Privacy Policy
Effective date: July 14, 2026
Overview
Montessori Engine ("we", "us", or "our") is a SaaS platform built for Montessori educators. We take the privacy of teachers, students, and schools seriously. This policy explains what data we collect, how we use it, and the protections we have in place.
Data We Collect
We collect the following categories of information:
- Account information — your name, school name, and email address provided at signup.
- Authentication credentials — passwords are hashed and never stored in plain text.
- Educational content — activities, observations, lesson plans, and student records you create within the platform.
- Student progress records — a student’s progress on individual Montessori materials (marked as Introduced, Practicing, or Mastered) and the developmental summaries generated from it, recorded over time by their teacher.
- Usage data — page visits and feature interactions used to improve the product. This data is not linked to individual student records.
How We Use Your Data
We use your data solely to provide and improve Montessori Engine. Specifically:
- To authenticate you and maintain your session.
- To store and retrieve the educational content you create.
- To send transactional emails (account confirmation, billing receipts).
- To diagnose bugs and improve platform performance.
We do not use your data or your students' data for advertising, profiling, or any purpose beyond operating the service.
FERPA Compliance
Montessori Engine is designed to support school compliance with the Family Educational Rights and Privacy Act (FERPA). Student records entered into the platform are owned by the school and its authorized educators. We act as a "school official" under FERPA when processing student data on your behalf. We do not disclose student education records to any third party without the written consent of the parent or eligible student, except as permitted by law. Schools remain responsible for obtaining appropriate parental consent before entering student data into any third-party platform, including Montessori Engine.
Data Storage and Infrastructure
All data is stored using Supabase, a managed backend platform built on PostgreSQL and hosted on AWS. Data is encrypted at rest (AES-256) and in transit (TLS 1.2+). Supabase infrastructure is SOC 2 Type II certified. Your data is stored in the United States. We do not transfer personal data to countries without adequate data protection frameworks without appropriate safeguards in place.
Security Measures
We employ multiple layers of security to protect your data:
- Input sanitization — all user-submitted content is validated and sanitized to prevent injection attacks.
- Rate limiting — per-user rate limits are enforced on API requests and AI-generation features to prevent abuse and ensure fair access.
- JWT authentication — access to platform functions requires a valid, signed JSON Web Token verifying your identity on every request.
- Row level security — database-enforced policies ensure users and schools can only access data they are authorized to see, scoped at the database layer rather than relying solely on application logic.
We Never Sell Your Data
We do not sell, rent, trade, or otherwise transfer your personal information or your students' information to any third party for commercial purposes. Ever. Your data is yours.
Data Retention and Deletion
Your data is retained for as long as your account is active. If you cancel your subscription, your data remains accessible for 30 days to allow for export. After 30 days, your account and all associated data are permanently deleted from our systems. You may request early deletion at any time by contacting us at the address below.
Cookies
We use session cookies strictly necessary to keep you logged in. We do not use advertising cookies or third-party tracking cookies.
Changes to This Policy
We may update this policy from time to time. When we do, we will update the effective date above and notify active users by email. Continued use of the platform after changes constitutes acceptance of the updated policy.