LYCEON Privacy Policy

LYCEON respects your privacy and is committed to protecting personal data. This Privacy Policy explains how we collect, use, store, share, and protect information when students, parents, and guardians use the LYCEON platform.

This policy applies to students using LYCEON, parents or guardians connected to a student account, people who pay for a subscription, and visitors to the LYCEON website or app.

By using LYCEON, you agree to this Privacy Policy.

---

1.1 Information You Provide

• Name or username
• Email address
• Account credentials
• A guardian email address, where a student provides one at sign-up
• Messages, responses, or feedback submitted through the platform, including private feedback you send to the LYCEON team
• Reviews you choose to leave about LYCEON: a star rating, optional text, and whether LYCEON may quote the review anonymously
• Your choice about marketing emails, and when and where you made it

1.2 Learning and Usage Data

• Answers submitted to questions
• Progress and performance data
• Time spent on activities
• Interaction patterns with explanations and AI tools

1.3 Technical and Device Data

• Device type and browser
• IP address
• Log data and error reports
• Cookies and similar technologies, as described in Section 9
• If you accept analytics cookies, how you first arrived at LYCEON (for example, from a search engine or an ad), as described in Section 9

1.4 Billing Information

We do not store payment card numbers. Payments are processed by Stripe, and card details go directly to Stripe without passing through LYCEON's systems.

When a subscription is purchased, Stripe receives and stores the payer's name, email address, billing address, and payment method details. LYCEON stores the payer's Stripe customer identifier, the subscription identifier, the subscription status and billing period, and which student account the subscription funds.

We also store a record of the payer's consent to the Billing Terms — the date and time, the version agreed to, and the account it belongs to — as described in Section 6.3.

---

We use collected data to:

• Provide and operate the LYCEON platform
• Personalize learning experiences
• Improve explanations, content quality, and difficulty targeting
• Monitor platform performance and security
• Prevent abuse, cheating, or misuse
• Process payments and manage subscriptions
• Communicate important updates or notices
• Understand how the website and app are used, and test improvements to them, if you accept analytics cookies (Section 9)
• Read the reviews and private feedback you send us, to improve the service
• Quote a review anonymously, only if its author allowed it
• Keep a record of marketing email choices, so we can honor them and show when consent was given or withdrawn
• Send marketing emails, only if you opt in

We do not use personal data for targeted advertising, and we do not sell personal data.

---

LYCEON uses artificial intelligence to support learning and personalization.

3.1 AI Personalization

Learning data may be used to adapt explanations and hints, adjust difficulty levels, and improve clarity and instructional effectiveness.

3.2 Model Improvement

LYCEON may analyze data in aggregated, anonymized, or pseudonymized form to improve platform quality and enhance AI accuracy, safety, and reliability.

3.3 Third-Party AI Providers

Conversations with LISA, our AI tutor, are processed by Google Cloud Vertex AI. Data shared with that service is limited to what is needed to generate a response, and Google is contractually prohibited from using it to train public or general-purpose models.

No data from a user under 13 is sent to any third-party AI provider, because LISA is not available below that age. See Section 4.

---

LYCEON is designed for students aged 13 and over. Users under 13 may use LYCEON only under the conditions in this Section. This Section is our notice to parents and guardians about the information we collect from children under 13, how we use it, and the choices available to you.

4.1 Under-13 Accounts Require a Connected Guardian

A student under 13 cannot use LYCEON until a parent or guardian has connected their account.

Before that connection exists, the account can be used only to connect a parent or guardian and to manage the account. We hold only the information needed to create it — name, email address, date of birth and sign-in details — the record of the sign-up agreements, and the technical data described in Section 1.3. No learning activity is collected.

If the student asks us to, we email their link code to the parent or guardian address they provide. We use that address only to send the email and to prevent misuse of this feature.

A parent or guardian connects by entering the student's link code in their own LYCEON account and agreeing to the Parent / Guardian Terms. A parent or guardian must be at least 18. When a parent or guardian connects, the account activates.

4.2 No AI Tutor Below 13

LISA is not available to any user under 13. This means no conversation data from an under-13 account is created, stored, or transmitted to Google Cloud Vertex AI or any other third-party AI provider.

