Privacy Policy

Effective: September 28, 2026 · Version 1.5

PrepIEP (the "Service") is a product of Kova Systems LLC, a Massachusetts limited liability company ("Kova Systems," "we," "our," or "us"). This Privacy Policy explains what personal information we collect from you, how we use it, who we share it with, how long we keep it, and the rights you have over it. Capitalized terms not defined here have the meaning given to them in our Terms of Service.

This policy applies to the PrepIEP website at prepiep.com, the PrepIEP web application, and the PrepIEP mobile applications (collectively, the "Service"). PrepIEP is offered to residents of the United States who are 18 years of age or older. We do not knowingly market to or accept users from the European Union, United Kingdom, EEA, Switzerland, or Canada.

Educational reference, not legal advice. PrepIEP surfaces patterns and questions for you to raise with your IEP team. Educational reference, not legal advice.

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and authentication credentials. If you sign in with Google or with Sign in with Apple, we receive only the basic profile fields you authorize (name, email, and a stable user identifier) — we do not access your Google Drive, your contacts, your iCloud, your calendar, or any other data from those providers.

1.2 Eligibility & Compliance Attestations

At signup we collect your self-attestation that you are at least 18, reside in the United States, and are the parent or legal guardian authorized to manage the child’s records. A court-appointed guardian is included when that appointment gives you legal guardianship. These are declarations, not independent verification of your identity, residence, or authority.

1.3 IEP Documents and Related Education Records

When you upload an IEP, an evaluation report, a Notice of Procedural Safeguards, a Prior Written Notice, related correspondence, or any other education record, we process the document to extract goals, services, accommodations, evaluation findings, and similar structured data. The uploaded file and the extracted data are stored in your private workspace and are accessible only to you and to the limited subprocessors described below.

You may upload records only for a child whose records you are authorized to manage as their parent or legal guardian. Independent advocates, schools, clinics, and other organizations are outside the current supported use. See §4.

1.4 Chat & AI Interactions

Questions you ask our AI advisor, prompts you submit to our copilots, generated meeting agendas, suggested goals, suggested requests, suggested rights questions, and the AI responses themselves are stored in your account to give you conversation history, continuity, and the ability to revisit prior sessions. They are also retained, in line with §7, as a defensive and service-quality record for the limited purposes described in §§3 and 10.

1.5 Billing Information

If you subscribe to a paid plan, our payment processor (Stripe, Inc.) collects and stores your payment card number, expiration date, and billing postal code on its own systems. We never see or store your full card number. Stripe returns to us a non-sensitive customer identifier, the last four digits of the card, the card brand, the renewal status of your subscription, and invoice metadata (amount, date, receipt URL). See §6 (Subprocessors).

1.6 Device and Diagnostic Data

Our infrastructure processes connection and technical information needed for authentication, security, and reliability. Application diagnostics use bounded error codes and technical metadata rather than document text, prompts, responses, child names, or raw error messages. Backend Sentry error reporting is configured to receive only bounded diagnostics. We have not yet verified end-to-end event delivery, alert routing, or the vendor account’s region, retention, and contractual settings. Client configuration can differ from the backend; we do not claim verified client delivery.

1.7 Usage Data

We use Google Analytics 4 to understand aggregate usage and content performance on our public website. Google Analytics starts in Consent Mode with analytics and advertising storage denied. If you accept analytics cookies, we may collect public-page path, referrer, device/browser metadata, coarse geography, and public-site interaction events.

We measure the authenticated product funnel in a separate, first-party ledger stored in our Firebase environment. It records server-confirmed milestones such as signup completion, first successful meeting-pack export, checkout start, completed purchase, paid-plan upgrade, cancellation, and full refund. Each row contains only a random per-account identifier, event and timestamp, first-event flag, environment, and limited plan, source, country, or status values. These product-funnel events are not sent to Google Analytics.

