School and Vendor Privacy Summary
Updated September 24, 2026
This summary helps schools evaluate Latin Launchpad as an online educational tool. It describes the current product and is not a FERPA certification, district approval, or substitute for a signed data privacy agreement.
Latin Launchpad is presently a direct-use educational website. It does not yet provide district administration, rosters, single sign-on, teacher access controls, or a standard district data-processing agreement. A school should not treat the service as operating under FERPA's school-official exception without completing its own review and any required agreement.
Educational purpose
The service provides Latin vocabulary, grammar, phrase, culture, quiz, printable, and progress-tracking activities for grades 3–8. Student information is used to provide authentication, save progress, personalize learning, support users, secure the service, and maintain its operation.
Data inventory
| Context | Data handled | Location and purpose |
|---|---|---|
| Guest learning | Nickname or first name, grade, progress, scores, mastered words, badges | Stored in that browser for local personalization and progress |
| Synced account | Email, optional learner name, grade, progress, scores, mastered words, badges | Supabase authentication and database for account access and progress sync |
| Support | Name, email, subject, message | Netlify function processing, Resend email delivery, and operator support records |
| Technical operation | IP address, browser/device details, timestamps, request and security logs | Service delivery, security, troubleshooting, and internal operations |
| Optional analytics | Page views, approximate location derived from IP address, browser/device details, timestamps | Google Analytics only after an adult opts in; no learner identity or learning records are sent |
Data practices
- No sale of student personal information.
- No third-party advertising or behavioral advertising.
- No public student profiles, messaging, social feed, location feature, camera, or microphone access.
- No use of student information to build an unrelated commercial profile.
- Collection is limited to information used for learning, authentication, support, security, and operation.
Service providers
- Netlify: website hosting, delivery, contact-form processing, and request logs.
- Resend: delivery of contact-form messages to the operator.
- Supabase: optional account authentication and synced learning records. The browser library is a pinned copy hosted with this site and loaded only when account features are used.
- Google Analytics: optional adult-approved usage measurement with advertising storage, ad personalization, and Google Signals disabled.
A school should review these providers and any applicable contractual terms as part of its vendor assessment.
Access, correction, and deletion
An account holder, parent, or authorizing school may request a description of maintained information, review or correction, deletion, or an end to further collection through the contact form. Requests should identify the account email and the requester's authority. Identity and authority may be verified before records are disclosed or changed.
Retention
Guest records remain on the device until browser storage is cleared. Synced account information is retained while needed to provide and protect the account and should be deleted when no longer reasonably necessary for its educational or operational purpose. A district agreement should define any required deletion schedule, end-of-contract return or deletion process, and legally required exceptions.
Security
The site uses HTTPS, restricted browser security headers, Supabase authentication, and database row-level access policies described in the project's deployment configuration. No system can guarantee absolute security. Before district adoption, the school should request and assess the applicable hosting and authentication security materials and agree on incident-notification contacts and timelines.
FERPA review points
If a school discloses education-record information under FERPA's school-official exception, the school must determine that the service performs an institutional function, remains under the school's direct control regarding use and maintenance of education-record PII, operates consistently with the school's annual FERPA notice, and does not re-disclose or use the data for unauthorized purposes.
Latin Launchpad will not represent itself as a school official or FERPA-compliant vendor for a district merely because a teacher uses the public site. Those obligations must be established through the district's approval process and, where required, a written agreement.
COPPA and school authorization
For learners under 13, a school may authorize collection only within the educational context and for the school's benefit, not for unrelated commercial purposes. The current public service does not have a verified school-authorization workflow and does not permit synced accounts for children under 13. Those students may use guest mode. Any future school-managed synced accounts require prior district review, an appropriate agreement, and an authorization process reasonably designed to verify that the school is providing authorization. The operator remains responsible for its own COPPA obligations.
District diligence checklist
- Confirm the service is approved by district administration and IT.
- Determine whether student use will involve education-record PII.
- Review provider contracts, security terms, and applicable state student-privacy law.
- Define authorized data, purpose, retention, deletion, incident notice, and re-disclosure restrictions.
- Provide any required parent notices and preserve parent/student access rights.
- Prefer guest mode when a synced account is not necessary.
Review contact
Schools may send vendor questionnaires or agreement requests through the contact form.