Privacy Policy

Last updated: September 2, 2026

This Privacy Policy explains how Parlay Vision Consulting LLC, doing business as Cedarboard (“Cedarboard,” “we,” “us”), collects, uses, discloses, and protects personal information in connection with the Cedarboard website and applications (the “Service”). It forms part of our Terms of Service. For the purposes of the EU/UK GDPR, Cedarboard is the controller of the personal information described here.

1. Personal information we collect

• Identifiers and account data — your name, email address, and a cryptographically hashed password. We never store your password in readable form.
• Professional profile data — the grade levels and subjects you teach, your standards framework, and, if you choose to create one, an anonymous class profile consisting of aggregate counts of learning supports and English-proficiency groups, and the home languages spoken in your class. This feature is designed so that it cannot identify an individual student.
• Content you create or submit — prompts, topics, lessons, worksheets, quizzes, slide decks, substitute packets, folder names, saved Knowledge Hub explainers, and any material you paste or upload.
• Absence and coverage data — absence dates, class names, notes, the recipient email addresses you enter (including a school coverage contact you choose to save), and event records of when a packet was delivered, first opened, accepted, returned, or cancelled, including any reason selected. Where a substitute voluntarily provides a name and email address when accepting, we store them so we can notify them of changes.
• Device and notification data — if you enable push notifications, the push endpoint and cryptographic keys your browser issues for that device, and your per-event notification preferences.
• Commercial and transaction data — your plan, trial status, subscription state, and the customer and subscription identifiers issued by our payment processor. We do not receive or store full payment card numbers.
• Usage data — counts and timestamps of billable actions such as generations and substitute packets, used to apply plan limits.
• Technical and log data — IP address, browser and device characteristics, and request logs generated automatically by our hosting provider for security, abuse prevention, and reliability.
• Connected accounts — if you choose to connect your Google account for exports, the Google account identifier and the access tokens Google issues, stored encrypted. We request only the narrow permission that lets us create files for you — we cannot see your existing Google files — and disconnecting in Settings revokes our access at Google.
• Waitlist data — if you join the pre-launch waitlist, your email address and a record of which link or post brought you to us. We use it only to email you about the launch (and at most an occasional preview), and you can ask us to remove it at any time.
• How you found us — the first link that brings you to the Service may carry a source tag (for example, that it came from a particular post), which we keep with your signup so we know which of our announcements worked. It records a source, not your browsing.
• Communications — the content of messages you send us for support.

2. Where the information comes from

Directly from you; automatically from your browser or device when you use the Service; and from our payment processor (subscription status only). We do not purchase personal information, and we do not enrich your data from data brokers.

3. Why we use it, and our legal bases

Where the GDPR or UK GDPR applies, we rely on the legal bases indicated:

• To provide the Service — create and maintain your Account, generate and store materials, deliver packets and alerts to the recipients you designate. Performance of a contract.
• To process payments and manage subscriptions. Performance of a contract; compliance with legal obligation (tax and accounting records).
• To send push and email notifications you have enabled. Performance of a contract; consent where consent is required for a given channel.
• To secure the Service, prevent abuse, enforce limits, and debug. Legitimate interests in operating a secure and reliable service.
• To improve the Service using aggregated or de-identified usage patterns. Legitimate interests.
• To respond to your support requests. Performance of a contract; legitimate interests.
• To comply with law and to establish or defend legal claims. Legal obligation; legitimate interests.

We do not use your content to train generative AI models, and we do not use your personal information, your content, or anything about your students for advertising or profiling. The one advertising-related tool we use is a measurement pixel on our public marketing pages, described in Sections 4 and 13; it never runs inside the Service.

4. We do not sell your personal information; one measurement pixel may count as “sharing”

We do not sell personal information. We do not process your Account information, your content, or anything about your students for targeted advertising, and we do not process personal information for decisions producing legal or similarly significant effects.

