At a glance
Operate and improve CARL, support educators, and enable collaborative lesson creation and sharing.
We do not sell personal information, and we do not use your content or personal information to train AI models.
CARL is for teachers and educators. We do not offer student accounts, and we do not knowingly collect personal information from children.
Information we collect
This policy describes how CARL Hub Inc. (“CARL”, “we”, “us”) handles personal information when you use the CARL platform. We collect information you provide directly, and information generated when you use CARL.
Information you provide
- Account information: name, email address, password (stored hashed), role (such as teacher or contributor), and school, district, or organization affiliation. If you sign in with Google or your district’s single sign-on, we receive basic profile details from that identity provider.
- Profile information: bio, subjects, grades taught, region, and the privacy settings you choose for each field.
- Content you create: lessons, worksheets, components, collections, comments, ratings, uploaded files and images, and related metadata.
- Payment information: if you subscribe to a paid plan, payments are processed by Stripe. We do not store full card numbers; we keep your plan, subscription status, and billing history.
- Communications: messages to support and feedback you share.
Information we collect automatically
- Usage data: page views, feature interactions (for example AI generations counted against plan limits), performance events, and standard server logs.
- Device data: browser type, operating system, language, IP address, and approximate location derived from IP.
- Error diagnostics: crash and error reports collected through our monitoring service (Sentry) to keep the platform reliable.
- Cookies: identifiers described in Cookies and tracking below.
How we use your information
- Provide, maintain, and improve CARL features and reliability.
- Power the features you use, including AI-assisted generation, lesson sharing, and recommendations of relevant curriculum content.
- Process subscriptions and send related information such as receipts.
- Send technical notices, security messages, and — with your consent or as permitted — optional digest and product emails you can unsubscribe from.
- Respond to questions and provide customer support.
- Monitor and analyze usage to inform product decisions and prevent abuse.
- Comply with law and enforce our Terms of Service.
We do not sell personal information, we do not use it for third-party advertising, and we do not use your content or personal information to train AI models.
AI features and content
CARL includes AI-assisted tools for lesson planning, content generation, editing assistance, and image generation. When you use these tools, your prompts and the context you choose to include are processed by our systems and sent to third-party AI providers — currently OpenAI and Google — acting as our service providers. Image search features may send your search terms to a search provider (currently Brave).
- No training. We do not use your content or personal information to train AI models. We access AI providers through their business APIs, under terms that do not permit them to use your inputs or outputs to train their models.
- You control the input. You choose what material is shared with AI tools inside CARL. Do not include personal information about students in prompts.
- Outputs are yours to review. Generated content is stored as part of your content and may be inaccurate; review it before classroom use.
Legal bases
Where applicable, we process personal information on the following bases:
- Contract: to provide CARL when you create an account or subscribe.
- Legitimate interests: platform security, fraud and abuse prevention, and product improvement.
- Consent: optional features such as marketing emails and non-essential cookies. You can withdraw consent at any time.
- Legal obligation: where we must retain or disclose information under applicable law.
Data security
We use technical and organizational measures to protect information from loss, misuse, and unauthorized access, disclosure, alteration, and destruction.
- Encryption in transit and at rest where appropriate.
- Hardened hosting environment, access controls, and logging.
- Password hashing and least-privilege practices for staff and system credentials.
- Regular updates and security reviews of our infrastructure.
No method of transmission or storage is completely secure. We work to minimize risk and will notify you and the relevant authorities of incidents as required by law.
Data retention
We keep personal information only as long as necessary to provide CARL, comply with our legal obligations (for example, financial records for subscriptions), resolve disputes, and enforce our agreements. You can delete your account to remove the personal data we store about you; residual copies in backups and limited logs are removed on their normal cycle. Public content you shared may remain available in remixed form without your personal information.
Children's privacy
CARL is currently available to teachers, educators, and education organizations only. We do not offer student accounts, and the platform is not directed to children. We do not knowingly collect personal information from children; if you believe a child has provided us personal information, contact us and we will delete it.
- Educators must not include students’ personal information in lessons, uploads, or AI prompts.
- If we introduce student access in the future, it will require school or parent or guardian authorization, and we will update this policy with notice before any change.
Your rights and choices
- Access and update your account and profile information in Settings.
- Delete your account to remove personal data we store, subject to legal retention requirements.
- Opt out of non-essential emails using the unsubscribe links.
- Request access to or a portable copy of your data, request correction or deletion, and object to or restrict certain processing, as provided by laws such as PIPEDA, the BC Personal Information Protection Act, or the GDPR.
- Complain to your privacy regulator, such as the Office of the Privacy Commissioner of Canada or the BC Office of the Information and Privacy Commissioner.
To exercise these rights, contact us at [email protected]. We may need to verify your identity before acting on a request.
Data residency and transfers
CARL is operated from Canada and hosted on cloud infrastructure that may store or process information in Canada and the United States. Some service providers, including AI and payment providers, process information in other jurisdictions, where it may be subject to the laws of those jurisdictions.
We use contractual and technical safeguards with all service providers to protect personal information, and we aim to support Canadian education privacy requirements, including those that apply to public school districts. Contact us for current information about data locations and subprocessors.
Changes to this policy
We may update this policy from time to time. We will post updates on this page and revise the effective date. For material changes, we will provide additional notice such as email or in-product messaging before the change takes effect.