Privacy Policy

1. Who We Are

LibraryAid is an AI-powered school library management platform built by David Webb, a primary school teacher. LibraryAid is operated globally, serving schools in the UK, US, and internationally. Our platform is designed specifically for use in educational settings — by school librarians, teachers, and students.

References to "LibraryAid", "we", "us", or "our" in this policy refer to the LibraryAid service and its operator, David Webb (davidwebb@libraryaid.net).

2. Information We Collect

2.1 School Administrator Information

When a school registers for LibraryAid, LibraryAid collects:

• School name and type
• Administrator name and email address
• Estimated number of students
• Subscription and billing information (processed securely by Paddle — LibraryAid does not store payment card details)

2.2 Student Information

Student accounts are created by school administrators or teachers — not by students directly. For each student LibraryAid collects:

• First name and last initial (the school may choose to enter a full name)
• Class and year group
• Reading age and reading level (assessed within the platform)
• Reading interests, favourite genres, and favourite authors (entered by teacher or student)
• Current class topic (for curriculum-aligned recommendations)
• Books read, reviews written, comprehension quiz scores, and points earned
• Worm companion customisation choices
• Generated username and password (teachers can view these so they can print login cards)

LibraryAid does not collect student email addresses. Students log in using a school-issued code. No personal contact information is required from students.

2.3 Teacher Information

Teachers and librarians log in using an email address and password. LibraryAid stores their name, email, school association, and activity within the platform (classes created, recommendations made, reviews approved).

2.4 Parent Information

Parents who access the parent portal are invited by the school. LibraryAid collects the parent's name and email address to create their account. Parents can view their child's reading progress and recommendations.

2.5 Information Collected Automatically

When you use LibraryAid, LibraryAid automatically collects:

• IP address and browser type (on the app, IP addresses are held briefly for abuse prevention)
• Pages visited and time spent on the platform
• Device type and operating system
• Usage patterns and feature interactions (via Google Analytics GA4)

3. How We Use Your Information

3.1 Student Data

Student data is used exclusively for educational purposes:

• Generating personalised AI book recommendations matched to each student's reading level, interests, favourite authors, and curriculum topics
• Tracking comprehension progress through VIPERS quiz scores
• Calculating and updating blended reading level assessments
• Powering the genre-based rewards system (worm companion accessories)
• Generating class-wide analytics for teachers — reading progress, VIPERS weak areas, genre diversity
• Enabling peer review features (a review is shown to classmates in the app only after a teacher approves it)

Student data is never used for advertising, marketing profiling, or any commercial purpose.

3.2 School and Teacher Data

• Providing and maintaining the LibraryAid service
• Processing subscriptions and payments
• Sending service updates, security alerts, and support communications
• Improving the platform based on usage patterns

3.3 Analytics Data

LibraryAid uses Google Analytics GA4 to understand how its marketing website (libraryaid.net) is used. GA4 data is anonymised and aggregated. LibraryAid uses this data to improve the website and understand which pages are most useful to schools evaluating the platform.

4. Information Sharing and Disclosure

4.1 Service Providers

LibraryAid uses these service providers to run the service; each receives only the data described:

• Google Cloud and Firebase — storage, sign-in, and hosting (United States)
• Google Cloud Text-to-Speech — reads short messages aloud on the pupil home page. It receives only the sentence being spoken, which can include a pupil's first name and last initial and a class name; it does not receive IDs, email addresses, the school name or reading history. Google states that it does not log Text-to-Speech text or audio. LibraryAid keeps the spoken audio for up to 7 days to avoid repeat requests, then deletes it automatically.
• Anthropic — AI language model provider (Claude API): book recommendations, quiz questions, and reading assessments. For recommendations it receives reading level, approximate age, class topic, interests, favourite authors and genres, and part of the school's catalogue; it does not receive the student's name, ID, school, or class name. Anthropic states: "We do not use API data for training (unless you have an agreement with us that states otherwise)." Anthropic also states that it deletes API inputs and outputs within 30 days, with exceptions for legal compliance and content flagged by its safety systems.
• Paddle — payments and billing contact details, never student data
• Google Analytics — marketing website only
• Google Books and Open Library — book covers and details, no student data
• Clever and ClassLink — single sign-on and roster sync for schools that use them (see Section 12)
• Gmail — overdue and reservation emails to school staff, which can include student names
• Content delivery services such as Google Fonts, cdnjs, jsDelivr, and unpkg — page scripts and fonts; they see visitors' IP addresses

4.2 Schools and Administrators

Teachers and librarians at a student's school can see that school's student data. Students at the same school can see classmates' approved reviews and reading activity; this is a deliberate feature. Parents see only their own child's data. District administrators see school-level totals only, not individual students. LibraryAid can access data when needed to give support.

