Privacy Policy

This page explains the above in plain English. If anything is unclear, email hello@mychatiep.com.

Who we are

MyChatIEP is a Florida-based service that helps families and advocates navigate Individualized Education Programs (IEPs) and Section 504 plans. We provide educational information; we do not provide legal advice.

What we collect

Account information

When you create an account we store your email address and (if you sign in with Google) your Google profile name and picture. Passwords are hashed using industry-standard algorithms and never stored in plain text.

Case data

When you create a case in the app we store whatever you choose to put in it: your child’s first name (or initials if you prefer), school district, IEP/504 status, evaluation history, accommodations, and any documents you upload (evaluations, prior IEPs, Prior Written Notices, letters, and so on). All case data is yours; we keep it only to power features in the app.

Conversations

Messages you send to the AI assistant and the responses you receive are stored, linked to your account, so you can return to them later.

Usage data

We log basic operational data: when you signed in, which features you used (chat, letter generation, meeting prep), and approximate counts for tier limits. We do not track your reading time, mouse movements, or anything that resembles surveillance.

Payment data

If you upgrade to a paid plan, billing is handled by Stripe. We never see or store your card number; Stripe gives us a customer ID, plan, and status. Stripe’s privacy policy is at stripe.com/privacy.

What we do NOT collect

• Cookies for advertising or cross-site tracking. We use only first-party cookies needed for sign-in.
• Location data beyond the country/region of your sign-in (used for security alerts only).
• Social-media profiles other than Google (when you choose to sign in with it).
• Any third-party analytics that build a profile of you across sites.

Cookies

We use only first-party cookies, and only the ones the app needs to function:

• A session cookie that keeps you signed in (set by our authentication backend, Supabase).
• During our invite-only preview, a short-lived cookie that remembers you entered a valid access code.

We do not use advertising cookies, cross-site trackers, or third-party analytics that profile you across the web. Our error-monitoring tool (Sentry) is configured not to set cookies or collect your IP address. Because we set no tracking cookies, MyChatIEP does not show a cookie-consent banner.

How we use what we collect

• To provide MyChatIEP: signing in, creating cases, running AI features, generating letters.
• To bill you (only if you upgrade) via Stripe.
• To send transactional email: sign-up confirmation, password reset, deadline reminders you’ve explicitly enabled.
• To enforce tier limits (e.g. the monthly chat message cap on the Free tier).
• To prevent abuse (rate limits, fraud signals).
• To improve the product. We look at aggregate usage only, not your individual case data.

We do not use your case data, chats, or documents to train any AI model. Not ours, not anyone else’s.

Who we share data with

We use a small set of vetted sub-processors to run the service. Each one only sees the slice of data they need:

Each provider is contractually bound (via standard data-processing agreements) to use the data only for the purpose we specify, not to sell it, and not to retain it longer than needed.

We do not sell, rent, or trade your information to third parties for any reason.

Calendar and video integrations

Advocates can connect their own Google Calendar, Zoom or Dialpad account. Each connection is optional, made by the advocate on the provider’s own consent screen, and removed from Settings at any time. We ask for the smallest set of permissions each feature needs.

Google Calendar

• What we do with it: create, move and delete the calendar event of each appointment you make in MyChatIEP (with a Google Meet link when you ask for one); show your other calendar events next to your appointments in your agenda, and change the title or time of one only when you do it from the agenda; read when you are busy, without reading the events, so your public booking page does not offer those times.
• What we store: an encrypted token, and for each appointment the id of its Google event and its Meet link. Your other events are read when you open the agenda and are not stored. Disconnecting in Settings revokes our access and deletes the token.
• What we never do: we do not send Google Calendar data to AI providers or use it to train AI models, we do not use it for advertising, and we do not sell or share it. Only you see your events; our team does not read them unless you ask us to for support, or the law or security requires it.
• MyChatIEP’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Zoom and Dialpad

• What we do with it: create a meeting for each appointment you choose it for, move it when the appointment moves, and delete it when the appointment is deleted. We read your account id and email only to show which account is connected.
• What we store: encrypted access tokens, and for each appointment the meeting id and its join link (the link is sent to your client with the appointment). We do not read your other meetings, recordings, chats or contacts.
• When it is deleted: disconnecting in Settings revokes our access and deletes the tokens; removing the MyChatIEP app from your Zoom account does the same. Meetings already made stay in your account, which you control.

Children’s data

MyChatIEP is designed for parents, guardians, and advocates of children with disabilities. The account holder must be 18 or older. The app contains information about children, but the children themselves do not have accounts and we never market to them.

We treat case content involving minors with the same protections as adult data, and in many cases stricter, because the data is sensitive. You decide what to put in (a first name, initials, or “my child” all work); we encourage minimizing identifying detail to what’s necessary for the AI to help you.

How long we keep your data

We keep your data while your account is active. When you delete your account from Settings → Delete Account, it enters a 30-day pending-deletion window. During those 30 days you can sign back in and cancel the deletion, and you can export everything you’ve put in. We email you a reminder about ten days before the window closes.

After 30 days we permanently purge your case data, chats, documents, and account record. We keep only a minimal record required for legal, tax, and security purposes (for example, that an account existed and its billing history) — never your child’s information or case content. Stripe records of past charges are retained per Stripe’s policy and applicable tax law.

Our database backups roll on a 30-day cycle. Even after deletion, a backup snapshot may briefly contain residual data; backups are encrypted and accessed only for disaster recovery.

Your rights

You can:

• Access all your data via the dashboard at any time.
• Export your case data as JSON from a case page (Case → Export).
• Correct anything inaccurate by editing it directly in the app.
• Delete your entire account from Settings → Delete Account.

If you live in California, the EU/UK, or another jurisdiction with formal data-rights laws, you have the same rights plus the ability to request a copy of your data in writing. Email hello@mychatiep.com with “Privacy request” in the subject line and we’ll respond within 30 days.

We do not “sell” personal information under California law.

Security

We use industry-standard security practices: TLS 1.2+ for all traffic, encryption at rest in Supabase, row-level security enforced by your account ID, and an isolated production environment separate from any test data. Provider API keys (OpenAI, Anthropic, Google) are encrypted with AES-256-GCM before being stored.

Access to your content inside our team is tightly limited. Most staff see only redacted data. A small number of authorized administrators can access account content (including chats and documents) when it is genuinely necessary to diagnose a problem or investigate abuse, and every such access is recorded to an audit trail. We never browse your data for any other reason.

No system is unbreakable. If we ever suffer a breach affecting your data, we will notify you by email within 72 hours of confirming it, per Florida’s Information Protection Act and similar laws.

International users

MyChatIEP is operated from the United States. Data is stored on US-based servers (Supabase US-West and US-East regions; AWS US-East-2 for transactional email). If you access the service from outside the US, your data will be transferred to and processed in the US.

Changes to this policy

If we make material changes, we will email account holders at least 14 days before the new policy takes effect. The “Effective” date at the top of this page always reflects the latest revision.

Contact

Questions about privacy: hello@mychatiep.com.