Privacy Policy

• Account data: name, email, role, organization, password hash.
• Uploaded materials: lesson plans, slides, assessments, curriculum maps, and any text you submit for audit.
• Usage data: audit history, settings, billing tier, log events, device and browser metadata.
• Payment data: processed by our payment provider (Stripe). We do not store card numbers.

• To run audits, generate findings, and surface revisions.
• To operate, secure, and improve the platform.
• To provide customer support and respond to inquiries.
• To send transactional emails (account, billing, audit completion).
• To meet legal, tax, and compliance obligations.

You can exercise most rights yourself from inside the app:

• Access / export: view your materials, audits, and account info from the dashboard. To receive a portable copy (JSON) of your personal data, email privacy@exceluplab.com.
• Correction: update your name and profile in Settings. For corrections we cannot make in-app, contact us.
• Deletion: delete individual materials and audits from the app, or permanently delete your entire account from Settings → Danger Zone (this also cancels any active subscription).
• Restriction / objection: ask us to pause specific processing while we evaluate a request.
• Withdraw consent: where processing is based on consent, you can withdraw it at any time without affecting prior lawful processing.

We respond to verified requests within 30 days (extendable by 60 days for complex cases under GDPR, or up to 45+45 days under CCPA). We may need to verify your identity by confirming control of your account email before acting. Requests are free for the first one in any 12-month period; we may charge a reasonable fee for manifestly excessive or repetitive requests.

If you are in the European Economic Area, the United Kingdom, or Switzerland, ExcelUp Lab LLC is the data controller for personal data submitted directly by individual users. For school and district plans, the institution is the controller and ExcelUp Lab acts as processor under a Data Processing Agreement.

Legal bases we rely on:

• Contract (Art. 6(1)(b)) — to deliver the Service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — security, abuse prevention, fraud detection, product improvement, and metering. You can object at any time.
• Legal obligation (Art. 6(1)(c)) — tax, accounting, and lawful requests.
• Consent (Art. 6(1)(a)) — where required, e.g., certain optional communications.

You have the rights set out in Section 9 above (access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal effect — TrustEd Nav does not make such decisions; outputs are advisory and require human review). You also have the right to lodge a complaint with your local supervisory authority.

International transfers: Personal data is processed in the United States. Where required, we rely on the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, or equivalent safeguards. A copy of relevant transfer mechanisms is available on request.

EU/UK representative: if we are required to designate one, contact details will be published here. Until then, please direct inquiries to privacy@exceluplab.com.

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the CPRA:

• Right to know the categories and specific pieces of personal information we collect, the sources, the business or commercial purpose, and the categories of third parties with whom we share it.
• Right to delete personal information we have collected, subject to legal exceptions (e.g., to complete a transaction, comply with law, or defend legal claims — see Section 9d).
• Right to correct inaccurate personal information.
• Right to limit use of sensitive personal information to what is reasonably necessary to deliver the Service.
• Right to opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising as those terms are defined under the CPRA.
• Right to non-discrimination for exercising your rights.

Categories collected in the past 12 months: identifiers (name, email, account ID), commercial information (subscription tier, billing history via Stripe), internet/network activity (log events, IP, user agent), professional information (role, organization), and user-submitted content (uploaded instructional materials). We do not knowingly collect biometric, geolocation (precise), or genetic data.

To exercise rights, email privacy@exceluplab.com with the subject "CCPA Request." Authorized agents may submit requests with written, signed permission. We will verify your identity before responding.

The Children's Online Privacy Protection Act (COPPA) regulates collection of personal information from children under 13. TrustEd Nav is not directed to children. Accounts are intended for educators, coaches, and administrators aged 18+, and the Service is designed to review instructional materials, not student records.

You must not upload personally identifiable student information — including student names, photos, IDs, grades, IEPs, behavior records, or any content that identifies a specific minor. If you upload student work, redact identifying information first.

Where a school or district directs teachers to use TrustEd Nav with content that incidentally references students, the school is responsible for obtaining any required parental consent under COPPA's school-authorization exception, and ExcelUp Lab will act only on the school's documented instructions as a service provider.

If we learn we have collected personal information from a child under 13 without verified parental or school consent, we will delete it promptly. To report such collection, email privacy@exceluplab.com.

When you delete your account from Settings → Danger Zone, we permanently delete your profile, uploaded materials, audits, revisions, comments, share links, and notification preferences from active systems. Active subscriptions are canceled in Stripe. Deletion is irreversible.

Some data is retained after account deletion when we have a legal basis or obligation to keep it (GDPR Art. 17(3); CCPA §1798.105(d)):

• Billing & tax records — invoices, payment records, and Stripe transaction IDs are retained for up to 7 years as required by tax and accounting law. Stripe is the system of record.
• Security & abuse logs — IP addresses, request metadata, and audit-trail entries tied to suspected abuse, fraud, or ToS violations are retained for up to 2 years in tamper-evident form.
• Copyright / DMCA records — see Section 9e below.
• Backups — encrypted backups are rotated on a rolling schedule and may contain residual copies of deleted data for up to 35 days before being overwritten.
• Aggregate / de-identified data — statistics that cannot reasonably be re-identified to you may be retained indefinitely.
• Legal holds — data subject to a preservation request, subpoena, or active dispute is retained until the matter is resolved.

If a DMCA takedown notice, counter-notice, or copyright dispute is filed concerning content you uploaded — even after you delete your account — the law and our DMCA policy require us to keep certain records:

• The DMCA notice and any counter-notice (including the submitter's name, address, and sworn statements) are retained for at least 3 years as part of our safe-harbor compliance record under 17 U.S.C. § 512.
• Account identifiers (email, user ID, IP, upload timestamps) associated with the disputed content are retained for the same period to enforce our repeat-infringer policy and to respond to legal process.
• The disputed content itself, if subject to a takedown, is removed or disabled. A hash or minimal reference may be retained so we can prevent re-upload during the dispute window.
• If a counter-notice is filed and the original claimant does not sue within 10–14 business days, content may be restored only if the account still exists. A deleted account cannot be restored; the counter-notice record is preserved but the content stays down.
• If we receive a valid subpoena, court order, or law-enforcement request tied to a deleted account, we will produce the records we are legally required to retain.

In short: deleting your account stops future processing and removes your content from the live Service, but it does not erase records we are legally required to keep to defend copyright claims, comply with tax law, or respond to lawful process.