Privacy Policy

1. Privacy by Design Framework

Labyrinth AI processes educational student records and proprietary corporate scientific research. Safeguarding this information is a core requirement of our system architecture. We implement a "Privacy by Design" framework, ensuring that data protection controls are built directly into our database schemas, backend API routes, and cloud storage buckets from the start.

Labyrinth AI complies with major international data privacy standards, including:

• FERPA (Family Educational Rights and Privacy Act): Safeguards student education records, restricting data collection to necessary classroom utilities.
• GDPR (General Data Protection Regulation): Grants users the right to erasure ("right to be forgotten"), access portability, and requires consent for non-essential telemetry.
• CCPA / CPRA (California Consumer Privacy Act): Provides California residents with specific opt-out controls, fully supported via our interactive Privacy Preference Center.

2. Multi-Tier Data Classification

To apply appropriate security controls, Labyrinth classifies all user-generated data into three distinct tiers:

3. Data Retention & Erasure Protocols

We retain data only as long as necessary to provide a high-quality educational experience:

• Active Account Policy: Scientific and profile records are kept active as long as the user's account remains active (logging in at least once every 12 months) or maintains a paid billing subscription.
• Telemetry Anonymization Pipeline: Granular, user-linked telemetry logs are kept for a maximum of 90 days. After 90 days, a database cron job aggregates raw logs into day-based count metrics and deletes the detailed user-linked event rows.
• Account Erasure Pipeline: When a user requests account deletion, the system purges all trace of their identity and data within 72 hours. All user-related tables (saved sessions, usage tracking, subscriptions) feature database-level foreign keys declared with ON DELETE CASCADE referencing the primary user profiles, guaranteeing a clean and absolute delete.

4. AI Orchestration & Processing

Our platform utilizes Large Language Models (LLMs) to power the Labyrinth AI science mentor. Prompt processing is subject to strict data security controls:

• Data Processing Agreements: Prompts sent to third-party AI orchestrators (e.g. OpenAI, Google Gemini) are processed strictly under enterprise-grade DPAs.
• Zero Training Guarantee: Our AI providers are contractually prohibited from using your prompts, questions, or simulation state to train their public models.
• No Automated Decisions: We do not use AI orchestration to make automated decisions that produce legal or significant effects on your student records or academic status.

5. 3D Model Security & Metadata Scrubbing

When researchers or educators upload custom 3D models (GLTF/GLB formats) for private simulations, the assets are stored in secure Supabase Storage buckets:

• Access Control Lists (ACLs): Storage folders are private by default. Access tokens are generated on demand and are valid only for the duration of an active user session.
• Exif & Metadata Scrubbing: During the upload phase, our backend processes incoming binary models, stripping out author details, system paths, creation timestamps, and geographic metadata. This scrubbing prevents the accidental disclosure of developer identities or proprietary network structures before the files are saved.

6. Institutional Data Management Overrides

For accounts governed by Enterprise tier contracts (such as school districts or university departments), a custom Data Processing Agreement (DPA) overrides default retention settings:

• Academic Term Purging: School administrators can trigger a full student record wipe at the end of each academic semester.
• Direct Export Controls: Institutional admins can download complete user archives in structured CSV/JSON formats for local compliance tracking before initiating erasure processes.

7. Children's Online Privacy Protection Act (COPPA)

Labyrinth AI complies with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information from children under the age of 13 without verifiable parental consent or appropriate institutional authorization from the school district or educational institution. When a school district acts as the agent for the parent, Labyrinth AI collects only the minimal required educational identifiers (email, name) to deliver the interactive 3D science simulations. We do not use child accounts for behavioral tracking, profiling, or direct marketing. Parents can contact us at [email protected] to review their child's collected information, request deletions, or prohibit further data collection.

8. Family Educational Rights and Privacy Act (FERPA)

Labyrinth AI strictly adheres to the Family Educational Rights and Privacy Act (FERPA). For school accounts, we operate under the control of the educational institution as a "School Official" with a legitimate educational interest. All student data constitutes educational records and is safeguarded under row-level database security. We strictly restrict accessing student records to authorized educational personnel, do not share student data with third parties except under secure Data Processing Agreements (DPAs) for system operations, and never monetize student personal information.

9. Educational Data Processing Agreements (DPA)

We provide a standard Data Processing Agreement (DPA) to school districts and educational entities to align our data handling practices with federal and regional privacy laws (including California SOPIPA, New York Ed Law 2-d, and Illinois SOPPA). The DPA covers exact data inventory, subprocessor disclosures, student records protection, and verified end-of-term student data destruction. Districts can execute a DPA by writing to [email protected].

10. Contact Information

If you have any questions regarding this Privacy Policy or wish to exercise your rights under GDPR/CCPA, please contact our Data Protection Officer at:

Email: [email protected]

Last Updated: June 2026