ALOS — Privacy Policy
Effective date: September 22, 2026
Last updated: October 2, 2026
1. Who we are
ALOS (Adaptive Learning Operating System) is an educational platform operated by Ayekah & Co. Inc. ("ALOS," "we," "us," "our"), a company registered federally and in Québec, with its registered office at:
Ayekah & Co. Inc. 1817 Rue de Villiers, Montréal, Québec, H4E 1K9, Canada
This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, who we share it with, and the rights you have over it. We have written it in plain language on purpose — because much of the information we handle concerns children, we believe families deserve a policy they can actually read and understand.
2. Who this policy applies to
This policy covers everyone whose personal information ALOS handles:
- Account administrators — the parent, guardian, or organization representative who creates and manages an ALOS account.
- Educators — adults invited to plan, teach, and document learning for assigned students.
- Students — the children whose learning is supported on the platform. ALOS is an educator-led platform: a parent, guardian, or organization sets up each student's profile and consents on the child's behalf.
- Visitors to our public website (alos.education).
3. The person responsible for your personal information
Under Québec's Act respecting the protection of personal information in the private sector (Law 25), we have designated a person responsible for the protection of personal information. You can reach this person for any privacy question or to exercise your rights:
Eduard Bugeag, Executive Director Ayekah & Co. Inc., 1817 Rue de Villiers, Montréal, Québec, H4E 1K9, Canada Email: privacy@alos.education
4. What information we collect
We collect only what we need to run the platform (the principle of data minimization).
Account and identity information Name and email address of account administrators and educators, collected when an account or invitation is created. Authentication is handled by our identity provider, Clerk (see Section 11).
Student profile information Information an account administrator or educator enters to set up a child's learning: the student's name, learning language, grade or cycle level, developmental placement, and any learning preferences or needs recorded by the educator.
Educational content The learning work created on the platform: weekly plans, activities, reflections, portfolio evidence (which may include text, drawings, photographs, or audio that the educator uploads), competency progress, assessments, and reports.
AI tutor interactions When a student uses the AI tutor, we store the conversation server-side on a rolling 12-month retention basis, and we maintain a short curated summary that helps the tutor stay consistent over time. The student's long-term context is always this curated summary — never a raw conversation log. We do not use student conversations to train AI models (see Section 9).
Usage and technical information Limited operational data needed to keep the service working and secure: authentication sessions; application error records, which contain no names; diagnostic records of failed AI requests, which may contain excerpts of the request (the student's name, as recorded in ALOS, is replaced before they are stored); records of AI usage (counts of requests and tokens, never their content); fair-use records; and, for our public forms, a keyed hash of your IP address, used only to limit abuse. ALOS does not use advertising trackers, marketing analytics, or cross-site tracking (see Section 10).
Messages you send us When you use the contact form or write to one of our email addresses, we keep your name, your email address and your message, including any request about your personal information. When a signed-in user sends feedback from within the platform, we keep the feedback text, the page it was sent from and basic browser information. Section 8 says how long each is kept.
Billing information Subscription and payment processing is handled by our payments provider, Polar (see Section 11). We receive subscription status and billing records, but we do not collect or store full payment-card numbers — card payments are processed by Stripe, the payment processor used by Polar.
5. Children's personal information
Protecting children's data is the most important commitment in this policy.
Educator-led consent. ALOS does not allow children to sign themselves up. A parent, guardian, or authorized organization representative creates the account, sets up each student's profile, and provides consent for that child's information to be collected and used on the platform. That adult acts as the account administrator and is the point of consent.
Consent thresholds we honor. Our consent model is designed to meet the strictest applicable rules:
- In Québec, for a child under 14, consent is given by the person having parental authority (Law 25).
- In the United States, for a child under 13, the account administrator or an assigned educator confirms in the platform that the consent of a parent or guardian has been obtained, and that confirmation is recorded (COPPA).
- In the European Union / EEA, where GDPR Article 8 applies, consent for information-society services to a child below the applicable age (16, or as low as 13 depending on the member state) is given or authorized by the holder of parental responsibility.