4.3 What We Collect From an Under-13 Account

Once active, an under-13 account is subject to the same collection described in Section 1, except that an under-13 account:

• has no tutor conversations;
• is excluded from analytics and session recordings;
• never receives marketing emails;
• is never asked to review LYCEON and cannot leave a review; and
• may send us private feedback, which we use only to improve the service.

We collect only the information reasonably necessary for a child to use LYCEON, and we do not require a child to provide more information as a condition of taking part. We do not show advertising to children, use their information for advertising, or sell or share it, and a child cannot make personal information publicly available on LYCEON. We use a child's information only to provide the service, show their practice and progress, show a connected parent or guardian the information described in Section 5.1, keep the account secure, and maintain the service. We disclose it only to a connected parent or guardian, to our service providers (Section 5.2), or where the law requires it or someone's safety is at risk. We keep it for the periods in Section 6.

4.4 Guardian Rights

A connected parent or guardian may at any time review the information we hold about their child, correct it, delete it together with the account, or refuse further collection by disconnecting or asking us to close the account. Email support@lyceon.ai from the address on your parent or guardian account. We may need to verify that you are the connected parent or guardian before acting on your request.

Disconnecting ends the student's access and you may request deletion of their data at the same time.

4.5 How We Treat This Consent

Connecting a guardian account is how we obtain and record consent for an under-13 student's use of LYCEON. We describe this mechanism plainly rather than claiming it satisfies any particular legal standard for verifiable parental consent. If you have questions about how we handle your student's data, contact support@lyceon.ai and we will answer directly.

4.6 If We Learn an Account Is Under 13 Without a Guardian

The account will be suspended, and associated personal data will be deleted in accordance with applicable law.

4.7 Contact for Parents and Guardians

LYCEON AI operates LYCEON. Parents and guardians can contact us at support@lyceon.ai, by post at 5650 Central Ave # E7, Toledo, OH 43615, or by telephone at +1 (419) 415-1885.

If we make a material change to how we collect, use or disclose children's information, we will notify connected parents and guardians and, where the law requires, obtain their consent before the change takes effect.

---

LYCEON shares information only where necessary to operate the platform, where you direct us to, or where the law requires it.

5.1 With a Connected Guardian

A linked parent or guardian can see the student's mastery level for each subject domain (for example, Algebra or Craft and Structure), the student's study calendar and progress, projected and target scores, and full-length practice test results. Guardians cannot see skill-level detail, individual answers, or conversations with LISA, our AI tutor.

A connected guardian cannot see the student's conversations with LISA. Tutor conversations are private to the student.

This sharing is a direct consequence of connecting, and either party can end the connection at any time.

5.2 Service Providers and Sub-Processors

We share information with the following service providers (our sub-processors), which process data only on LYCEON's instructions. We will update this list before engaging a new service provider that processes personal information.

Provider	Purpose	What it receives
Supabase	Database, authentication, hosting	Account data, learning data
Vercel	Application hosting and delivery	Request and log data
PostHog	Product analytics and session recordings, only with your consent and never for users under 13	Usage events and page interactions, as described in Section 9
Stripe	Payment processing	Payer name, email, billing address, payment method
Google Cloud	AI services for LISA and content safety; background processing	Tutor conversation content — never for users under 13; internal identifiers
Google	Sign in with Google, if you choose it	Google sign-in details
Resend	Email delivery	Email address and message content
Cloudflare (Turnstile)	Security and bot protection	Technical browser data
Desmos	Graphing calculator in math questions	Technical browser data, such as IP address and browser type
Slack	Internal team notifications	Internal reference numbers only

Where a provider is used for AI generation, it is contractually prohibited from using personal data to train public or general-purpose models.

Parents, guardians and students aged 18 and over may be shown a link to review LYCEON on Trustpilot. If you follow it, you leave your review on Trustpilot's website under Trustpilot's own privacy policy. We do not send Trustpilot any of your information.

5.3 Legal and Safety Reasons

We may disclose information where required to comply with legal obligations, respond to lawful requests, or protect the rights, safety, or security of LYCEON, our users, or others.

Where a tutor conversation raises a safety concern, we may review it and contact a connected guardian or, where necessary, appropriate authorities. This is described further in Trust & Safety at LYCEON.

