Student privacy firstTrust & Security
This page is maintained by Docentia to answer common security and privacy questions about the platform. The statements below describe Docentia's current practices and platform capabilities. They are not independent legal verification or certification by a third party. Our full privacy policy (effective October 12, 2026) is available as a PDF below.
Privacy by design
For school-managed accounts, the school or district controls the student records it provides to Docentia, and a district agreement controls if it offers stronger protections or conflicts with our policy.
No sale of student data
Student information is not sold, used for targeted advertising, or used to build advertising profiles.
Purpose-limited use
Student information is used only to provide, secure, support, and improve the learning service, or as a school directs.
Human oversight
AI supports learning but does not replace educator judgment, and never decides grading, placement, or discipline on its own.
Clear requests
Access, correction, and deletion requests can be made at info@docentia.ai or (281) 687-7844.
Role-based access
Students, teachers, district admins, and platform admins see only what their role requires.
Encrypted infrastructure
Data is encrypted in transit and at rest, and student data is deleted or de-identified within 60 days after an agreement ends.
Compliance and safeguards
Educational data stays educational
Docentia is designed to support FERPA-aligned educational data practices. Student information is used only to deliver learning and progress features within the platform. We do not sell student data, use it for advertising, or share it with unrelated third parties. For district deployments, we work with schools under terms that reflect a school official or educational-purpose relationship where applicable.
Built for grades 8–11, with young learners in mind
Docentia is primarily used by students in grades 8–11. For any student under 13, we follow applicable COPPA requirements and rely on the school or district to obtain the necessary parental consent and to manage age-appropriate access. We minimize the personal data we collect and only ask for what is needed to support the learning experience.
Working toward SOC2 examination
Docentia is in the beginning stage of SOC2 readiness and audit preparation. We are documenting controls, tightening access policies, and preparing for an independent SOC2 examination. This page will be updated as we complete milestones. SOC2 is a compliance framework, not a guarantee of security; we treat it as one part of our ongoing commitment to protecting student data.
Data is encrypted and access-controlled
Docentia encrypts data in transit and at rest. The platform uses authenticated sessions, role-based access control, and Row-Level Security (RLS) policies so users can only access the data they are authorized to see. Admin, teacher, and student views are separated by role, and sensitive operations are handled by privileged server-side code.
AI supports learning, not surveillance
Docentia uses AI to generate explanations, feedback, and adaptive practice recommendations. Student prompts and responses are processed to provide educational support, not to build advertising profiles or train unrelated models. AI-generated content is filtered for safety and age-appropriateness, and teachers and administrators retain control over classroom use.
Minimal cookies, clear choice
Docentia uses only essential cookies: sign-in, display preferences (like theme), and two security cookies from our hosting network (__cf_bm for Cloudflare bot protection and __dpl for keeping a visit on one site version). We do not use analytics, advertising, or cross-site tracking cookies. A banner on first visit lets visitors choose whether optional preference storage is allowed.
Access, correction, and deletion
Students, parents, and district administrators can request access to, correction of, or deletion of student data by contacting info@docentia.ai. We process requests in coordination with the school or district that owns the student relationship, because many records are managed under district agreements.
Shared responsibility
Docentia's website is hosted on Vercel, and its database, sign-in and file storage run on Supabase. Source code is managed in GitHub. Docentia configures and operates the application layer on top of these platforms. Security and privacy are a shared responsibility: the providers manage their platforms, while Docentia manages application permissions, data handling, and user-facing practices. The controls described on this page are implemented by Docentia in the application layer.
Platforms and service providers we use
Docentia relies on the following third-party platforms to run the service. Each receives only the data it needs for its stated purpose. We do not sell student data or allow these providers to use it for advertising.
| Provider | Purpose | Data involved |
|---|---|---|
| Vercel | Website and application hosting | Technical request data and account, learning and usage data in transit |
| Supabase | Database, sign-in and file storage | Account, learning and usage data |
| Cloudflare | Content delivery and network security for the website | Technical request data (IP address, browser) |
| Lovable AI Gateway with Google Gemini | AI tutor (Doc), lesson, quiz and feedback generation, translation | Questions, prompts and student responses sent for an AI reply; Docentia does not add names or emails to prompts |
| ElevenLabs | Read-aloud voice and audio features | Text being read aloud |
| Zoom | Video meetings for scheduled demos and webinars | Name, email and meeting details of people who book |
| Stripe | Payment processing for paid programs | Payer name, email and payment details (handled directly by Stripe) |
| Lovable Emails | Transactional emails such as sign-in links, invites and reminders | Recipient email address and message content |
| OpenAI ChatGPT | Helps our team draft and review learning content (lessons, practice questions, study guides) before educator review | Curriculum and content drafts only; no student data |
| Anthropic Claude | Helps our team draft and review learning content and platform copy before educator review | Curriculum and content drafts only; no student data |
| GitHub | Source code hosting and automated quality checks | Application code only — no student data |
This list is updated when our providers change. Questions: info@docentia.ai.
If a data breach happens
- We contain the incident, secure affected systems, and preserve evidence.
- We investigate what data and which users were affected.
- We notify each affected school district or customer without unreasonable delay, and within 4 hours of confirming a breach of their student data, with what happened, what data was involved, and the steps we are taking.
- We support districts in notifying parents and students, and notify affected individuals and regulators as required by law, including Texas Business & Commerce Code §521.053 (individuals within 60 days; the Texas Attorney General when 250 or more Texans are affected).
- We fix the cause and share a written summary with affected districts.
Request data deletion
Students, parents, teachers, and district administrators can request deletion of a Docentia account and its associated learning data. For district-managed students, we coordinate with the district that owns the student relationship before completing deletion.
Trust Center updates
Get an email when Docentia publishes material updates to compliance, security, or privacy practices. Low volume — only when this page materially changes.
Security contact form
Report a vulnerability, suspected incident, or privacy concern. The form goes to our security inbox at info@docentia.ai.
Trust center changelog
Material changes to our practices, controls, and this page.
July 2026 (later)
Added data deletion request form, cookie preferences page, downloadable PDF privacy policy, and a Trust Center updates email list.
July 2026
Added cookie consent banner, downloadable privacy policy, and a dedicated security contact form.
June 2026
Consolidated privacy and security inquiries to info@docentia.ai for a single point of contact.
May 2026
Published Trust & Security page covering FERPA-aligned practices, COPPA, SOC2 readiness, and encryption.
April 2026
Began SOC2 readiness engagement; started documenting controls and access policies.
Contact us
For privacy requests, security reports, or questions about this page, email us directly.
Privacy & security
Data access, correction, deletion, vulnerability reports, and incidents.
Last updated: October 2026. This page is a living document and will be updated as Docentia's practices and compliance posture evolve.