What we will never do with children's data.
- We never use student information for advertising or marketing.
- We never sell or rent student information.
- We never use student tutor conversations to train AI models.
- All AI-generated content shown to a student passes through a Safety and Appropriateness review before it reaches the child (see Section 9).
6. How we use personal information
We use personal information only to operate and improve the educational service:
- To create and manage accounts and invitations.
- To generate personalized plans, activities, tutoring, reflections, and reports.
- To document learning, track competency progress, and produce assessments and jurisdiction-aligned reports (for example, an annual learning plan where a jurisdiction requires one).
- To process subscriptions and billing.
- To keep the platform secure, prevent abuse, and meet our legal obligations.
We do not use personal information for advertising, behavioral profiling for marketing, or any purpose unrelated to delivering education on the platform.
7. Our legal bases (for users subject to GDPR)
Where the GDPR applies, we rely on: performance of our contract with you (to provide the service); consent (in particular for children's data, given by the holder of parental responsibility); compliance with legal obligations; and our legitimate interests in keeping the platform secure and functioning, balanced against your rights.
8. How long we keep information
| Type of data | Retention period |
|---|---|
| Active student and account data | Kept while the account is active |
| Data of an account whose trial or subscription has ended | Kept for 24 months after the last sign-in to the account; we write to the account's administrators 30 days before deleting it |
| Data after a deletion request | Deleted within 30 days; copies in our backups are removed as the backups rotate, within a further 30 days. What our providers hold is listed below |
| Billing and invoice records | Held by our payments provider, Polar, as merchant of record, for as long as tax and accounting law require. When an account is deleted, we have Polar replace the name and email address on its customer record with one-way hashes and clear its billing address; the invoices remain with Polar |
| Audit logs and the record of a deletion request | 3 years |
| AI tutor raw conversation logs | 12 months, on a rolling basis |
| Messages sent through the contact form or to our email addresses, including requests about your information | 12 months, or sooner at your request |
| Feedback sent from within the platform | 12 months |
| Diagnostic records of failed AI requests | 90 days |
| Application error records (no names) and fair-use reservation records | 90 days |
| Invitations to join an account | 90 days after the invitation is accepted, withdrawn or expires |
| Keyed hashes of IP addresses used to limit abuse of our public forms | 6 hours after their last use |
| Copies held by our providers | Anthropic deletes the content of AI requests within 30 days, or keeps it up to two years where its safety systems flag it; Resend keeps sent email and its logs for 30 days; Vercel keeps server logs for up to 30 days; Clerk deletes a sign-in identity when we delete it; Convex keeps its own backups for up to 14 days. Copies in each provider's own backups follow its own policy |
When a retention period ends, we delete or irreversibly anonymize the data.
9. How we use artificial intelligence
ALOS uses AI to generate learning plans, activities, tutoring, reflections, and draft reports. A few commitments matter here:
- AI runs on our servers, never in your browser, and never with student data exposed to the public web.
- Student-facing AI output is screened. Every AI response intended for a child passes through a Safety and Appropriateness review for age-appropriateness and emotional safety before it is shown.
- Your data is not used to train AI models. Our AI provider, Anthropic, does not use the inputs or outputs of our platform's API calls to train its models, under its commercial terms. Under those commercial terms, the inputs and outputs of our API calls are, by default, automatically deleted at Anthropic within about 30 days — except where they must be kept longer to comply with law or enforce policy. ALOS likewise does not use student conversations or student work to train any model.
10. Cookies and tracking
ALOS uses only the cookies that are strictly necessary for the platform to function:
- a secure session cookie set by our authentication provider so you can stay signed in; and
- a small preference cookie that remembers your chosen interface language.
Our Cookie Policy lists each of these cookies — their names, purpose, and duration — in detail.
ALOS does not use advertising cookies, third-party marketing analytics, or cross-site tracking. Because we use only strictly necessary cookies, no cookie-consent banner is required. If we ever introduce any non-essential cookie or analytics tool in the future, we will update this policy and obtain consent where the law requires it.
