Trust Center
Security & Privacy at Acarya Labs
This page is maintained by the Acarya Labs team to answer common security and privacy questions about the Acarya Labs platform. It describes practices and controls that are currently enabled in the product. It is not an independent audit, certification, or attestation.
Accounts & authentication
- Users sign in with email and password or Google sign-in.
- Sessions are issued and validated by our authentication provider; passwords are never stored by Acarya Labs in plain text.
- Teacher accounts go through a review step before they can create classes.
- Administrative actions require a separate role and are recorded in an admin audit log.
Access controls
- Every data table enforces row-level access rules so users only see records they are entitled to (their own profile, their own classes, their own children, etc.).
- Teachers see only students enrolled in classes they own. Parents see only students they have explicitly linked to via a one-time parent code.
- Sensitive fields such as teacher bank details and verification documents cannot be modified by the teacher after their profile has been approved.
Data we collect & how we use it
- Account data: name, email, phone, preferred language, and role (teacher, student, parent).
- Classroom data: classes, enrollments, notes, assignments, quizzes, attendance, and live-session records created by teachers and students.
- Teacher onboarding data: qualifications, identification documents, and payout details (used only for verification and payments).
- We use this data to operate the product. We do not sell personal data.
Sensitive data handling
- Enrollment-key attempts and parent-link codes are masked when written to internal logs so the raw values cannot be recovered from those logs.
- Quiz submission records are sanitized before storage to prevent correct-answer data from being persisted alongside a student's response.
- Recordings, uploaded notes, and identity documents are stored in private storage buckets and served via short-lived signed URLs.
Subprocessors & integrations
- Database, authentication, storage, and serverless functions: Supabase.
- Live-video infrastructure: LiveKit.
- Email delivery: our transactional email provider, used only for product emails.
- AI features (lesson plans, quiz generation, parent-email drafts) are powered by model providers contracted by Acarya Labs.
Retention & deletion
- Account, classroom, and submission data is retained while your account is active.
- Deleting a class removes its enrollments, notes, assignments, announcements, live-session records, and attendance entries.
- To request deletion of your account or specific data, contact us using the address below.
Reporting a security issue
- If you believe you have found a vulnerability, please email us before disclosing it publicly so we can investigate and respond.
- Please include reproduction steps, the impact you observed, and any account or request identifiers that help us trace the issue.
Contact
- General privacy questions and data requests: the Acarya Labs team.
- Security reports: the Acarya Labs team (please mark the subject as "Security").
- We aim to acknowledge security reports within a few business days.
This page reflects the current product. Practices may evolve as the platform changes; we update this page when material changes are made.