CARL
Privacy policy
Your privacy is important to us. This policy explains what we collect, how we use it, and the choices you have.
On this page
At a glance
Operate and improve CARL, support educators, and enable collaborative lesson creation and sharing.
We do not sell personal information, use private application content for targeted advertising, or use your content or personal information to train AI models.
CARL is for teachers and educators. We do not offer student accounts, and we do not knowingly collect personal information from children.
Information we collect
This policy describes how CARL Hub Inc. (“CARL”, “we”, “us”) handles personal information when you use the CARL platform. We collect information you provide directly, and information generated when you use CARL.
Information you provide
- Account information: name, email address, password (stored hashed), role (such as teacher or contributor), and school, district, or organization affiliation. If you sign in with Google or your district’s single sign-on, we receive basic profile details from that identity provider.
- Profile information: bio, subjects, grades taught, region, and the privacy settings you choose for each field.
- Content you create: lessons, worksheets, teaching resources, collections, comments, ratings, uploaded files and images, and supporting details such as titles, tags, and dates.
- Payment information: if you subscribe to a paid plan, payments are processed by Stripe. We do not store full card numbers; we keep your plan, subscription status, and billing history.
- Communications: messages to support and feedback you share.
Information we collect automatically
- Usage data: page views, feature interactions (for example CARL creations counted against plan limits), performance information, and standard service records used to keep CARL secure and reliable.
- District reporting and review information: where your district turns on these features, district-wide activity totals and district-review records. Review records include the saved copy of submitted content, who submitted and reviewed it, decisions, comments, the staff notice that applied, and when it was acknowledged. We do not record an IP address or browser details as part of that acknowledgment.
- Device data: browser type, operating system, language, IP address, and approximate location derived from IP.
- Error diagnostics: crash and error reports collected through our monitoring service (Sentry) to keep the platform reliable.
- Cookies: identifiers described in Cookies and tracking below.
- Consented advertising measurement: on public hicarl.ai pages, Meta click and browser identifiers and PageView events. If you then create an account, we send Meta hashed account identifiers and available IP address, user agent, click, and browser identifiers in one server-side CompleteRegistration event.
How we use your information
- Provide, maintain, and improve CARL features and reliability.
- Power the features you use, including AI-assisted generation, lesson sharing, and recommendations of relevant curriculum content.
- Process subscriptions and send related information such as receipts.
- Send technical notices, security messages, and — with your consent or as permitted — optional digest and product emails you can unsubscribe from.
- Respond to questions and provide customer support.
- Monitor and analyze usage to inform product decisions and prevent abuse.
- Comply with law and enforce our Terms of Service.
We do not sell personal information, use private CARL content for targeted advertising, or use your content or personal information to train AI models. With your consent, we measure whether public-site advertising leads to a new account.
AI features and content
CARL includes AI-assisted tools for lesson planning, content generation, editing assistance, and image generation. When you use these tools, your prompts and the context you choose to include are processed by our systems and sent to third-party AI providers — currently OpenAI and Google — acting as our service providers. Image search features may send your search terms to a search provider (currently Brave).
- No training. We do not use your content or personal information to train AI models. We access AI providers through their business APIs, under terms that do not permit them to use your inputs or outputs to train their models.
- You control the input. You choose what material is shared with AI tools inside CARL. Do not include personal information about students in prompts.
- Outputs are yours to review. Generated content is stored as part of your content and may be inaccurate; review it before classroom use.
Legal bases
Where applicable, we process personal information on the following bases:
- Contract: to provide CARL when you create an account or subscribe.
- Legitimate interests: platform security, fraud and abuse prevention, and product improvement.
- Consent: optional features such as marketing emails and non-essential cookies. You can withdraw consent at any time.
- Legal obligation: where we must retain or disclose information under applicable law.
Data security
We use technical and organizational measures to protect information from loss, misuse, and unauthorized access, disclosure, alteration, and destruction.
- Encryption in transit and at rest where appropriate.
- Hardened hosting environment, access controls, and logging.
- Password hashing and least-privilege practices for staff and system credentials.
- Regular updates and security reviews of our infrastructure.
No method of transmission or storage is completely secure. We work to minimize risk and will notify you and the relevant authorities of incidents as required by law.
Data retention
We keep personal information only as long as necessary to provide CARL, comply with our legal obligations (for example, financial records for subscriptions), resolve disputes, and enforce our agreements. You can delete your account to remove the personal data we store about you; residual copies in backups and limited logs are removed on their normal cycle. Public content you shared may remain available in remixed form without your personal information.
District-review saved copies, comments, and review history are kept for the periods stated in the district’s active notice and approved privacy settings. Reviews in progress are not deleted. When the law requires CARL to preserve information, deletion pauses. Approved copies remain while the district resource is active and are then kept for the stated period after it is archived.
Records used to deliver the Meta registration event retain matching information only while delivery is pending. Hashed identifiers, Meta browser identifiers, IP address, and user agent are erased after the event is sent or can no longer be delivered. A non-identifying record that prevents duplicate delivery is normally removed after 30 days.
Children's privacy
CARL is currently available to teachers, educators, and education organizations only. We do not offer student accounts, and the platform is not directed to children. We do not knowingly collect personal information from children; if you believe a child has provided us personal information, contact us and we will delete it.
- Educators must not include students’ personal information in lessons, uploads, or AI prompts.
- If we introduce student access in the future, it will require school or parent or guardian authorization, and we will update this policy with notice before any change.
Your rights and choices
- Access and update your account and profile information in Settings.
- Delete your account to remove personal data we store, subject to legal retention requirements, any legal requirement to preserve information, and the minimum review history required for a district review you participated in.
- Opt out of non-essential emails using the unsubscribe links.
- Request access to or a portable copy of your data, request correction or deletion, and object to or restrict certain processing, as provided by laws such as PIPEDA, the BC Personal Information Protection Act, or the GDPR.
- Complain to your privacy regulator, such as the Office of the Privacy Commissioner of Canada or the BC Office of the Information and Privacy Commissioner.
To exercise these rights, contact us at hi@hicarl.ai. We may need to verify your identity before acting on a request.
Data residency and transfers
CARL is operated from Canada and hosted on cloud infrastructure that may store or process information in Canada and the United States. Some service providers, including AI and payment providers, process information in other countries or regions, where it may be subject to local laws.
We use contractual and technical safeguards with all service providers to protect personal information, and we aim to support Canadian education privacy requirements, including those that apply to public school districts. Contact us for current information about data locations and subprocessors.
Changes to this policy
We may update this policy from time to time. We will post updates on this page and revise the effective date. For material changes, we will provide additional notice such as email or in-product messaging before the change takes effect.
Contact us
CARL Hub Inc. — Privacy
Email: hi@hicarl.ai