5.4 We Do Not Sell Personal Information

LYCEON does not sell personal information and does not share it for cross-context behavioral advertising, and has not done so in the past 12 months. This includes the personal information of consumers under 16. Our service providers process personal information only to provide services to us and are not permitted to use it for their own purposes.

If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information, and as a refusal of analytics cookies (Section 9). If we ever intend to sell or share personal information, we will update this policy and provide a way to opt out before doing so, and we will obtain opt-in consent for consumers under 16.

---

We keep information only as long as we need it, and we delete or anonymize it on the schedule below. We do not keep any category of information indefinitely except where this section says so explicitly.

6.1 Your Account and Learning Data

While your account is open, we keep your profile, your practice and test activity, and your progress data so the service works.

Tutor conversations are kept while your subscription is active. If your subscription ends, they are deleted seven days later. If you resubscribe within those seven days, they are kept. If you have never subscribed, they are kept while your account is open and are deleted when your account is deleted.

Conversations flagged for safety review are kept until our safety review team has completed its review and closed the case. They are then deleted by that team. While a review is open, these records may be kept longer than our standard retention periods.

Notifications you receive in the app are kept for 90 days.

Reviews, private feedback and the record of your marketing email choices are kept while your account is open and are deleted when your account is deleted.

If your account is inactive for 12 months, we delete it. Before deleting an inactive account, we will email you at least 48 hours in advance (and, for a student, their linked parent or guardian). Signing in or using Lyceon during that time cancels the deletion.

6.2 When You Delete Your Account

You have 7 days to change your mind. Nothing is erased during that window and you can cancel at any time.

After 7 days we permanently erase the information that identifies you — your name, email address, date of birth, and login. Your learning activity is anonymized: the records remain, but nothing in them connects to you, and we cannot reverse that.

The one exception is conversations flagged for safety review. These are disconnected from the deleted account and kept only until the safety review is closed, as described in Section 6.1.

Three things survive, and here is exactly why:

• A record that you asked us to delete your account, including your email address, kept for 24 months. We are required to keep records of these requests. After 24 months we remove the email address and keep only the date and outcome.
• A record that a parent or guardian gave consent, kept permanently. This is how we can show consent was properly obtained.
• Payment records, kept for 7 years, because tax and financial rules require it.

If you asked us not to contact you again, we keep your email address on a do-not-contact list until you tell us otherwise. That is the only way we can honour the request.

6.3 Consent to the Billing Terms

Records of consent to the Billing Terms are kept for no less than three years from the date of consent, or one year after the subscription ends, whichever is longer. This is a separate record from the parent or guardian consent described above, and it is kept on its own clock.

6.4 Children

A child under 13 may use LYCEON only with an active guardian connection, as described in Section 4. If we identify an account belonging to a child under 13 without one, we delete it.

6.5 Security and Operational Records

Records of sign-ins, security events and administrative actions are kept for 365 days. When you delete your account, your identity is removed from these records immediately; the records themselves remain for the rest of that period. Records of a parent or guardian connecting to or disconnecting from a student are the exception: they are consent records and are kept permanently (Section 6.2).

Records of how our systems were configured are kept permanently, as an operational record. These describe our operations, not you.

6.6 Analytics

We use PostHog to understand how the service is used, only if you accept analytics cookies, and never for users under 13. Analytics events are kept for up to 12 months and then deleted. Session recordings are kept for 30 days.

6.7 Anything Else

Where we keep operational records that include information about you and are not listed above, we keep them for no more than 90 days.

6.8 Changes

If we change these periods we will update this section and note the date.

---

LYCEON uses reasonable administrative, technical, and organizational safeguards to protect personal data, including secure authentication, access controls, and monitoring and logging.

No system is completely secure. In the event of a data breach that compromises personal information, LYCEON will notify affected users and, where applicable, connected guardians, in accordance with legal requirements.

---

Depending on where you live, you may have rights to access your personal data, correct inaccurate data, request deletion, request a portable copy, restrict or object to certain processing, and withdraw consent.

Parents and guardians may exercise these rights on behalf of a connected student.

8.1 California Residents

Under the California Consumer Privacy Act as amended, you have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to obtain a portable copy; and to be free from discrimination for exercising these rights.

We do not sell personal information and do not share it for cross-context behavioral advertising. We honor the Global Privacy Control signal (Section 5.4).

