Platform Privacy Policy

For the account holders who run a school on Together, Lorain Products LLC is the controller of their account details and billing information. For everyone a school enters into the service — its members, their families and children — the school is the controller and we are its processor: we handle that data only to provide the service, on the school's instructions.

• The account holder's name, email address and sign-in credentials.
• The school's name, type, address and the plan it chose.
• Billing details, held by Stripe; we see the last four digits of a card and the billing history.
• Support correspondence and, when a staff member opens a support session, a record of who, when and why.
• Technical logs: request metadata, errors and performance data, kept for ninety days.

Whatever a school and its members put in: member and family details, children's records including class, pickup arrangements, attendance and any medical notes the school records, messages, photographs, volunteer and payment history. The school's own privacy policy explains this to its members; ours explains what we do with it, which is: store it, back it up, deliver it to the people the school addresses it to, and nothing else.

We do not sell personal information, use it for advertising, train models on it, or share it with anyone but the providers below.

• Supabase (database, authentication, file storage, secrets vault), in the United States.
• Vercel (hosting), in the United States.
• Stripe (payments and subscriptions).
• Resend (email delivery).
• Twilio (text messages and WhatsApp).
• Anthropic (AI writing help, only when a school uses it, only with the text it submits).

Each holds only what its role needs and is bound by its own terms and data agreements. We will publish changes to this list here.

Every record carries the school it belongs to and the database enforces that boundary on every query. Our staff cannot see a school's data by default; a support session must be opened for a stated reason, expires within an hour, and is listed in the school's settings.

If we confirm a security incident that affects a school's data, we tell that school's owner what happened, what data was involved and what we have done about it within 72 hours of confirming it, and sooner where we can, and we help the school inform its members.

Accounts are for adults. Schools enter information about children; we never collect it from a child directly. A school that serves families of children under thirteen is responsible for the consents that requires, and our templates for the school's own privacy policy address it.

A school's data is kept for as long as the school exists on the service. When the owner closes the school, the public site stops at once and every record and file is deleted after fourteen days; backups age out within thirty days after that. Account and billing records are kept as long as the law requires.

Account holders can see and correct their details in their account, and can close their school. Members should direct requests about their data to their school, which controls it; we will help the school respond.

Privacy questions for Lorain Products LLC: reply to any email we have sent you, or use the contact address on the About page. REVIEW: add a postal address before launch.