Proposed policy · Not published. New protections describe requirements for launch, not controls verified as operating. Complete the legal and operational review before use.
How Gracevine handles information about students, parents, and website visitors. Our program serves U.S. residents aged 14 and older.
In plain language
Gracevine is for U.S. residents aged 14 and older. We use your answers and practice history to help plan your learning. Your instructor and the verified parent connected to your enrollment can see your work and progress as explained below. Parents and students have separate accounts that remain connected as part of the program. Ask us if you want to see, correct, or delete your information. Avoid sharing private details in class or AI chats when they are not needed.
1. Who we are and what this policy covers
Gracevine Schools LLC operates Gracevine from Austin, Texas, United States. We are responsible for the personal information described here. This policy covers our website, inquiries, consultations, enrollment applications, family accounts, and the learning services we make available.
Contact info@gracevineschools.org with privacy questions. Our full business mailing address and any additional legally required contact details will appear in the final notice before publication. This notice does not cover employment applications or a separate school-sponsored service unless that service expressly uses it.
2. Information we collect and where it comes from
Contact and application information: names, email addresses, phone numbers, parent or guardian relationship, grade level, test preferences, planned test dates, test history and scores, and preparation goals. We request the age and residence information needed to confirm eligibility and apply the relevant privacy rules.
Learning information: answers, assignments, practice-exam results, completion history, time taken, hints used, study-plan recommendations, and communications with instructors or any enabled AI study assistant.
Account and transaction information: sign-in and verification records, account roles, enrollment status, payment status and transaction references. Payment providers handle payment details through their own payment flow.
Live participation and technical information: names shown in sessions, voice or video you choose to share, chat or shared materials, browser or device details, IP addresses, request logs, and identifiers needed for accounts and security.
Sources include you, an authorized parent or student, instructors, your activity in our services, and providers supporting those services. Required fields are identified in the relevant form; optional information is your choice. Without essential contact or enrollment information, we may be unable to provide the requested service.
Please do not send government identity numbers, payment-card details, medical records, or other unnecessary sensitive information in ordinary forms or AI chats. If you need an accommodation, contact us first so we can explain what information is needed and how to provide it.
3. Why we use information
We use information to answer questions, schedule consultations, assess and manage applications, verify contact details, communicate decisions, administer enrollment and payments, teach students, tailor practice, provide authorized progress updates, and maintain account security. Application and inquiry contact permissions concern those requests; they are not blanket marketing consent.
Optional marketing, optional tracking, and unrelated new uses of information require appropriate notice and any permission required by applicable law.
4. Who can receive information
Authorized Gracevine staff and instructors receive information needed to review applications, teach, provide support, or administer the program. The verified parent connected to an enrollment can see the student’s work, learning progress and instructor updates as part of the program, as explained below.
The planned service uses Supabase for application storage and authentication; Google Workspace for email; Google Calendar for booking; and Square for payment processing. Hosting, live-class, and AI providers must be identified in the final provider notice before the relevant feature is enabled. We limit provider access to the role they perform and require appropriate privacy and security safeguards. Providers may separately control information they process for their own lawful purposes, such as payment-fraud prevention.
Information shared in a live cohort session can be seen or heard by other participants. This is different from access to a student’s private application or account.
We may disclose limited information to meet a legal requirement, investigate misuse, protect people or legal rights, or obtain professional advice. A business reorganization would not remove applicable privacy obligations; any new use requiring notice or permission must follow that process.
5. Minimum age
Gracevine’s student services are for students aged 14 and older. Students aged 13 or younger cannot enroll, create a student account, or use our learning services, even with parental permission. We do not knowingly collect personal information online from children under 14.
We request only the age information needed to apply this rule before enabling student access. A parent may contact us using their own details about future eligibility, but should not submit an ineligible child’s application or unnecessary personal information about that child.
If we learn that we have collected personal information online from a child under 14, we stop the affected collection, disable the child’s access, and promptly delete the information unless a narrow legal exception requires a different response. Contact info@gracevineschools.org if you believe this has happened. The age check and deletion process must be implemented before student access is enabled.
6. Connected parent and student accounts
Students and parents use separate accounts. The verified parent or guardian connected to an enrollment has access to that student’s work, learning progress and instructor updates. This family connection is part of the program; there is no optional sharing switch, and turning 18 does not automatically disconnect the accounts. We explain this access during enrollment and before student workspace activation.
Account access is limited to the verified enrollment relationship. A payment, an unverified claim to be a parent, or knowledge of a student’s email does not grant access. Passwords and sign-in credentials remain separate. Additional guardians and incorrect relationships require Gracevine’s review.
Optional progress emails can be turned off without changing parent dashboard access. Contact us to correct an account relationship or exercise applicable privacy rights. Nothing in this program policy overrides a legal restriction, court order, or privacy right that cannot lawfully be waived. Existing accepted agreements are not silently replaced by a website update.
