Security & Data Privacy
Protecting educator data is foundational to everything we build. Here is exactly how we do it.
How we protect your data
Enterprise-Grade Infrastructure
Deployed entirely within Amazon Web Services (AWS). All data encrypted at rest (AES-256) and in transit (TLS 1.3).
AI Data Opt-Out
Teacher prompts, curriculum files, and uploaded materials are never used to train public AI models. All data remains strictly confidential and isolated.
No Student Data Collection
STEMEngine AI is a teacher-facing tool. We do not collect, store, or process any student personally identifiable information.
Minimal Teacher PII
We collect only what is needed for account access: name, school email, and district affiliation. Passwords are stored as one-way bcrypt hashes.
Secure Payments via Stripe
Credit card data never touches our servers. All transactions are handled by Stripe in full PCI-DSS compliance.
No Advertising or Cross-Site Tracking
No ad pixels, no social trackers, no data sales. The only analytics we use is Google Analytics 4 with anonymized IPs, and it can be disabled at any time.
District data-privacy agreements
We understand that districts require formal data-privacy agreements before approving new tools. STEMEngine AI is glad to review and sign your district’s Data Privacy Agreement (DPA) as part of onboarding.
Because STEMEngine AI is a teacher-only tool that collects no student data, our compliance posture is straightforward:
- No student PII is collected, stored, or processed at any point.
- Teacher data is limited to name, school email, and district affiliation.
- All data is encrypted at rest (AES-256) and in transit (TLS 1.3).
- AI-generated content is not used to train public models.
- We do not use advertising trackers or sell any data.
For DPA review, compliance questionnaires, or vendor security assessments, please contact us at [email protected].
Includes company identity, the SDPC NDPA Exhibit E data-elements schedule, sub-processors, retention, and breach-notification terms.
About the class-roster tool
In the interest of complete transparency, we disclose the one place in STEMEngine AI where a student’s name can be entered: the optional class-roster / random-grouping tool. A teacher may type student first names to generate random student groups for classroom activities.
Here is exactly how that data is handled:
- It is stored exclusively in the teacher’s own web browser (browser local storage on their device).
- It is never transmitted to, and never stored on, STEMEngine servers. We have no access to it and cannot retrieve, view, or export it.
- It never leaves the teacher’s device except through a teacher-initiated export file the teacher alone controls.
- The feature is entirely optional, and teachers may use initials or nicknames instead of full names.
Accordingly, STEMEngine AI as a vendor still collects and processes zero student personal information — the only place a student first name can be entered is client-side only and never reaches us.
Sub-processors
STEMEngine AI uses a small number of trusted third-party service providers strictly to operate the platform. None of them receives student personal information, because none is collected.
| Provider / function | Purpose | Data handled |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting and database infrastructure for the application. | Teacher account data and teacher-created lesson content. No student data. |
| AI model processing (Abacus.AI) | Generates lesson content from teacher-entered prompts. | Teacher-entered prompts (learning objective, grade, subject). No student data. |
| Stripe | Payment processing for paid subscriptions (PCI-DSS compliant). | Billing and transaction metadata. Card details go directly to Stripe and never touch our servers. |
| Transactional email | Delivers account and product notification emails. | Teacher email address only. |
| Google Analytics 4 | Anonymized product-usage measurement (optional, can be disabled). | Anonymized usage events and IP addresses. No student data. |
All sub-processors host and process data within the United States.
Full Privacy Policy
Last updated: August 2026
1. Infrastructure & Data Security
Our platform infrastructure is deployed entirely within enterprise-grade Amazon Web Services (AWS) cloud environments. All user data, lesson configurations, and account inputs are fully encrypted using industry-standard AES-256 protocols at rest within our databases, and secured via TLS 1.3 encryption in transit across the network.
2. AI Data Privacy & Opt-Out Protocol
We utilize secure enterprise-level AI API endpoints to generate classroom materials. We maintain a strict Data Opt-Out policy: any curriculum files, textbook text, state standards, or custom teacher prompts uploaded to our platform are processed dynamically and are never used to train public generative AI models. All uploaded contextual data remains strictly confidential and isolated.
3. Teacher PII & Financial Data Protection
We collect only the baseline Personal Identifiable Information (PII) necessary to manage secure account authentication (teacher name, school-issued email address, and district affiliation).
- Financial Data Security: STEMEngine AI does not store or process credit card numbers or financial passwords directly on our servers. All credit card transactions are handled securely by our third-party payment processor, Stripe, in compliance with PCI-DSS standards.
- School Purchase Orders: Any physical or digital Purchase Orders (POs) uploaded to our system by administrators are encrypted and treated with strict enterprise-level confidentiality.
- We do not collect student data, do not use advertising pixels or cross-site tracking, and will never sell, lease, or monetize educator data. The only third-party analytics we use is Google Analytics 4 for product usage measurement — see section 7.
- Optional class-roster tool: the only place a student first name can be entered is the optional random-grouping tool, and that data is stored solely in the teacher’s own browser — it is never transmitted to or stored on our servers. See the “About the class-roster tool” section above for full detail.
4. Data Collection
STEMEngine AI collects only the information necessary to provide our service. This includes:
- Account information (name, email address, school/district name, hashed password)
- Billing history and transaction metadata (processed via Stripe; raw payment details are excluded)
- Purchase order request details submitted through the platform
- Lesson content and configurations you create
- Assessment questions generated through the platform
- Usage data such as feature interactions and generation counts
5. Additional Security Measures
Your lesson content and educational materials remain private to your account. In addition to the infrastructure protections above, we implement:
- Secure password hashing (bcrypt)
- Session-based authentication with JWT tokens
- User-level access controls ensuring data isolation between individual accounts
- Secure tokenization for active subscription state verification via Stripe webhooks
6. User Rights
You have the right to:
- Access — Request a copy of all personal data we hold about you
- Rectification — Correct any inaccurate personal information
- Deletion — Request permanent deletion of your account and associated data
- Portability — Export individual lessons via PDF download or print
- Restriction — Limit how we process your personal data
7. Cookies & Tracking
We use essential cookies for authentication, session management, and secure checkout processing (the latter set by Stripe). We do not use advertising trackers, advertising pixels, social media trackers, or any form of cross-site tracking, and we never sell usage data.
We also use Google Analytics 4, which sets its own cookies, to understand which features educators use and where they encounter difficulty. IP addresses are anonymized and analytics data is never used for advertising. Analytics is optional: for visitors whose browser indicates they are in the EU, EEA, UK, or Switzerland it is switched off by default and the Google Analytics script is not loaded until it is enabled; elsewhere it is on by default and can be switched off at any time.
A full list of every cookie we set, along with the controls to change your analytics preference, is available on our Cookie Policy page.
8. Contact
For any privacy-related inquiries or district compliance verification, please contact us at [email protected] or visit our Contact page.