4.3 Legal Requirements

LibraryAid may disclose information if required to do so by law, or if LibraryAid believes in good faith that disclosure is necessary to comply with a legal obligation, protect the safety of students, or protect the rights and property of LibraryAid.

4.4 Business Transfers

If LibraryAid is involved in a merger, acquisition, or sale of assets, LibraryAid will notify affected schools before any student data is transferred and give schools the opportunity to request deletion of their data.

5. Cookies and Tracking Technologies

5.1 On Our Marketing Website (libraryaid.net)

LibraryAid uses the following cookies on its public marketing website:

• Essential cookies: Required for the website to function — login sessions, cookie consent preferences
• Analytics cookies: Google Analytics GA4 — anonymised data about how visitors use the website. LibraryAid uses this to improve the site. No student activity is tracked through GA4.

LibraryAid does not use advertising cookies or allow third-party advertisers to set cookies on its website.

5.2 Within the LibraryAid App

Within the student-facing application, LibraryAid uses only essential cookies required for authentication and session management. No third-party tracking cookies are used within the student application.

For full details see our Cookie Policy.

6. Data Security

LibraryAid takes the security of student data seriously. Security measures include:

• All traffic is sent over HTTPS
• Data is stored on Google Cloud, which encrypts stored data by default
• Access rules restrict data by role and school
• Students log in with school-issued credentials and no personal email
• Reviews are shown to classmates only after teacher approval
• No payment card details are held (Paddle handles payments)

No system is completely secure. If LibraryAid becomes aware of a security breach affecting student data, LibraryAid will notify affected schools promptly in accordance with applicable law.

7. AI-Generated Data

7.1 Book Recommendations

LibraryAid uses AI to generate personalised book recommendations for each student. The recommendation engine analyses over 30 factors including reading level, interests, favourite authors, genre history, curriculum topics, series progression, and peer reviews within the school community. Recommendations are drawn exclusively from books in the school's own library catalogue — we do not recommend books the school does not own.

7.2 Reading Level Assessment

LibraryAid includes an adaptive reading age assessment spanning 13 bands from 6.0 to 12.0 years. Results are used to inform recommendations and are visible to teachers. Assessment results are clearly labelled as estimates within the platform and are intended as a guide for teachers, not as a replacement for formal educational assessment.

7.3 VIPERS Comprehension Questions

Comprehension quiz questions are AI-generated based on the books in our catalogue. Questions are aligned to the VIPERS comprehension framework (Vocabulary, Inference, Prediction, Explanation, Retrieval, Summarise). AI-generated questions are provided as educational tools and should be reviewed by teachers where used for formal assessment purposes.

7.4 Book Metadata

Reading level estimates for books (where not available from official sources) may be AI-generated. These are clearly labelled within the platform and should not be used as definitive educational measurements.

8. Children's Privacy (COPPA)

LibraryAid is designed for schools, including students under 13. Schools consent on behalf of parents under the school-consent exception.

8.1 How LibraryAid supports schools under COPPA

• Consent is given by the school on behalf of parents, under COPPA's school consent exception.
• LibraryAid collects only the minimum information necessary to provide the educational service
• LibraryAid does not collect student email addresses
• LibraryAid does not use student personal information for advertising or marketing purposes
• LibraryAid does not share student personal information with third parties for commercial purposes
• LibraryAid does not condition a student's participation on the disclosure of more personal information than is reasonably necessary
• Teachers and librarians at a student's school can see that school's student data. Students at the same school can see classmates' approved reviews and reading activity; this is a deliberate feature. Parents see only their own child's data. District administrators see school-level totals only, not individual students. LibraryAid can access data when needed to give support.

8.2 Parental Rights

Parents can ask their school, or LibraryAid, to show, correct or delete their child's data. LibraryAid acts on a school's instruction.

8.3 Age-Appropriate Content

LibraryAid applies content age-rating filters to all book recommendations. A gifted young reader with a high reading level will never be recommended books with age-inappropriate content for their actual age. Reading ability and content appropriateness are managed separately.

