructure. They are contractually bound to protect data and typically include:
    • Cloud Hosting: [e.g., AWS / Google Cloud]
    • AI Processing: [e.g., OpenAI API - Note: We utilize enterprise agreements where data is not used for model training]
    • Analytics: [e.g., PostHog / Google Analytics (Website only)]
  • Legal Compliance: If required by law (e.g., a subpoena), we may disclose information to law enforcement.
  • Business Transfers: If String is acquired, the successor company will continue to be bound by the terms of this Privacy Policy regarding Student Data.

5. Compliance with Education Laws

United States (FERPA & COPPA)

  • FERPA (Family Educational Rights and Privacy Act): We comply with FERPA. We access Student Data only as a "School Official" with a "legitimate educational interest" in the student's education.
  • COPPA (Children Under 13):
    • Authorized Collection: We knowingly collect personal information from children under the age of 13 only for the use and benefit of the School.
    • School Consent: We rely on the School to provide consent for the collection of this information on behalf of the parent, as permitted by COPPA.
    • Strict Usage: This data is used solely for educational purposes and is never used for commercial purposes unrelated to education (such as behavioral advertising).
  • SOPIPA (California): We do not engage in targeted advertising to students or create profiles of students for non-educational purposes.

General Data Protection Regulation (GDPR) - For International Users

If you are accessing the Services from the EEA or UK:

  • Data Controller: The School/District is the Data Controller.
  • Data Processor: String is the Data Processor.
  • International Transfer: Your data is processed in the United States. We utilize Standard Contractual Clauses (SCCs) or the Data Privacy Framework to ensure compliant transfers.

6. Data Retention & Deletion

  • Active Accounts: We retain Student Data for as long as the School's subscription is active.
  • Termination: Upon contract termination, we will delete or de-identify Student Data within [e.g., 60 days] of the termination date, or upon the School's specific written request.
  • Backups: Encrypted backups may exist for an additional [e.g., 30 days] before being overwritten in our standard cycle.

7. Security

We implement industry-standard security measures to protect your data, including:

  • Encryption: Data is encrypted in transit (TLS/SSL) and at rest (AES-256).
  • Access Controls: Only authorized employees with a specific need (e.g., support engineers) can access database records, and all access is logged.
  • Vulnerability Testing: We perform regular security audits of our code and infrastructure.

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

8. Your Rights (Parents & Eligible Students)

Since String acts as a processor for the School:

  • Access & Correction: Parents or eligible students wishing to review, correct, or delete their data should contact their School administration directly. We will assist the School in fulfilling these requests within a reasonable timeframe.
  • Stop Usage: Schools may request that we stop processing their data by cancelling their subscription.

9. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

STEAM Hub Software Corp (dba String)

Attention: Privacy Officer

Address: 301 Congress Ave, Austin, TX 78701

Email: legal@String.education (or help@String.education)