LEGAL
Privacy Policy
Last updated: [date at site launch]
Who we are.
Maloo LLC, New York, NY. Contact: privacy@heymaloo.com.
Information we collect.
Account data (name, email); email domain, which we check against the domains of verified Program accounts to identify a potential match to an existing Program; classroom profile data (program characteristics — no child names, records, or identifiers); content you generate; payment data (processed by Stripe; we store subscription status, not card numbers); usage data (PostHog analytics, device/browser data, cookies); error and diagnostic data (Sentry).
Children’s privacy.
The Service is for adults only. We do not knowingly collect personal information from children under 13 (or any minors). Classroom profiles describe classrooms in aggregate, not individual children. See our COPPA and FERPA statement.
How we use information.
To provide and personalize the Service (including AI generation), process payments, communicate transactionally, analyze and improve the product, prevent abuse, and comply with law. If your email domain matches a verified Program account, we use that match to prompt you to join that Program.
AI processing.
Profile and session inputs are transmitted to OpenAI to generate content. Generated content then passes through an automated safety check performed by a separate third-party AI provider (currently Anthropic) before it reaches you. Per each provider's applicable API terms, content submitted for these purposes is not used to train the provider's underlying models. We do not sell your data.
Sharing.
Service providers only (including Anthropic, OpenAI, PostHog, Stripe, Supabase, Vercel, Resend and Sentry), under their respective terms; legal compliance; business transfer with notice. No sale of personal information; no third-party advertising.
Program accounts.
If your seat belongs to a Program, the Program director can see your name, email, activity in the shared library, and seat status. If your email domain matches a Program, we will prompt you to join it; the Program director is not notified of this match unless and until you accept.
Retention.
Account data retained while your account is active and as required by law; you may request deletion (below).
Your rights.
Access, correction, deletion, and portability requests to privacy@heymaloo.com. We will respond within a reasonable time.
Security.
We maintain administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, row-level security on our database, and least-privilege key management, consistent with our obligations under New York’s data security law. No method of transmission or storage is 100% secure.
Cookies/analytics.
We use first-party product analytics (PostHog) to understand how educators use the Service. We do not sell or share your information with third parties for advertising, and no cookie-consent banner is required for this processing under applicable law. If your browser or device sends a Global Privacy Control signal, we will honor it as an opt-out request to the extent any opt-out right later applies to you.
Changes.
We will post updates and notify account holders of material changes.
