NextSchool is operated from Ontario, Canada. We are committed to protecting your privacy and ensuring transparency about how we collect, use, and manage your personal information.
Privacy Officer: Our Privacy Officer is the CEO of NextSchool. Contact: [email protected].
NextSchool operates in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) (federal) and Quebec's Act respecting the protection of personal information in the private sector (Law 25). We are committed to transparency, granular consent, and your right to access, correct, delete, port, or withdraw consent for any personal information we hold.
When you use NextSchool, we collect the following information:
Important: We collect information about children as provided by their parent or guardian. Children do not directly create accounts or use the platform.
When school administrators claim and manage their profiles, we collect:
We use your data for these specific purposes:
Parent Data:
School Data:
Aggregated/Anonymized Data:
Critical Privacy Commitment: Parent family profiles are NEVER shared with schools unless you explicitly initiate contact (such as sending an inquiry).
We take children's privacy seriously. Here's how we protect it:
Here's how we handle your data:
What We Don't Share:
What We May Share:
The following companies process personal data on our behalf. Each operates under a data processing agreement with NextSchool and is prohibited from using your data for any purpose beyond what we instruct.
Cross-border processing notice
All of our current sub-processors are based in the United States: Supabase, Vercel, OpenAI (via OpenRouter), Anthropic (via OpenRouter), OpenRouter, Resend, Stripe, and Sentry. As a result, your personal data is processed in the United States and may, in narrow circumstances, be subject to US law including the CLOUD Act, which can compel a US provider to disclose data in response to a lawful order. We have data processing agreements with every sub-processor and rely on Standard Contractual Clauses or equivalent transfer mechanisms where required.
AI Inference — OpenRouter (United States)
Purpose: Generating personalized school recommendations through our AI consultant.
Data transmitted: Pseudonymized conversation content including educational preferences (child's grade, learning style, school priorities). We replace names with placeholders and reduce location to city/region level before transmission — your child's name, specific medical diagnoses, and precise address are not sent to OpenRouter.
Retention by OpenRouter: Prompts are used for inference only and are not retained for training without explicit consent. See OpenRouter's Privacy Policy.
| Service | Country | Purpose | Data Shared |
|---|---|---|---|
| Stripe | United States | Payment processing | Email address, subscription status |
| Resend | United States | Transactional email delivery | Name, email address |
| Sentry | United States | Error monitoring and performance | Anonymized error events — emails and IP addresses are stripped before transmission |
| Vercel | United States | Platform hosting and edge network | IP address (in transit only); page view metrics with your consent |
| Google Analytics / Ads | United States | Analytics and conversion measurement | Anonymized events (with your consent); hashed email only on purchase and only with your explicit ad consent |
| Supabase | United States | Database and authentication | All data stored by NextSchool (encrypted at rest, AES-256) |
| OpenAI (via OpenRouter) | United States | AI inference (text generation) | Pseudonymized conversation content; no training |
| Anthropic (via OpenRouter) | United States | AI inference (text generation) | Pseudonymized conversation content; no training |
We retain personal information only as long as necessary for the stated purpose. The table below summarizes our retention schedule.
| Data Category | Retention | Notes |
|---|---|---|
| Account & family profile | Until account deletion | Permanently deleted on request |
| Conversations | 24 months; inactive accounts anonymized at 12 months | Deleted on request; per-conversation delete available |
| API logs (api_logs) | 30 days | Automatically purged |
| Error logs (error_logs) | 60 days | PII scrubbed before storage |
| LLM logs (llm_logs) | 90 days | Pseudonymized; PII scrubbed |
| Search logs (search_logs) | 90 days | User identity removed after 30 days |
| User events (user_events) | 90 days, then anonymized | Aggregated metrics retained indefinitely |
| Consent records | Until account deletion | Retained for compliance purposes; included in your data export |
Account Deletion: When you delete your account, all personal data is permanently removed from our systems. Data held by third-party sub-processors (Stripe, Sentry, etc.) is subject to their own retention policies.
We use cookies to:
You can control cookies through your browser settings. Disabling some cookies may affect platform functionality.
You have the following rights regarding your personal information:
How to exercise these rights: email [email protected], or use the controls in Settings → Privacy. We respond within 30 days.
For more on how recommendations are generated, see How recommendations work.
If you suspect a security incident affecting your data, contact us immediately at [email protected]. NextSchool will notify affected users and the relevant regulators (Office of the Privacy Commissioner of Canada, and Commission d'accès à l'information du Québec where applicable) of any breach posing a real risk of significant harm, in accordance with PIPEDA and Law 25.
If your concern is not resolved to your satisfaction, you may file a complaint with:
NextSchool complies with Canada's Anti-Spam Legislation (CASL):
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws.
When we make material changes, we will notify you by updating the "Last Updated" date and, for significant changes, by email or through a notice in the platform. For changes that affect how we process children's information or introduce new third-party data sharing, we will require you to re-acknowledge the updated policy before continuing to use NextSchool.
If you have questions about this Privacy Policy or how we handle your data, please reach out:
Privacy Officer:
We will respond to access, correction, and deletion requests within 30 days. You may also file a complaint with the Office of the Privacy Commissioner of Canada.
General Questions:
Visit our Contact PageA record of material changes to this policy. Minor wording clarifications are not listed.
May 7, 2026
April 2, 2026
February 20, 2026
Initial privacy policy published.