7. Adaptive practice and AI-assisted learning
Practice responses, timing, hints, and history help estimate which concepts need attention and when to revisit them. These are learning recommendations, not medical or psychological diagnoses. Students can ask an instructor to explain or reconsider a recommendation. Enrollment decisions are reviewed by our team; an adaptive practice score does not by itself decide admission.
If an AI assistant is enabled, its prompts, responses, and relevant learning context may be processed by the identified AI provider. Before activation, the feature notice must explain which data is sent, who can review conversations, how long it is retained, and whether any additional permission is needed for a child. We do not describe conversations as confidential from all adults when authorized staff or family members can review them.
Joining Gracevine does not grant permission to use identifiable student conversations or coursework for unrelated advertising or a provider’s general-purpose model training. Any proposed additional use requires a separate assessment and any required notice and permission. Do not put private information about yourself or another person into an AI conversation when it is unnecessary for the question.
8. Live sessions, community, and student stories
In a live class or office-hours session, information you share—such as your displayed name, voice, video, chat, or work—may be visible to the instructor and other participants. Share only what is appropriate for that setting. We do not authorize participants to record, publish, or redistribute another student’s information or course content.
Class recordings are not included in the program. Any separate recording, transcription, or optional media feature requires a clear notice and any necessary permission before it is enabled. Enrollment does not grant permission to publish a student’s name, image, voice, testimonial, or identifiable success story for marketing; a separate release is required.
9. Cookies, marketing, and advertising choices
Account and security tools may use cookies or similar browser storage. Browser controls can remove or block storage, although doing so may affect sign-in and other requested features. The final cookie notice will identify the tools actually deployed, their purposes, providers, and durations.
Optional analytics, advertising, or embedded tools must be assessed before use and presented with the controls required in the visitor’s location. Where prior consent is required, optional tools must remain off until permission is given. Children’s services must not rely on an adult marketing-site consent setting.
Our proposed student-data rule is no sale of student personal information and no use of it for targeted advertising. This rule must be reflected in provider contracts and configuration before launch. Any marketing messages a person separately requests must include an appropriate way to unsubscribe; essential service messages are handled separately.
10. Retention and deletion
Unsubmitted application drafts are scheduled to expire seven days after creation. The periods for submitted applications, learning records, AI conversations, inquiries, consent evidence, security logs, payment records, and backups must be stated in the final retention schedule before publication.
Retention must be tied to a specific purpose: responding to a request, providing the program, addressing a documented dispute or security issue, or meeting an identified legal obligation. A general desire to keep records is not an unlimited retention period. When information is no longer needed, it must be deleted or irreversibly anonymized, including through the relevant provider processes.
Withdrawal of consent or a deletion request triggers a review of the affected records, linked providers, and any narrowly applicable retention exception. Information discovered to have been collected online from an ineligible child under 14 follows the prompt-response process above; an indefinite-storage default must not override it.
11. Privacy requests, rights, and appeals
Contact info@gracevineschools.org to ask what information we hold, correct it, request access or deletion, or change a privacy choice. Tell us whether the request concerns you or a child you are authorized to represent. We may verify identity and authority using proportionate information; do not send identity documents in an ordinary email unless a secure process has been specifically arranged.
Depending on applicable state law, rights may also include receiving a portable copy, opting out of qualifying sale, sharing, targeted advertising or significant automated decisions, and using an authorized agent. You may withdraw a permission you previously gave, subject to any lawful recordkeeping requirements. We do not retaliate for exercising an applicable right. Some requests have exceptions, such as necessary legal recordkeeping or another person’s rights.
We respond within applicable legal time limits and explain permitted extensions or a refusal. If you disagree with a decision, reply with “Privacy appeal” and explain why you want it reconsidered. We provide any applicable appeal outcome and regulator-complaint route. You may also contact the relevant privacy authority directly, such as your state attorney general, where appropriate.
12. U.S. service and data processing
Gracevine’s program is offered only to U.S. residents. We do not accept enrollment for students residing outside the United States.
This enrollment limit does not mean that every service provider stores or processes information only in the United States. The final provider notice must accurately describe the processing locations and safeguards used by the services we select.
13. Security and concerns
We use safeguards appropriate to the information and service, including controlled account access and verification measures. No online service can promise complete security. Provider access, incident handling, and the protection of children’s information must be covered by our security procedures.
Contact info@gracevineschools.org promptly if you believe information was exposed or an account relationship is wrong. Do not include passwords or unnecessary sensitive details. If a security incident requires notice to affected people or authorities, we provide that notice as required by applicable law.
14. Changes and contact
We display the effective date of the published policy. For material changes, we provide the additional notice and any renewed permission required, including direct notice to parents when their existing consent no longer covers a child’s data use. Continued use alone does not replace legally required consent.
Privacy contact: info@gracevineschools.org
Operator: Gracevine Schools LLC
Location: Austin, TX 78731, United States
Full mailing address: pending confirmation
Effective date: pending publication approval
