Skip to content
StoryLabHome
← StoryLab

Legal

Privacy Policy

Effective date: March 29, 2026 · Last updated: March 29, 2026

1. Who We Are

StoryLab, Inc. (“StoryLab,” “we,” “us”) operates the StoryLab platform at storylab.ai. We are a pedagogy marketplace where teachers build AI coaching agents and students access personalized coaching. This Privacy Policy explains what data we collect, why, and how we protect it.

2. Information We Collect

2.1 Information You Provide

  • Account information: Name, email address, role (teacher or student), subject area
  • Teacher content: Responses to the agent builder conversation, uploaded teaching materials (syllabi, session notes), teaching philosophy, methodology descriptions
  • Student content: Essays, drafts, messages sent to AI coaches, onboarding profile information (grade, writing goals, schools of interest)
  • Session recordings: Video session transcripts (with explicit consent), flagged coaching moments
  • Payment information: Processed by Stripe. We do not store credit card numbers. We receive transaction metadata (amounts, dates, subscription status).

2.2 Information Generated by the Platform

  • AI agent configurations: Teaching DNA, student type taxonomies, move taxonomies, behavioral constraints compiled from teacher input
  • Student profiles: AI-generated coaching assessments based on student interactions (growth edges, writing patterns, development stage)
  • Student portraits: Internal clinical assessments used by teachers to track student development. These are never shown to students.
  • Usage data: Messages sent, sessions completed, features used, timestamps

2.3 Automatically Collected

  • IP address, browser type, device type
  • Pages visited and interactions within the Platform
  • Cookies for authentication and session management

3. How We Use Your Information

  • To provide the service: Running AI coaching sessions, building and refining teacher agents, generating student assessments, processing payments
  • To improve the Platform: Analyzing usage patterns, improving AI model quality, developing new features
  • To train AI systems: Teacher content submitted to the agent builder and session transcripts may be used to improve StoryLab’s AI models. Student essays and conversations may be used to improve coaching quality. All training data is de-identified where feasible.
  • To communicate with you: Account notifications, service updates, security alerts. We do not send marketing emails without consent.
  • To ensure safety: Enforcing platform safety constraints, detecting prohibited content, protecting minors

4. How We Share Your Information

We do not sell your personal information. We share data only in these circumstances:

  • With AI providers: We send conversation content to third-party AI providers (currently OpenAI) to generate coaching responses. This data is sent via API and is subject to the AI provider’s data processing terms. We do not permit AI providers to use your data for training their general models.
  • With teachers (for their students): Teachers can see their students’ conversation histories, session transcripts, and AI-generated student portraits. Teachers cannot see other teachers’ students.
  • With payment processors: Stripe processes all payments. See Stripe’s Privacy Policy.
  • As required by law: We will disclose information when required by law, subpoena, or legal process, or when we believe disclosure is necessary to protect rights, safety, or property.

5. Student Data and Minors

We take the privacy of student data seriously, especially for minors.

  • No children under 13: StoryLab is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we discover we have collected such data, we will delete it promptly.
  • Parental consent for minors 13-17: Students between 13 and 17 must have parental or guardian consent to use the Platform.
  • Student portraits are teacher-only: AI-generated clinical assessments (student portraits) are visible only to the student’s teacher and are never shown to the student or exported in student data downloads.
  • Video session consent: Students must provide explicit consent before joining recorded video sessions. Students can withdraw recording consent at any time through their Data Rights Center (/lab/data), which immediately prevents them from joining future recorded sessions.
  • Data export and deletion: Students (or their parents) can export their data and request deletion through the Data Rights Center at /lab/data.
  • Safety monitoring: Conversations are monitored for student welfare concerns, including signs of distress, self-harm, or abuse. If a concern is detected, crisis resources are shown to the student immediately and the student’s teacher is flagged for follow-up. Safety flags and their review history are retained as part of the student’s safety record and are visible only to the student’s teacher and platform administrators.

6. Data Retention

  • Account data: Retained while your account is active. Deleted within 90 days of account deletion, except where retention is required by law.
  • Conversation histories: Retained while your account is active. Students can soft-delete individual conversations.
  • Session transcripts: Retained for the teacher’s use while both accounts are active. Knowledge chunks extracted from transcripts (de-identified coaching patterns) may be retained indefinitely to improve the teacher’s agent.
  • Teacher agent configurations: Retained by StoryLab per the license granted in our Terms of Service, including after account termination.
  • Payment records: Retained as required by tax and financial reporting laws (typically 7 years).

7. Data Security

We use industry-standard measures to protect your data, including encryption in transit (TLS), encrypted database storage, row-level security policies, and access controls that ensure teachers can only see their own students’ data. Authentication is handled by Supabase Auth with magic link (passwordless) login.

No system is perfectly secure. If we discover a data breach that affects your personal information, we will notify you and applicable authorities as required by law.

8. Your Rights

Depending on your location, you may have the right to:

  • Access: Request a copy of the data we hold about you. Students can use the Data Rights Center (/lab/data) to export their data.
  • Correction: Request correction of inaccurate data.
  • Deletion: Request deletion of your data, subject to retention requirements. Account deletion removes your profile, conversations, and personal information.
  • Portability: Receive your data in a structured, machine-readable format. The Data Rights Center provides JSON export.
  • Withdraw consent: For recording consent (video sessions), you can withdraw at any time through the Data Rights Center.
  • Object: Object to processing of your data for certain purposes.

To exercise these rights, email us at storylab.ivy@gmail.com or use the in-platform tools (Data Rights Center for students, account settings for teachers).

9. Cookies

We use essential cookies for authentication and session management. We do not use advertising cookies or third-party tracking cookies. Essential cookies cannot be disabled as the Platform cannot function without them.

10. Third-Party Services

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Platform at least 14 days before the changes take effect.

12. Contact

Questions or concerns about your privacy? Email us at storylab.ivy@gmail.com.