Bill 194 Compliance Matrix

Data must be stored in Canada

All data hosted in AWS Montreal (ca-central-1)

No transfer to foreign jurisdictions without consent

Student records never leave Canada. Requests to AI model providers (activity generation, translation, and the optional in-activity helper) are processed in the United States and carry no student names, usernames or account identifiers. Teachers can switch the helper off per activity.

Collect only necessary personal information

Student accounts use randomized usernames and no PII. In optional live sessions, students may type a first name or nickname; these are shown to the teacher and purged after 30 days.

Purpose limitation for collected data

Data used solely for educational progress tracking. No marketing or advertising.

Retention limitation

Live-session names/responses are auto-purged after 30 days. Students can delete their own account at any time; teachers and boards can request deletion of any student or class. Teachers can close their account from Settings, which anonymizes the profile immediately.

No collection of student names

Student accounts use random usernames. Live sessions may collect an optional, teacher-visible nickname that is purged after 30 days.

No collection of student emails

No email required. Sign-in is a random username plus a three-emoji code the student chooses, stored as a bcrypt hash.

No collection of biometric data

Not collected. No facial recognition, voice, or fingerprint data.

Parental consent for students under 13

Handled under COPPA's school-consent model: the school consents to educational use on parents' behalf and notifies families through its normal technology communications. We collect no student contact details, so there is no direct-to-parent collection.

Data encrypted in transit

TLS 1.2 or higher (1.3 where supported) for all connections. HTTPS enforced.

Data encrypted at rest

AES-256 encryption on database storage.

Secure authentication

Teachers: Supabase Auth with bcrypt hashing. Students: emoji codes stored as bcrypt hashes (never plaintext).

Access controls

Row-level security (RLS) policies. Teachers only see their own classes.

Student nicknames protected

Encrypted in the teacher's browser with AES-256-GCM. The server stores ciphertext only and never receives the key.

Key derivation

A 32-character random key is generated on the teacher's device the first time they save a nickname and is never sent to us. PBKDF2-SHA256 derives the AES key from it (1,000 iterations for device keys; 600,000 for legacy typed passphrases).

Decryption capability

Only the teacher's device, or another device they paste the key into, can decrypt. If the key is lost the nicknames cannot be recovered by anyone, including us.

Clear privacy policy

Published at /privacy. Plain language. Reviewed periodically.

Data Processing Addendum available

Available at /dpa for institutional customers.

Contact for privacy inquiries

support@argraide.com

Vetted subprocessors only

Supabase (Canada), Vercel (no student data), Stripe (teacher payments), PostHog (teacher pages only), Resend (teacher email), Google Maps (teacher signup), and Google, OpenAI and Anthropic for AI. Full table in the DPA.

AI processing disclosure

AI generates activities from teacher prompts. The optional in-activity helper sends a student's typed question, the text on their screen and their progress in that activity to the AI provider, with no student identifiers. Teachers can turn the helper off per activity; an organization-wide switch is planned.