Hope Street Group Privacy Policy

Our Privacy Principles

• We are here to serve students. The data we collect is meant to serve you and your students. We do not collect more than what is necessary to serve you and the greater mission of helping every student move from overwhelm to meaningful action for their future
• We strive to be transparent and clear about our data collection and use practices so that you can easily understand what data is collected and how it is used.
• You have control over your data and can request your data to be deleted at any time.
• We keep your data safe. We implement cybersecurity best practices to safeguard your data and store it on US-based servers.
• We do not sell your data to third parties. We will not share your data with technology vendors for purposes other than those critical to providing our services.‍
• We comply with applicable laws and regulations, including FERPA and COPPA, and take student data privacy seriously. We do not collect personal data from students under 13 without the consent of their school.

‍

Overview

Hope Street Group (“Hope Street,” “our,” “us,” or “we”) is a US-based 501(c)(3) charitable nonprofit organization. We are organized under the laws of the State of California. We operate the Hope Street platform, including our website at www.hopestreetgroup.org, our mobile application, and our AI-powered educational tools and services (collectively, the “Service”). As a nonprofit, we use the information we collect to provide our Service and to fulfill our mission of helping every student move from overwhelm to meaningful action for their future.

This Privacy Policy explains how we collect, use, disclose, and protect information when you access or use our Service. It applies to all users of our Service, including students, teachers, school administrators, and other visitors.

In addition to federal laws such as FERPA and COPPA, we comply with applicable state student data privacy laws, including the California Student Online Personal Information Protection Act (SOPIPA), in the states where we operate. Throughout this Policy, we distinguish between two categories of student data, which together make up "Student Personal Data":

"Account-Level PII" refers to information that directly identifies a student, such as their name, email address, student identifier, school, grade level, and graduation year. This information may be provided by the student, their school, or a Single Sign-On service. Account-Level PII also may include “education records” as defined by the Family Educational Rights and Privacy Act (“FERPA”) or other information protected by applicable state student data privacy laws.

"Student-Generated Content" refers to information created by a student through their use of the Service, including messages exchanged with our AI-powered tools, career interest selections, resume drafts, and other content produced during platform activities. Student-Generated Content may contain personally identifiable information if a student voluntarily discloses it during use.

In addition, “Technical Data” refers to information related to your device type, operating system, browser type, IP address, and general location (country or region). We do not collect precise geolocation data, including GPS coordinates, Wi-Fi-based location, or Bluetooth-based location data.

Collectively, all information collected is referred to as “Collected Information.”

‍

Collection of Information

We collect information in the following ways, depending on how you use the Service:

Information You Provide to Us:

• Account registration information. Depending on how your account is created, we may collect your name (optional when joining via class code), email address (via Google Single Sign-On), or both (via mobile app registration). During onboarding, you may optionally provide additional information such as your school name, grade level, graduation year, and career interests.
• Your interactions with our AI-powered tools. When you use our AI-powered features (such as our career advisor, resume builder, or AI professionals), we collect your messages and the AI-generated responses. This chat history is stored on our servers to provide and improve the Service.‍
• Your communications with us. We collect information when you contact customer support, send us an email, provide feedback, or respond to a survey.

Information We Receive from Others

• Information from schools and teachers. A school or district may provide us with information about students, such as names, email addresses, student identifiers, grade levels, and class rosters. This information may be provided directly by a teacher, or automatically through a third-party rostering or integration service such as Google Classroom, Clever, or ClassLink.‍
• Single Sign-On (SSO) services. If you register or log in through a Single Sign-On (SSO) service such as Google, Clever, or ClassLink, we receive basic profile information consistent with the permissions granted by that provider. This may include your name, email address, school, grade level, and unique user identifiers. The specific information shared depends on the SSO provider and the settings configured by your school or district. Your use of any SSO service is also subject to that provider's own privacy policy.

‍

Use of Information

We use Collected Information for the following purposes:

• To provide and operate the Service, including powering AI-driven educational features and personalizing your experience.
• To support educators, by providing teachers with summaries of student engagement, conversation topics, and career interests so they can offer informed guidance. Teachers may also request full student chat transcripts for students in their own classes to comply with teachers obligations to protect students.
• To communicate with you, including responding to inquiries, providing account-related notices, and sharing information about our Service.
• To understand and improve the Service, including analyzing usage trends and reviewing user interactions with AI features to improve accuracy, safety, and educational effectiveness.
• For safety and compliance, including reviewing AI conversations for safety purposes, protecting the rights and safety of our users.
• For complying with applicable laws, including in response to law enforcement, administrative, or judicial orders; this includes responding to civil subpoenas in consultation with legal counsel.‍
• De-identified or aggregated data. We may also use de-identified or aggregated data that does not reasonably identify any individual for research, analytics, product development, and demonstrating the impact of our Service. When we de-identify data, we do so in accordance with FERPA's de-identification standards and do not attempt to re-identify such data.

‍

How We Share Information

• We do not sell or rent Student Personal Data. 
• We do not display advertising to students.