Advertising measurement on our public pages. To learn whether the ads we run reach teachers, our public marketing pages (the home page, the feature pages, and the waitlist sign-up and thank-you pages) load the Meta Pixel, an advertising measurement tool provided by Meta Platforms, Inc. It records that a browser viewed one of those pages and, on the thank-you page, that a waitlist sign-up was completed. It sets a cookie and sends Meta the page address, your IP address, and browser information; Meta may combine that with information it holds about you under its own privacy policy. It never runs inside the Service — not on any signed-in page, not on substitute packet pages, not on this policy or the sign-in page — and it receives no Account data, no content, and nothing about students. Under the California Consumer Privacy Act as amended (CCPA/CPRA) and comparable state laws, this may be treated as “sharing” personal information for cross-context behavioral advertising, so we give you an opt-out: use the control in Section 13, or turn on Global Privacy Control in your browser, and the pixel will not load for you. We have used this pixel since September 2026; before that we shared no personal information for any advertising purpose.

5. Disclosure to service providers

We disclose personal information to the following categories of recipients, who act as our processors or service providers and are contractually restricted to using it only to perform services for us:

• Anthropic — AI processing of generation, packet, explainer, and fact-check requests, including the content submitted for those requests.
• Resend — transactional email delivery (absence alerts, coverage updates, confirmations).
• Neon — managed database hosting.
• Vercel — application hosting, delivery, and logging.
• Stripe — payment processing. Stripe collects and handles your payment card details directly as an independent controller under its own privacy policy.
• Google — only if you connect your Google account: documents you choose to export are transmitted to Google to create the file in your own Google Drive. Google acts on your instruction and under its own privacy policy.

Advertising partner (public pages only). Meta Platforms, Inc. receives the measurement information described in Section 4 from our public marketing pages, as an independent controller under its own privacy policy. It is not a service provider to the Service and receives nothing from inside it.

We may also disclose personal information: to comply with law, legal process, or a lawful governmental request; to enforce our Terms; to detect, prevent, or address fraud, security, or technical issues; to protect the rights, property, or safety of Cedarboard, our users, or the public; and to an acquirer in connection with a merger, financing, reorganization, or sale of assets, subject to advance notice to you and continued protection under a policy no less protective than this one.

6. Substitute packet share links

Substitute packets are shared using links containing a long, unguessable token. Any person who holds such a link can view that packet and its exports without signing in. This is intentional so that a substitute or office administrator can access materials immediately. Packet pages are not indexed by search engines. You control who receives a link, and you are responsible for distributing it only to appropriate recipients.

7. AI processing and the fact-check feature

When you generate material or run a fact check, the relevant content is transmitted to our AI provider for processing. The fact-check feature additionally causes automated web searches derived from that content to be performed through the provider’s search infrastructure. Do not submit confidential, proprietary, or personal information you would not wish processed in this way.

8. Retention

• Account and content — retained while your Account is open.
• Deleted materials — retained for 30 days in Recently Deleted so you can restore them, then permanently deleted.
• Absence records — retained as coverage history for the life of the Account so your timeline remains accurate.
• Help-assistant conversations — questions you type into the in-app help chat, and the answers given, are retained for 90 days to identify common problems and improve the product, then permanently deleted. The assistant is only provided our own help documentation and your plan and current page — never your lesson content or any student information.
• Feedback you send us — anything you write in the “tell us what’s wrong” box, along with your name, email and the page you were on, is retained for 90 days so we can read it, reply to it, and decide what to build, then permanently deleted. It is never used to train any AI model, and no AI reads it — it goes to a person.
• Waitlist entries — retained until our launch communications conclude or you ask us to remove you, whichever comes first. An entry whose email becomes an Account is kept as part of that Account’s record.
• Connected Google account tokens — retained, encrypted, until you disconnect the account or close your Account; disconnecting also revokes our access at Google.
• Billing records — retained as required by tax and accounting law, typically up to seven years.
• Security and request logs — retained for a limited period consistent with our hosting provider’s defaults.
• On account closure — personal information and materials are deleted, except records we must retain by law and aggregated or de-identified data that can no longer identify you.