Notice at collection. We collect the following categories of personal information, for the purposes and periods shown:

Category	Examples	Purpose	Retention
Identifiers	Name, email address, account ID, IP address	To create and operate your account, keep it secure, and contact you about the service	While your account is open; on deletion, as described in Section 6.2
Customer records	Billing name and address, subscription records	To process payments and manage subscriptions	7 years
Characteristics of protected classifications	Date of birth	To apply age requirements	While your account is open
Commercial information	Subscription purchased, billing period	To provide the service you purchased	7 years
Internet or other electronic network activity	Pages used, device and browser data, log data; analytics and session recordings if you accept analytics cookies	To operate, secure and improve the service	Security records: 365 days; other operational records: up to 90 days; analytics events: up to 12 months; session recordings: 30 days
Education information	Practice answers, progress, test results	To provide the learning service and show progress	While your account is open; de-identified on deletion
Electronic information	Text conversations with LISA (users 13 and over)	To provide the AI tutor	While your subscription is active, then 7 days
Sensitive personal information	Account login credentials	To let you sign in and keep your account secure	While your account is open

We do not collect precise geolocation, government identifiers, financial account numbers, health information or biometric information. We use sensitive personal information only to provide the service and keep it secure.

8.2 European Union, EEA, and United Kingdom Residents

Where the GDPR or UK GDPR applies, we process personal data on the following bases: performance of a contract for operating your account and subscription; legitimate interests for platform security, abuse prevention, and service improvement; consent for a guardian's connection to a student account; and legal obligation where required.

You have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to lodge a complaint with your supervisory authority.

8.3 Making a Request

Contact support@lyceon.ai. We will respond within the time required by applicable law and may need to verify your identity first.

---

LYCEON uses cookies and similar technologies that are strictly necessary to keep you signed in, protect your account, and remember your settings. These do not require your consent.

We do not use advertising or cross-site tracking cookies.

We use PostHog for product analytics and session recordings, on our website and on pages within the signed-in app:

• Your choice. We ask whether you accept analytics cookies when you first visit. You can change your choice at any time using the Cookie settings link. We keep a record of your cookie choices for as long as needed to show that we have your consent.
• Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a refusal.
• Limited data. We do not send names or email addresses to PostHog, IP addresses are anonymized, and analytics never includes your answers to questions or your conversations with LISA.
• Session recordings. With your consent, we make session recordings of how pages are used. Certain content is masked in these recordings, including what you type, questions and answers, conversations with LISA, and the text of reviews and feedback. Session recordings are kept for 30 days.
• How you found us. If you accept analytics cookies, we note the kind of source you first arrived from — direct, a referring website, a paid ad, a search engine, or unknown — for the rest of that browser session, and store it with your account if you sign up. We do not keep the address of the page you came from or the name of any campaign.
• Testing improvements. If you accept analytics cookies, we may show you one of several versions of a page, such as the homepage, to learn which works better.
• Children. Accounts of users under 13 are excluded from analytics and session recordings.

You can control cookies through your browser settings, though some features may not function properly if disabled.

9.1 Question of the Day

You can answer the Question of the Day without an account. To protect it from automated abuse, we use Cloudflare Turnstile, and we limit how often it can be used from one connection using a keyed one-way code derived from your IP address, which we delete within two days; we never store the IP address itself. We keep only daily totals of how many answers were submitted and how many were correct. We do not keep anyone's individual answers.

9.2 Marketing Emails

Users aged 13 and over may choose to receive marketing emails. We send them only if you opt in, and we record when you opted in or out, where you did so, and the version of the wording you agreed to. You can opt out of marketing emails at any time in your account settings or by using the unsubscribe link in any marketing email. Users under 13 never receive marketing emails.

---

LYCEON is operated from the United States. If you access LYCEON from outside the U.S., your information may be transferred to and processed in the United States and other jurisdictions with different data protection laws.

Where required, we rely on appropriate safeguards for international transfers, including standard contractual clauses with our providers.

---

LYCEON may update this Privacy Policy from time to time. Each version carries a version number and effective date.

If changes are material, we will provide notice through the platform or other reasonable means. Continued use of LYCEON after changes take effect constitutes acceptance.

---

support@lyceon.ai

LYCEON AI