Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, phone number (optional), school or district affiliation, and role (Teacher, Lead, Admin, or Vendor). If you sign in via Google OAuth, we receive your name, email address, and profile picture from Google.

Platform Activity

We collect data about your use of the Service, including learning progress (project and coaching step completions), credit balances and transaction history, classbox order history and status, and administrative actions you perform within your role.

File Uploads

You may upload files to the Service, such as profile avatars and documents. These files are stored on our behalf using S3-compatible cloud storage.

Device & Usage Data

We automatically collect basic technical information when you access the Service, including your IP address, browser type, operating system, and pages visited. This data is used for security, troubleshooting, and service improvement.

2. How We Use Your Information

We use the information we collect to:

• Operate and maintain the Service, including account management, credit transactions, and order fulfillment
• Send transactional notifications such as order confirmations, return reminders, password resets, and account updates
• Provide reporting to school and district administrators about platform usage and progress within their organization
• Ensure security and prevent fraud, including monitoring for unauthorized access and credit system abuse
• Improve the Service based on usage patterns and feedback

We do not use your data for advertising or sell it to third parties.

3. Information Sharing

We share your information only in the following circumstances:

Within Your Organization

Leads and Admins within your school or district can view relevant information about teachers in their organization, including activity, credit usage, and order history. This role-based access is a core feature of the platform.

Vendors

When you place a classbox order, relevant order and shipping details (school name, shipping address) are shared with the vendor fulfilling the order.

Service Providers

We use third-party services to operate the platform:

• Google OAuth: For optional single sign-on authentication
• AWS Simple Email Service (SES): For sending transactional emails (password resets, order notifications)
• S3-Compatible Storage: For secure file storage (uploads, documents)

These providers process data on our behalf and are bound by their own privacy and security obligations.

Legal Requirements

We may disclose your information if required by law, subpoena, or legal process, or if we believe disclosure is necessary to protect the rights, property, or safety of Betabox, Inc., our users, or the public.

We do not sell your personal information to third parties.

4. Cookies & Tracking

The Service uses a session cookie (“authjs.session-token”) to maintain your authenticated session. This cookie is essential for the Service to function and cannot be disabled while using the platform.

We do not use advertising cookies, analytics tracking cookies, or third-party tracking pixels. We do not engage in cross-site tracking.

5. Data Security

We implement industry-standard security measures to protect your data:

• Passwords are hashed using bcrypt and never stored in plain text
• All data is transmitted over HTTPS (TLS encryption)
• Session cookies are configured with HttpOnly and Secure flags to prevent client-side access
• Role-based access controls (RBAC) ensure users can only access data appropriate to their role
• Administrative actions are logged for audit and compliance purposes

While we take reasonable precautions to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

6. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Service. When an account is deleted, we perform a soft-delete that removes your data from active use while retaining it for a reasonable period to comply with legal obligations, resolve disputes, and enforce our agreements.

Audit logs and transaction records may be retained for a longer period as required for compliance, reporting, and legal purposes.

7. Children's Privacy

Classbox is a business-to-business platform designed for use by teachers, school administrators, and education professionals. It is not intended for direct use by students or children under the age of 13.

We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately so we can delete it.

As the Service is used in K-12 school settings, we are mindful of the Family Educational Rights and Privacy Act (FERPA). The platform does not collect student records or personally identifiable information about students. Data collected relates solely to educators and administrators using the Service.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request that we correct inaccurate or incomplete information
• Deletion: Request that we delete your personal information, subject to legal retention requirements
• Portability: Request a copy of your data in a structured, machine-readable format

To exercise any of these rights, please contact us at privacy@classbox.com. We will respond to your request within 30 days.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to the address associated with your account or through a notice on the Service. The “Last updated” date at the top of this page reflects when the policy was most recently revised.

10. Contact

If you have questions about this Privacy Policy or our data practices, please contact us at privacy@classbox.com.

Betabox, Inc.
Raleigh, NC