This is a draft for review by counsel. It is not in effect yet.
Who we are
Surf Platforms Inc. provides Helio Education, also called Helio AI or Helio Edu in some places. This policy covers the helio.education website and the Helio learning service. Contact support@helio.education with privacy questions or requests.
What we keep
- Account and contact data: an adult's name, email and sign-in details; a child's account may instead use a code and secret words. We also keep consent records and messages you send us.
- Learner profile: name, age or birth month and year, grade, learning goals and school or class information when you or a school provide them.
- Learning data: speech transcripts, written and drawn board work, lesson history, answers, progress and information used to tailor the next lesson.
- Service data: session times, plan and usage records, device and connection information, and error and security logs.
What we don't keep
- In ordinary sessions, Helio turns a learner's speech into text and does not store a raw recording. A speech provider processes the live audio; its retention settings must be checked before launch.
- We do not sell personal information, show ads, or use student data for targeted advertising.
Why we keep it
We use this information to provide tutoring, adapt lessons, show progress to authorized adults and schools, run accounts and billing, answer requests, and protect the service. We use only the information needed for these purposes.
Where information comes from
We receive information from account holders, learners during lessons, and schools that create classes or assignments. We also receive account, payment and technical events from the companies that help run Helio. We do not obtain a child's contact list or precise location from their device.
Children
- A parent or guardian must give the required permission before a child below the applicable consent age uses the learning service, unless a school may authorize educational use. A parent may create a limited child profile to request permission first.
- Children do not sign up with their own email. A parent or school creates their account and gives them a way to sign in.
- We do not use a child's work to train AI models without separate parental permission. School authorization for educational use does not authorize model training.
Website analytics and browser storage
On the public site and adult pages, we use cookieless page analytics. Across the site, we collect performance information with page addresses stripped of query details and account identifiers. Learner pages do not send page analytics.
The browser stores sign-in information and preferences needed to run Helio, such as display settings. Payment checkout may use storage set by our payment provider. You can clear local site data in your browser, though that may sign you out or reset preferences.
Your choices
- Request a copy of your or your child's data from the account's privacy controls or by emailing us.
- Request deletion from the account's privacy controls or by emailing us. We verify requests before processing them. School records and legal duties may affect what can be removed.
- A parent may withdraw permission at any time in the parent account. That stops future child sessions that require it. Ask for deletion separately if you also want existing data removed.
- Email support@helio.education to ask about access, correction, deletion or other privacy rights. We may need to verify your identity. Applicable law may give you additional rights; we will not penalize you for exercising them.
School accounts
For school accounts, the school controls educational records and may handle family requests under its agreement with us. We use school student data only to provide the school service and follow the school's authorized instructions. A school agreement may set different retention or request procedures.
How long we keep it
We keep information only while needed for the purposes above, the school's agreement, or legal duties. Some learning records are removed before an account closes.
Our planned standard limits are 365 days for session logs and 1,095 days for session records and learning evidence. School agreements may set other periods. These limits need an active deletion schedule before this draft can take effect.
Our deletion process is designed to remove active learner records and destroy their encryption key. Deleted database records can remain in backups for up to 14 days. The full process must be verified before this draft takes effect.
Security
We use access controls, encryption and other safeguards to protect information. No online service can promise perfect security; tell us promptly if you think an account has been compromised.
Where information is processed
Our service providers may process information in the United States and other places where they operate. School agreements may set location requirements. Contact us if you need the current provider and location details for a school review.
Payments
Stripe handles card payment details. We receive billing contact information, subscription status, invoices and payment results; we do not receive your full card number.
Additional privacy rights
Depending on where you live, you may have rights to know, access, correct, delete or obtain a copy of personal information, and to appeal a denied request. Email support@helio.education to make a request. We will verify your identity and respond as applicable law requires. We do not sell or share information for cross-context behavioral advertising.
For records held for a school, contact the school first. We will help it respond under its agreement and applicable student record laws. A parent can also contact us, and we will route the request appropriately.
Changes
We will post an updated policy here and give additional notice before a material change takes effect when required. The date at the top identifies this draft; it is not yet an effective date.