 We may share collected information only in the following limited circumstances:

• AI service providers. To power our AI features, Student-Generated Content (specifically, student messages as part of conversations) is transmitted to third-party AI service providers via their APIs for processing. We do not include any Account-Level PII (such as names, email addresses, or school information) in the data sent to our AI providers. However, if a student voluntarily discloses personal information within a conversation and messages, that personal information will be transmitted as part of the message. Students and their advising teachers are responsible for exercising discretion regarding what information is shared during AI conversations. We encourage students not to share personal information such as their full name, address, phone number, or other identifying details during AI conversations. Our AI providers do not use student data to train their AI models. Our AI providers may retain messages for up to 30 days solely for safety and abuse monitoring, after which it is deleted. This retained data does not include any Account-Level PII and cannot be linked back to an individual student by the AI provider. We disable all optional data-sharing settings with our AI providers. A current list of AI service providers is maintained in our Service Providers section below.
• Service providers and vendors. We may share information with vendors and service providers who perform services on our behalf. All such vendors and service providers are subject to contractual obligations to maintain the confidentiality and security of that information. Our current service providers that may process student data include Supabase (database hosting), Amazon Web Services (infrastructure), Vercel (application hosting), OpenAI (AI processing), Google Analytics (Teacher app only) and SendGrid (email delivery for authentication).
• Schools and educators. If you are a student using the Service through your school, we may share engagement data, conversation topic summaries, and career interest information with your teachers and school administrators. Teachers may also request access to full student chat transcripts for students in their own classes when there is a concern related to student safety or wellbeing. We may also share de-identified, aggregated statistics with schools to help them understand overall student engagement.
• Legal and safety purposes. We may disclose information when we have a good-faith belief that doing so is reasonably necessary to comply with applicable law, protect the safety of our users, or enforce our Terms of Service.
• Organizational changes. In the unlikely event that Hope Street Group merges with another organization, dissolves, or transfers its operations, your information may be transferred to a successor entity. If such a transfer involves Student Personal Data, we will require the successor to honor this Privacy Policy and provide the school with notice and an opportunity to request deletion before the transfer occurs.

‍

Schools and Student Use

This section provides additional information about our practices when the Service is used by a school, school district, or teacher (collectively, “Schools”) for educational purposes. 

Our commitments regarding Student Personal Data:

• We collect, use, and share Student Personal Data only for authorized educational purposes as described in this Policy and as directed by Schools.
• We enter into Data Processing Agreements (DPAs) with Schools that establish our role and obligations with respect to Student Personal Data.
• We will not make material changes to this Privacy Policy that expand the collection, use, or sharing of Student Personal Data without first providing notice to Schools and a reasonable opportunity to review before the changes take effect.

Account creation for school use. Student accounts may be created by a teacher, by a student joining with a class code, or through a Single Sign-On service (such as Google, Clever, or ClassLink) at the direction of the School. When automated rostering is enabled, student accounts may be provisioned automatically based on data provided by the School's Student Information System. Schools are responsible for ensuring that appropriate consent has been obtained for their students' use of the Service.

Guidance to students. Schools are responsible for providing guidance to students about what information is appropriate to share during AI conversations.

Data deletion for schools. Teachers can request deletion of their account along with all associated class and student data by contacting us at support@hopestreetgroup.org. Districts may also request deletion of all associated data. Students can delete their own accounts directly within the Service.

Compliance inquiries. Schools may contact us at any time to request information about our data privacy and security practices. We will respond to reasonable compliance inquiries from Schools in a timely manner.

‍

Children’s Privacy

Protecting the privacy of children is especially important to us. This section describes our practices with respect to children under the age of 13 (“Children”), as required by the Children’s Online Privacy Protection Act (“COPPA”).

We do not knowingly collect personal information from Children without the consent of their School. When a School directs the use of our Service for students under 13, we rely on the School to provide the requisite consent on behalf of the child’s parent or legal guardian, consistent with COPPA’s school-official exception. The School is responsible for obtaining any necessary parental consent before providing student information to us.

If we learn that we have collected Student Personal Data from a child under 13 without appropriate school or parental consent, we will take steps to delete that information promptly. If you are a parent or guardian and believe your child has provided us with personal information without proper consent, please contact us at support@hopestreetgroup.org.

‍

Your Choices and Rights

You have the following choices regarding your personal information:

• Access and update. You can access and update your account information at any time through your account settings.
• Delete your account. Students can delete their accounts directly within the Service. Teachers and districts can request deletion of their accounts and all associated class and student data by contacting us at support@hopestreetgroup.org.
• Limit information you provide. Many fields during onboarding are optional. You can choose to provide only the minimum information required to use the Service.
• Additional rights. You may have additional rights under FERPA, COPPA, the California Consumer Privacy Act (CCPA), or other applicable federal or state laws. If you wish to exercise any privacy right, please contact us.

‍

Third-Party Services

Our Service may contain connections to third-party websites or services that are not operated by us. If you access the Service through SSO services, their privacy policy policy will apply. If you click on a link to an external website, you will be directed to that party’s site, and their privacy policy will apply. We have no control over and assume no responsibility for the content or privacy practices of any third-party services or sites.

‍

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the revised Policy with an updated effective date. If we make material changes, we will provide prominent notice through the Service or by other means prior to the changes taking effect. We will not make material changes that relate to the collection or use of Student Personal Data without first providing notice to the School and an opportunity to opt out.

‍

Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us:

By email: support@hopestreetgroup.org

By mail: Hope Street Group, 7055 Veterans Blvd, Suite D, Burr Ridge, IL 60527