Privacy Policy

Account Information: If you create an account, we collect your name and email address to provide you with personalized features such as saving decisions to folders and receiving notifications about new decisions.

Authentication Data: When you sign in using Google, we receive your name, email address, and profile picture from Google. We do not receive or store your Google password.

Usage Data: We collect records of how the Site is used, such as pages visited, search queries, and features used. See Usage Analytics below.

Cookies: We use essential cookies to maintain your session and preferences, as well as first-party analytics cookies. These are our own cookies; we do not use third-party advertising or tracking cookies, and we do not share this data with anyone.

Billing and Subscription Information: When you subscribe to a paid plan, our payment processor, Stripe, collects your payment card details directly. We do not receive or store your full card number. We retain a Stripe customer identifier, your subscription plan and status, your billing email, and, where Stripe provides it, your card brand, the last four digits of your card, and your billing history.

AI and Search Queries: the search terms and questions you submit, including to our AI-assisted research features, together with any answers you choose to save or flag.

Transactional Emails: We may send you transactional emails related to your account, such as notifications about new decisions. These are not marketing communications.

New Decision Notifications: When you create an account, you will automatically receive email notifications when new BSEA decisions and rulings are posted to the Site. You can unsubscribe from these notifications at any time using the unsubscribe link included in each email.

Newsletter:We may offer an optional email newsletter. Subscribing is voluntary, and you can unsubscribe at any time using the link in any newsletter email. We deliver our emails (decision alerts and the newsletter) through Resend, a third-party email delivery provider that processes your email address to send our messages. Links in our emails point to our own website and may include tags that let us see which emails and content brought you to the site, including on a per-account basis. Resend's privacy practices are governed by its own privacy policy.

Some features of the Site let you ask questions and receive AI-generated answers about special education law (for example, our Ask and AI search tools). When you use these features, the question or search terms you submit are sent to our AI provider, Anthropic, to generate a response.

What we collect: the questions and prompts you submit, the answers generated for you, and any answers you choose to save to your dashboard or flag as incorrect. We use this to provide the feature, to let you revisit saved answers, and to improve the quality of our service.

AI provider:we use Anthropic's API to generate answers. Under Anthropic's API terms, the questions you submit through the Site are not used to train Anthropic's models. Anthropic's handling of data is governed by its own terms and privacy policy.

Optional voice input:if you use the microphone button, the audio you record is sent to Groq's transcription API. Groq returns a text transcript, which is then handled like a question or search term as described above. You can use all research features without voice input. Groq's handling of audio is governed by its own terms and privacy policy.

Please do not enter sensitive personal information: our AI and search tools are designed for legal research, not for storing personal details. Please do not enter a child's name, contact information, or other identifying personal information about a student into a search box or AI prompt. AI answers are generated by automated systems, may be incomplete or inaccurate, and do not constitute legal advice. See our Terms of Service for more information.

We offer a Model Context Protocol (MCP) connector that lets AI assistants such as Claude run read-only legal research over our database of special education administrative decisions (see our connector documentation). The connector reads only public, already-published legal materials; it does not create, modify, delete, or transmit data on your behalf. It is available only to signed-in accounts with an active Pro entitlement.

What we collect through the connector: the search terms and query parameters required to return your result, your Special Education Law account identifier, and technical request metadata used to authenticate, rate-limit, and secure the service. The MCP route does not store tool names or query text as product-analytics events. We do not access, query, or store your AI assistant's memory, chat history, conversation summaries, or any files you have uploaded to it, and we do not collect the surrounding conversation.

Authentication data: the connector uses OAuth. We store cryptographic hashes—not the usable values—of authorization codes, access tokens, and refresh tokens, together with the OAuth client, approved scope, protected-resource URL, expiration, rotation, and revocation data. Normal members authenticate with Google or a one-time Magic Link, so we do not receive their Google password or create a site password. A single, access-controlled directory-review account uses a server-side password hash so OpenAI and Anthropic can test the submitted connector.

Your AI provider: ChatGPT, Claude, or another MCP client sends us the specific tool input needed for your request and receives the tool result on your behalf. That provider processes the query and result under its own terms and privacy policy. We do not receive the rest of the conversation from the provider.

We keep personal information only for as long as it is needed for the purposes described in this Policy.

Account data: retained while your account is active. If you delete your account through account settings, we remove the associated personal information from active systems immediately, except where we must retain it to comply with law, resolve disputes, or enforce our agreements, and except for copies that remain in routine backups for a limited period.

Saved AI answers: retained until you delete them or close your account.

Query, usage, and security logs: raw Ask questions and generated answers are retained for no more than 90 days unless you explicitly save or flag an answer. Magic-link security events are retained for no more than 30 days. Other usage and security records are retained only as long as needed to operate and secure the service, and are then deleted or aggregated.

MCP-specific retention: the connector does not persist MCP request bodies, tool names, or query text in product-analytics records. Access tokens expire after one hour and refresh tokens expire after 30 days. Expired or revoked OAuth token records are retained for no more than 30 additional days for replay detection and security review, then deleted automatically. Authorization codes expire after 60 seconds and are deleted after expiration.

Billing records: retained as required for tax, accounting, and legal purposes.