Privacy Policy

1. Who We Are

IEPvocate is operated by IEPvocate LLC ("IEPvocate," "we," "our," or "us"), a New Jersey limited liability company. We provide an AI-powered tool to help parents of children with disabilities understand their child's Individualized Education Program (IEP) and communicate more effectively with their child's school team.

You can reach us at any time at privacy@iepvocate.com.

2. Information We Collect

2.1 Information you provide directly

• Email address — collected when you create a subscription account or use our magic-link sign-in system.
• IEP document content (temporary, never stored) — when you upload your child's IEP PDF, the document is transmitted to our AI processing system for analysis. The document is processed in real time and immediately discarded — we do not store, retain, or save the PDF or its raw content anywhere on our servers. The full document, including anything it contains (such as your child's name, diagnoses, and school), is sent to our AI provider once, for this first read — see Section 4.1. That first read produces a short summary of your child's needs (disabilities and diagnoses, services, goals, accommodations, strengths, and challenges). We automatically remove your child's name, the school and district names, dates of birth, ID numbers, other people's names, and contact details from that summary, and every later step — your report, each premium tool, chat, and translation — works from the summary instead of the document. Because IEPs vary, we can't guarantee that every mention is caught, but the summary is built to leave them out. Your child's first name is returned to your own browser so your report can use it; it stays in that browser tab and is not sent to our AI provider again.
• Text you type into our tools — for example, chat questions, the goal you describe for an advocacy letter, or extra details for a template. Like IEP content, this is sent to our AI provider to generate your response and is not stored on our servers. Anything you type is sent as written, so if you include your child's name or other details, those are sent too.
• Payment information — collected and processed directly by Stripe, our payment processor. IEPvocate never sees or stores your credit card number.
• US state/location — you may optionally provide your state when uploading an IEP so we can include location-relevant resources in your report. This is not linked to your identity and is not stored after the session ends.

2.2 Information collected automatically

• IP address — collected for rate limiting and abuse prevention. We store request counts keyed by IP address in our database for up to 30 days, and your IP address may also appear in server logs retained by our hosting provider (Vercel) for up to 14 days.
• Usage data — we track how many times per month a subscriber uses AI generation features (e.g., generating questions, advocacy letters) to enforce monthly usage quotas. This is stored as a monthly count linked to your account email address. It records how many generations you used, not what you generated.

2.3 Information we do NOT collect

• We do not extract, store, or keep your child's name, date of birth, or school name from the IEP. (These details are in the document you upload, so they do reach our AI provider during processing — see Section 4.1.)
• We do not use cookies for advertising or tracking.
• We do not build behavioral profiles or sell data to data brokers.
• We do not use third-party analytics (Google Analytics, Meta Pixel, etc.).

3. How We Use Your Information

4. AI Processing & Third-Party Service Providers

IEPvocate uses trusted service providers to operate. When you upload an IEP and use our features, your data is processed by these companies on our behalf. They are contractually prohibited from using your data for their own purposes.

4.1 Anthropic (AI Processing)

Your IEP document is transmitted to Anthropic's API once, for the first read described in Section 1. After that, to generate your resource guide, meeting-prep questions, advocacy letters, and other AI-powered features, we send Anthropic only the summary from that first read (with your child's name, school, date of birth, ID numbers, and contact details removed) plus anything you type into a tool. IEPvocate does not store this content; it is discarded on our servers immediately after processing (see Section 2.1 above). Under Anthropic's commercial API terms, your data is not used to train Anthropic's models. Anthropic automatically deletes API inputs and outputs within 30 days. It may keep them longer only in limited cases described in its policy, such as when the law requires it or when its automated safety systems flag a request for review (up to 2 years). Zero Data Retention, an optional arrangement where Anthropic keeps nothing after responding, is not in place for this account. See Anthropic's commercial data retention policy for details.

4.2 Supabase (Database)

Supabase stores your email address, subscription status, and account information in a PostgreSQL database hosted in the United States. Supabase is SOC 2 Type II certified.

4.3 Stripe (Payments)

Stripe processes all payments. Stripe receives your email address and payment card details. IEPvocate never sees or stores your payment card information. See Stripe's Privacy Policy.

4.4 Resend (Email Delivery)

Resend delivers our emails — magic-link sign-in emails, account notices, and occasional marketing emails. Your email address and the email content are transmitted to Resend solely to deliver those emails.

4.5 Vercel (Hosting)

Vercel hosts IEPvocate's web application and serverless functions in the United States. Vercel may retain server access logs (including IP addresses) for up to 14 days.