9. Security

We use technical and organizational measures appropriate to the risk, including encryption of data in transit, password hashing, unguessable share tokens, access controls, and reputable infrastructure providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. The most effective safeguard is structural: the Service is designed so that student personal information is never collected in the first place.

10. Children and student data

The Service is a professional tool for adults and is neither directed to nor intended for children. We do not knowingly collect personal information from children under 13 (or the equivalent age under applicable law), and students must not hold Accounts.

You are prohibited from submitting Student Data (as defined in our Terms). We do not act as a “school official” under FERPA, as an “operator” under state student-privacy statutes, or as a processor of Student Data on behalf of an educational institution, unless a separate written data processing agreement has been executed. If you believe a student’s personal information has been submitted to the Service, contact us immediately and we will delete it.

11. International transfers

We and our service providers process personal information in the United States and may process it in other countries. Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional measures where required. You may request further information using the contact details below.

12. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

• Know / access — obtain confirmation of processing, a copy of your personal information, and details of categories, purposes, sources, and recipients.
• Correct — have inaccurate personal information rectified.
• Delete — request erasure of your personal information, subject to legal retention requirements.
• Portability — receive your data in a portable format. You can also export your materials yourself at any time: to PDF on every plan, including the free plan, and to Word, PowerPoint, or Google Docs/Slides on a paid plan. Exercising this right is never conditional on paying — ask us and we will send you a copy of your data whatever plan you are on.
• Object or restrict — object to processing based on legitimate interests, or request restriction of processing.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing. You can disable push notifications per device in Settings.
• Opt out of sale or sharing — we do not sell personal information. To opt out of the advertising measurement pixel on our public pages, use the “Do not sell or share my personal information” control in Section 13, or turn on Global Privacy Control in your browser; we honor that signal as an opt-out.
• Non-discrimination — we will not deny service, charge different prices, or provide a different quality of service because you exercised a privacy right.
• Complain — lodge a complaint with your supervisory authority or, in the UK, the Information Commissioner’s Office.

How to exercise. Email support@cedarboard.app from your Account email address, or contact us at the address below. We will verify your identity by reference to your Account credentials before acting, and will respond within the period required by applicable law (generally 30 days for GDPR requests and 45 days for CCPA requests, extendable where permitted). An authorized agent may submit a request on your behalf with written proof of authority. If we decline a request, you may appeal by replying to our decision with the word “Appeal.”

13. Cookies and similar technologies

We use a strictly necessary session cookie to keep you signed in and to protect against request forgery, and a single first-party “source” cookie that remembers which link first brought you to the site (for example, a particular post) so we can tell which of our announcements actually reached teachers. The source cookie identifies a link, not you; it is never shared and is not used to track you across other sites.

Advertising measurement pixel (public pages only). Our public marketing pages load the Meta Pixel described in Section 4, which sets a Meta cookie (_fbp) in your browser. It does not load on any signed-in page, on substitute packet pages, or on this page. We use no other advertising cookies and no third-party analytics trackers inside the Service. We honor Global Privacy Control: if your browser sends it, the pixel does not load. You can also opt out here for this browser, whether or not you have an account:

Blocking the session cookie will prevent you from signing in.

14. Automated decision-making

We do not engage in automated decision-making that produces legal or similarly significant effects concerning you. AI is used to generate teaching materials at your request; it is not used to evaluate you, your students, or your employment.

15. Changes to this policy

We may update this policy. If a change is material, we will notify you by email or through the Service before it takes effect. The “last updated” date above reflects the current version, and we encourage you to review it periodically.

16. Contact us

Parlay Vision Consulting LLC d/b/a Cedarboard
871 Coronado Center Drive, Henderson, NV 89052
support@cedarboard.app