Privacy Notice

Who is responsible for your data

ScaffoldED360 is operated by ExcelUp Lab LLC ("ExcelUp Lab"), trading as ScaffoldED360. For your own account data — name, email, login credentials, plan and billing records, support messages, device and IP information, and usage telemetry — ExcelUp Lab LLC is the data controller. For the activity content you upload on behalf of a school, we act as processor for that school. Privacy contact: privacy@exceluplab.com.

Who we share data with

• Service providers and subprocessors: cloud hosting and edge delivery, managed database, authentication and private file storage, transactional email, and an enterprise AI gateway used to generate scaffolded content (no training on your content).
• Stripe, our payment processor, for the sale of subscriptions, payments, subscription management, and invoicing. Stripe collects your payment details directly; we never see or store card numbers.
• Professional advisers such as legal and accounting providers, under confidentiality.
• Authorities, where disclosure is required by law.

Security and cookies

We use appropriate technical and organisational measures, including encryption in transit and at rest, row-level access controls, and short-lived signed links for files. We use essential cookies and local storage for sign-in and preferences, plus privacy-preserving product analytics; we do not run advertising cookies. You can clear or block cookies in your browser, though sign-in will not work without the essential ones.

What you should never upload

Use anonymous learner descriptions. Do not upload student names, IDs, contact information, medical information, disciplinary records, complete IEPs, complete Section 504 plans, or other personally identifiable student information.

What we store

• Your account email and the profile details you enter.
• Activity files you upload, kept in a private storage folder scoped to your account.
• Extracted activity content, generated versions, and export records.
• Anonymous learner-support profiles that you name and describe, including the pedagogy/andragogy framework, target reading level, and accommodation supports you select for them. These describe instructional delivery, not individual students.

How your content is protected

• Every record is restricted to the account that created it.
• Uploads live in private buckets and are reached only through short-lived signed links.
• Server-side processing verifies the signed-in user before reading or writing any record.
• Student data is never used to train models.

Deleting your data

You can delete individual activities, versions, and learner profiles at any time. From account settings you can also submit an account-deletion request, which removes your account records and uploaded files.

EU / EEA and UK users (GDPR)

When a school or educator in the EU, EEA, Switzerland, or the UK uses ScaffoldED360, the school or educator is the data controller for the content they upload and ExcelUp Lab acts as the data processor, processing that content only on documented instructions to deliver the service.

Lawful basis

• Contract: account creation, authentication, storing your activities, and generating scaffolded versions.
• Legitimate interests: service security, abuse prevention, and aggregate usage analytics that are not used to profile individuals.
• Legal obligation: retaining limited billing and audit records where required.

Your rights

You can request access, rectification, erasure, restriction, portability, or object to processing, and you may withdraw consent where consent is the basis. Account settings support export and deletion directly; for anything else, email privacy@exceluplab.com. We respond within one month. You may also lodge a complaint with your local supervisory authority.

International transfers

Our hosting, database, and AI processing run on infrastructure that may be located outside the EEA, including the United States. Those transfers rely on the EU Standard Contractual Clauses (and the UK Addendum where applicable), together with encryption in transit and at rest.

Subprocessors

• Cloud application hosting and edge delivery.
• Managed database, authentication, and private file storage.
• An enterprise AI gateway used to generate scaffolded content, with no training on your content.

Retention

Activities, versions, and exports are retained until you delete them or close your account. Account deletion purges stored files and records; limited audit and billing entries may persist where legally required.

Automated decision-making

ScaffoldED360 does not grade students, score assessments, or make placement decisions. AI output is a draft for an educator to review, so no decision with legal or similarly significant effects is made automatically.

Schools that need a signed data processing agreement can review our Data Processing Agreement.