11. Service providers (sub-processors)
We rely on a small set of trusted providers to operate ALOS. Each handles personal information only as needed to provide its service to us, under a data processing agreement.
| Provider | Purpose | Processing location |
|---|---|---|
| Clerk | User authentication and account management | United States |
| Convex | Application database and backend | United States |
| Vercel | Website and application hosting | United States / global edge |
| Anthropic | AI processing (Claude) | United States |
| Resend | Transactional email delivery | United States |
| Polar | Subscription and payment processing (merchant of record; card processing by Stripe) | United States |
| DreamHost | Email hosting for our alos.education addresses, including the privacy mailbox that receives your requests | United States |
12. Where your information is processed (cross-border transfers)
ALOS is a Canadian company and would prefer to keep all data in Canada. However, for this version of the platform, the service providers listed in Section 11 process and store data in the United States (and potentially elsewhere). This means your personal information — including children's information — is transferred to and processed outside Québec and Canada. Anthropic, our AI provider, keeps the records of our requests in the United States and may process a request in other countries.
We rely on contractual protections with each provider to safeguard this information. By using ALOS, account administrators acknowledge this cross-border processing on behalf of themselves and the students they manage.
13. How we share information
We do not sell, rent, or trade personal information, and we do not use it for advertising.
We share personal information only:
- with the service providers in Section 11, to operate the platform;
- when required by law, legal process, or a regulator; and
- to protect the rights, safety, or property of ALOS, our users, or the public.
Within an account, information is shared as the platform is designed to work: educators assigned to a student can see that student's profile, plans, portfolio, evidence, and progress, and account administrators can see account-level information.
14. Your rights
Depending on where you live, you have rights over your personal information, including the right to:
- access the personal information we hold about you or a child in your care;
- correct information that is inaccurate or incomplete;
- delete information (the right to erasure under Law 25 and GDPR Article 17);
- withdraw consent you previously gave;
- receive a copy of your information in a portable format (data portability); and
- complain to a regulator.
How to exercise your rights. Use the account settings where available, or contact our person responsible for personal information at privacy@alos.education. Account deletion can be requested by an account administrator; on confirmation, student and educator personal data is deleted within 30 days, except records we must keep by law (such as billing records).
For Québec residents, you may also contact the Commission d'accès à l'information du Québec (CAI). For users in other jurisdictions, you may contact your local privacy regulator.
15. How we protect information
We use technical and organizational safeguards to protect personal information, including:
- Encryption in transit and at rest. Personal information is encrypted while travelling over the network (TLS). Our database, file-storage, and backend provider, Convex, encrypts all stored customer data at rest using industry-standard 256-bit AES encryption. Our authentication provider, Clerk, is independently audited to the SOC 2 Type II standard and encrypts personal information in transit and at rest.
- Role-based access control. Every request is authenticated before any data is returned, and access is limited by role — platform administrators; account administrators (their own account only); educators (only the students assigned to them); and students (only their own learning space).
- A Safety review of all child-facing AI content, as described in Section 9.
No system is perfectly secure, but we work to protect your information and to respond quickly if something goes wrong.
16. If a data breach occurs
If a confidentiality incident creates a risk of serious harm, we will take reasonable steps to reduce the risk, keep a record of the incident, and notify the affected individuals and the applicable regulator (the CAI in Québec, and others as required) within the timeframes the law requires.
17. International users
ALOS is operated from Canada and intended first for users in Canada. If you access ALOS from outside Canada, you understand your information will be processed as described in this policy, including in the United States.
18. Changes to this policy
We may update this policy from time to time. If we make a material change, we will update the "Last updated" date and, where appropriate, notify account administrators. Continued use of ALOS after an update means you accept the revised policy.
19. Contact us
For any privacy question, or to exercise your rights:
Eduard Bugeag, Executive Director — Person responsible for the protection of personal information Ayekah & Co. Inc. 1817 Rue de Villiers, Montréal, Québec, H4E 1K9, Canada privacy@alos.education