9. Data Retention

LibraryAid keeps data while the school has an account. Specifically:

• School data: Kept while the school has an account. Cancelling does not delete data automatically.
• Deletion on request: On written request, LibraryAid deletes a student's data, or all of a school's data, and confirms within 30 days.
• Backups and logs: Deleted data can remain in backups for up to 90 days and in system logs for up to 30 days.
• Billing records: Billing and payment records are kept as accounting and tax rules require.
• Analytics data: Google Analytics user-level data is kept for 14 months and event data for 2 months.
• Voice audio: spoken messages on the pupil home page are kept for up to 7 days, then deleted automatically.

10. Your Rights

10.1 Rights for All Users

• Access: You can request a copy of the personal information LibraryAid holds about you or your child.
• Correction: You can ask LibraryAid to correct inaccurate information. Teachers can correct student data directly through the dashboard.
• Deletion: You can ask LibraryAid to delete personal information. Parents can request deletion through their school. Requests go to the contact email in Section 15.
• Restriction: You can ask LibraryAid to restrict processing of your personal information in certain circumstances.
• Objection: You can object to LibraryAid's processing of your personal information based on legitimate interests.

10.2 GDPR Rights (UK and EU Users)

If you are located in the UK, European Economic Area, or Switzerland, you have rights under the UK GDPR and EU GDPR including all rights listed above plus the right to lodge a complaint with your local data protection authority. In the UK this is the Information Commissioner's Office (ICO) at ico.org.uk.

10.3 CCPA Rights (California Residents)

California residents have rights under the California Consumer Privacy Act (CCPA) including the right to know what personal information is collected, the right to delete personal information, and the right to opt out of the sale of personal information. LibraryAid does not sell personal information.

10.4 Exercising Your Rights

To exercise any of these rights, please contact LibraryAid at davidwebb@libraryaid.net. LibraryAid will respond within the timeframe required by applicable law (typically 30 days).

11. International Data Transfers

LibraryAid is operated globally and its data infrastructure uses Google Firebase, with servers located in us-central1 (United States). This means that data submitted by users in the UK, EU, and other countries may be transferred to and stored in the United States.

For transfers of personal data from the UK and European Economic Area to the United States, LibraryAid relies on Google's standard contractual clauses and Google Cloud's Data Processing Addendum, which provides appropriate safeguards for international data transfers in accordance with UK GDPR and EU GDPR requirements.

Google's data processing terms apply.

12. Clever & ClassLink Single Sign-On

12.1 Clever SSO

LibraryAid supports Clever Single Sign-On (SSO) for US schools and districts. When a school uses Clever SSO:

• Students and teachers log in to LibraryAid using their existing school credentials via Clever — no separate LibraryAid password is needed
• Student roster information (name, grade, school) is synced automatically from Clever to LibraryAid
• LibraryAid receives only the information necessary to create and maintain student accounts — first name and last initial, grade level, and school association
• LibraryAid uses data received through Clever only to run LibraryAid for the school.

For information about Clever's data practices, see Clever's privacy policy at clever.com/trust/privacy/policy.

12.2 ClassLink SSO

LibraryAid is a certified ClassLink partner for Single Sign-On (SSO), and is completing ClassLink's certification for OneRoster 1.1 roster sync for US schools and districts. When a school uses ClassLink:

• Students and teachers log in to LibraryAid using their existing ClassLink credentials — no separate LibraryAid password is needed
• Once roster sync is enabled for a school, student roster information is synced automatically from ClassLink to LibraryAid via OneRoster 1.1 on a nightly basis
• LibraryAid receives only the information necessary to create and maintain student accounts — first name and last initial, grade level, and school association
• LibraryAid uses data received through ClassLink only to run LibraryAid for the school.

For information about ClassLink's data practices, see ClassLink's privacy policy at classlink.com/privacy-policy.

13. District Dashboard

LibraryAid offers a District Dashboard for school district administrators managing multiple schools. District administrators can:

• View aggregated school-level metrics (active students, books read, average VIPERS scores) across all schools in their district
• Push reading challenges to all schools in their district

District administrators do not have access to individual student profiles, individual student reading history, or any personally identifiable student information. All district-level data is aggregated at the school level.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify school administrators by email for any significant changes affecting student data
• Post a notice on our website

We encourage schools to review this policy periodically. Continued use of LibraryAid after changes are posted constitutes acceptance of the updated policy.