Neither measurement stream includes child names, disability details, uploaded document text, chat text, meeting notes, district names, meeting or document identifiers, Firebase user IDs, Stripe or customer IDs, or other free-form education-record content. PrepIEP does not emit Google Analytics page views or custom events on authenticated app routes that can display IEP content, including /understand, /documents, /build, /build/requests, /requests, /requests/wording, /goals, /track, /pack, /account, and /admin. We do not run session replay or behavioral-profiling tools.

You can reject analytics cookies in the banner. We also honor Global Privacy Control (GPC) as a rejection signal under §9 (California).

1.8 What we do not collect

We do not collect biometric identifiers, voiceprints, faceprints, precise location, contact-list data, calendar data, or social-graph data. We do not place advertising-network cookies or pixels. We do not run social-media login providers other than the two named in §1.1. We do not buy, license, or otherwise obtain personal information about you from data brokers.

2. How We Use Your Information

We use the categories of information described in §1 for the following purposes only:

Uses we prohibit. PrepIEP does not sell or rent personal information, use it for targeted advertising, or build profiles for sale. PrepIEP does not train or fine-tune models on education records, prompts, chat, or generated outputs. Limited review to improve prompt instructions and safety behavior is described in §§3 and 10. The AI provider’s separate terms and the retention limits in §3 also matter.

Optional reminder emails. If you turn on email alerts in Notifications, we use your verified account email and selected time zone to send reminder emails through our Google Workspace mailbox. Messages contain generic reminder categories and a sign-in link, not student names, IEP text, saved questions, or school-response notes. You can turn alerts off in the app or use the unsubscribe link. Minimal delivery receipts are retained for up to 90 days plus the time needed for automatic deletion; they contain no email address or message text. Delivered mail is also handled by Google Workspace and your email provider under their terms and retention settings.

3. AI Processing and Data Use

Launch-status clarification: October 9, 2026. The temporary fictional-document restriction has been removed for the supported family use in §4. This does not change our processing purposes, providers, retention commitments, or no-training commitment.

We send document content and prompts to Gemini models through Google Cloud Vertex AI to extract information and generate responses. Results return to your workspace and may be retained as described in §§7 and 10. PrepIEP does not use this content to train or fine-tune models.

Parent-directed use. Adult U.S. parents and legal guardians may upload records they have authority to manage for the family preparation purposes described in this policy. Uploads are private to the authorized account and processed by our service providers as described here; they are not public documents. AI can omit or misread information. Check results and source references against the original before relying on them. This service does not amend the school’s official record or make educational decisions for your child.

AI provider update — October 7, 2026: AI requests use U.S. Vertex AI endpoints: us-central1 for Gemini 2.5 and embeddings, and the us multi-region for Gemini 3.8. We authenticate through our server identities. Google’s Cloud service terms prohibit training or fine-tuning on customer data without permission or instruction. Google may retain data for safety and abuse monitoring; default in-memory caching can retain data for up to 24 hours. These settings and Google’s retention terms do not establish zero retention or certify PrepIEP’s legal compliance.

Authorized reviewers may examine limited AI records to investigate reported errors and improve PrepIEP’s prompt instructions and safety behavior. This is separate from model training. Material changes to our data-use practices will follow §14.

4. Supported Family Use and Education Records

PrepIEP is offered directly to adult parents and legal guardians, including court-appointed legal guardians, who have authority to manage their child’s records. You choose what to upload and which features to request. We do not contact the school or send records to it on your behalf.

Independent advocacy, school, district, clinic, and institutional use is not supported. A court appointment to make educational decisions does not by itself establish eligibility unless you are also the child’s legal guardian. We have not established the contracts and legal review needed for these additional uses.

We do not represent PrepIEP as FERPA- or HIPAA-certified, and a vendor’s security certifications do not establish our compliance. The Department of Education describes FERPA and the rights it protects. Ask a qualified adviser about how law applies to your records and role.