5. Your Child's Information

IEPvocate is a tool for parents and legal guardians, not for children. We do not knowingly collect personal information directly from children under 13. When you upload your child's IEP, you are acting as their parent or legal guardian and authorizing the processing of their educational records for your own use.

IEP documents are FERPA-protected education records. As the parent of a minor child, you have the right under FERPA to access, inspect, and share those records. By uploading an IEP to IEPvocate, you are exercising that right on your own behalf. IEPvocate is not an educational institution and is not subject to FERPA obligations; those obligations rest with your child's school.

We process IEP content solely to provide the service you requested. We do not retain the document, create profiles of your child, or use your child's information for any other purpose.

6. Data Retention

7. Your Rights

Depending on where you live, you may have the following rights with respect to your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request that we correct inaccurate information.
• Deletion: Request that we delete your personal information (subject to legal retention requirements).
• Opt-out of marketing: Unsubscribe from any marketing email at any time using the "Unsubscribe" link at the bottom of the email, or by emailing us.
• California residents (CCPA): You have the right to know, delete, and opt-out of the sale of personal information. IEPvocate does not sell personal information.
• New Jersey residents (NJ DPA): You have the right to access, correct, delete, and opt out of profiling. IEPvocate does not engage in profiling.
• Washington, Nevada, and Connecticut residents (consumer health data): Information in your child's IEP, such as disability classifications and diagnoses, may be "consumer health data" under your state's law. See our Consumer Health Data Privacy Policy for how we handle it and how to exercise your rights.
• EU/UK residents (GDPR): You have the right to access, rectification, erasure, restriction, portability, and to object to processing. Note that IEPvocate is a US-based service. If you are an EU or UK resident using this service, you are doing so under US data protection standards.

To exercise any of these rights, email us at privacy@iepvocate.com. We will respond within 30 days.

7.1 How to request deletion — two paths

Self-service (immediate): If you're a signed-in subscriber, visit /delete-account and confirm. Your email, subscription record, and usage history are deleted immediately, and any active subscription is cancelled at the same time so you are not billed again — this is the same code path as the email request below, just without the wait.

By email (up to 30 days): Email hello@iepvocate.com with subject Delete My Account, from the email address on the account. We verify the request matches an existing account, cancel any active subscription, delete the account, magic-link, and usage-history rows, and confirm back to you by email — within 30 days, though in practice same-day is typical. One-time (single-report) purchases have no persistent account to delete; nothing beyond a Stripe payment record exists for those.

Do Not Sell/Share requests follow a separate, faster path — see Do Not Sell or Share My Info (10 business days).

8. Data Security

We take reasonable technical measures to protect your information, including:

• All data transmitted between your browser and our servers is encrypted via HTTPS/TLS.
• Session cookies are HttpOnly, Secure, and HMAC-signed — they cannot be read by JavaScript and cannot be forged.
• Database access requires server-side authentication; no direct public database access is permitted.
• Payment processing is fully delegated to Stripe, a PCI-DSS Level 1 certified provider.

No system is 100% secure. If you discover a security vulnerability, please report it responsibly to privacy@iepvocate.com.

9. Cookies and Session Storage

IEPvocate uses two functional cookies. Neither is used for advertising, and we do not use third-party cookies or tracking pixels. (Browsers may show the session cookie with a __Host- prefix, a security setting.)

• iep_session — keeps signed-in subscribers logged in across browser sessions. Set only if you sign in or complete a purchase.
• iep_anon — a random identifier (no personal information) set for every visitor who uses the free IEP analysis tool, used solely to prevent automated abuse of that feature by limiting how many analyses can run from one browser per day. It does not track you across other websites, is not linked to your identity, and cannot be read by JavaScript.

We use your browser's sessionStorage to temporarily hold your IEP analysis results during your session. This data is stored locally in your browser and cleared when you close the browser tab.

If you use the Journal, Checklist, or Goals tools, those notes are saved in your browser's localStorage so they are still there next time you visit. They stay on your device only — they are never sent to our servers — and remain until you delete them or clear your browser's site data.

10. Children's Privacy

IEPvocate is intended for use by parents and legal guardians (adults). We do not knowingly collect personal information directly from children under 13. The IEP documents you upload may contain information about your minor child; this information is processed on your behalf as their parent or legal guardian and is not used to build a profile of your child.

If you believe a child under 13 has directly submitted personal information to us without parental consent, please contact us at privacy@iepvocate.com and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of IEPvocate after changes are posted constitutes your acceptance of the updated policy.

12. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy, please contact us:

IEPvocate LLC
Email: privacy@iepvocate.com
Location: New Jersey, United States