You can view and delete workspace data through the app and request a portable export by emailing contact@prepiep.com. See §8.

5. Children's Privacy (COPPA)

PrepIEP is for parents and legal guardians who are 18 or older. PrepIEP is not directed to, and is not intended for use by, children under 13. We do not knowingly collect personal information directly from a child under 13 in connection with the Service.

The IEP documents and related records you upload typically describe a child, but they are uploaded by you, the parent or guardian, in the exercise of your own rights. You are responsible for the accuracy of those records and for the lawfulness of your possession of them.

The FTC's amended COPPA Rule adds stronger requirements for covered child-directed services, including limits on retention, separate opt-in consent for targeted advertising or other third-party disclosures, and an expanded definition of personal information that includes biometric identifiers. PrepIEP is parent-facing, does not knowingly collect information directly from children under 13, does not collect biometric identifiers, does not use targeted advertising, and (per §3) does not train AI models on customer-supplied data of any kind, including data about children that a parent uploads.

If you become aware that a person under 13 has somehow created an account, please email contact@prepiep.com and we will close the account and delete the data within seven (7) days.

6. Subprocessors

We use a small set of subprocessors to deliver the Service. The current, versioned list — including each subprocessor's name, purpose, data category, region, retention, and data-use attestation — is published at prepiep.com/subprocessors and is incorporated into this policy by reference.

The list, in summary:

We will give at least 30 days' advance notice on the subprocessors page and via in-app notice before adding a new subprocessor that processes user-uploaded education records or AI-related content.

7. Data Retention

We retain personal information only as long as we have a legitimate business or legal reason to do so. Specifically:

Deleting an account, workspace, or document starts removal from active stores and blocks in-flight AI work from recreating it. Cleanup can require retries. Minimal deletion receipts containing user/object identifiers, cleanup state, and timestamps, but no document content, remain for 90 days after completion to prevent replay. Cleanup version records can remain while the account exists. Production database recovery history, daily backups, and storage soft-deleted copies have seven-day recovery windows, so a deleted record can remain in those copies until they expire. These recovery copies are not ordinary workspace access. Required security logs and billing records follow their separate retention periods above.

If billing-provider cleanup needs a retry or manual recovery, we retain a minimal cleanup record containing an account identifier, provider object identifiers, timestamps, and retry state. It contains no education text or email address and is normally removed when cleanup finishes. An unresolved provider response can require manual recovery; that record remains until resolved rather than expiring automatically after 90 days.

8. Your Rights

Regardless of where you live in the United States, you have the right to:

To exercise any of these rights, use the relevant in-app Account, document, billing, and deletion controls or email contact@prepiep.com. We will respond within 45 days. We do not charge for these requests. We will not retaliate or downgrade your service for exercising them.

9. Notice to California Residents

This section applies to California residents and supplements the rest of this policy for purposes of the California Consumer Privacy Act (CCPA), as amended by the CPRA, and the California Privacy Rights regulations effective January 1, 2026.

9.1 Categories of personal information

In the preceding 12 months we have collected the following statutory categories of personal information from California consumers:

We use sensitive personal information solely to deliver the Service you requested, to keep it secure, and for the purposes permitted by Cal. Civ. Code §1798.121(a). We do not use it to infer characteristics about you for any other purpose.

9.2 Sale or sharing of personal information

We do not "sell" personal information for money. We do not "share" personal information for cross-context behavioral advertising. We have not done so in the preceding 12 months and we do not plan to. Because we neither sell nor share, no opt-out from those activities is required to exercise the right not to have your data sold or shared. If we ever add a sale or sharing activity, we will add the legally required opt-out mechanism before that activity begins.

9.3 Global Privacy Control

We treat the Sec-GPC: 1 browser signal as a valid opt-out signal under California law (Cal. Code Regs. tit. 11, §7025). When we detect Sec-GPC: 1 from your browser, we will (i) not enable optional analytics that pass identifiers and (ii) suppress any future "sale or share" mechanic by default. You may also reject optional analytics from the consent banner.

9.4 Sensitive PI category — education records

Education records uploaded by parents (IEPs, evaluations, related correspondence) are sensitive personal information. We process them only as needed to deliver the features you have requested, retain them only as described in §7, and never use them to infer demographic, health, religious, sexual-orientation, biometric, or precise-location characteristics about you or your child.

9.5 No financial incentive

We do not offer financial incentives, loyalty programs, price differences, or service-level differences in exchange for personal information. Pricing is set by plan tier and applies to all users equally regardless of any privacy choices you exercise.

9.6 California rights

California residents may exercise the rights of access, deletion, correction, portability, opt-out, and limitation of use of sensitive PI described in §8 above. You may use the relevant in-app controls or email contact@prepiep.com. You may designate an authorized agent to act on your behalf; we will require written, signed authorization and a verification step with you before acting.

9.7 California "Shine the Light"

We do not share personal information with third parties for those parties' direct-marketing purposes. We do not need a Shine the Light disclosure on that ground.

9.8 Privacy contact

Email contact@prepiep.com for privacy requests. This is one contact channel; we do not describe the same inbox as a second or postal-equivalent channel.

10. AI Records — Defensive Retention

For 90 days after each AI-mediated interaction, we retain a restricted defensive and service-quality record that may include: your user identifier, a bounded summary of the input, the prompt-template version, the generated response subject to storage limits, relevant jurisdiction and source metadata, and the timestamp. This record exists so that, if a parent later disputes what the AI did or did not say, we can investigate the interaction, and so that authorized reviewers can perform the limited safety and quality review described in §3. Records are scheduled to expire after 90 days. Removal uses asynchronous expiry and scheduled cleanup, so physical deletion can finish later. Account deletion also removes attributable active AI, audit, feedback, and chat records.

11. International Transfers

Our primary Firebase infrastructure runs in the United States. AI requests are configured for U.S. Vertex AI endpoints. Google’s separate safety and abuse-monitoring retention terms also apply, as described in §3. If you access the Service from outside the United States, your information is necessarily transferred to and processed in the United States and may be processed in those additional locations. We do not target, market to, or knowingly accept users from the European Union, the United Kingdom, the European Economic Area, Switzerland, or Canada, and require a United States residence self-attestation at signup. If you reside in one of those jurisdictions, please do not use the Service.

12. Security

The Service runs on Google Firebase, which provides:

No system is perfectly secure. You are responsible for keeping your account credentials confidential. If you believe your account has been compromised, contact contact@prepiep.com immediately.

13. Data Breach Notification

If we determine that an incident has resulted in unauthorized access to or acquisition of your personal information, we will notify affected users by email without unreasonable delay, and in any case within 72 hours of confirming the scope of the incident, consistent with applicable state breach-notification laws and Massachusetts G.L. c. 93H. The notice will describe the categories of information involved, the steps we have taken in response, and any actions you can take to protect yourself. Where required, we will also notify the relevant Attorneys General and other regulators.

14. Changes to This Policy

We may update this policy from time to time. If we make a material change, we will (i) update the "Effective" date and version number at the top, (ii) keep prior versions available on request by emailing contact@prepiep.com, (iii) provide at least 30 days' advance notice via email and an in-app notice before the new version takes effect, and (iv) for changes that meaningfully expand the categories of data we collect or the purposes for which we use them, ask you to re-acknowledge the policy at next sign-in.

Non-material changes (typos, clarifications, link fixes, the addition of a new subprocessor of the same kind as an existing one) take effect on posting and are reflected in the version number's minor digit.

15. Contact

For privacy questions, data-subject requests, or to exercise any right described in this policy:

Effective: September 28, 2026 · Version 1.5. Prior versions are available by emailing contact@prepiep.com.