Privacy Policy

Information We Collect

We collect information you provide when creating and using a school account:

• School name, city, state, website, and logo (optional)
• Administrator email address
• Account passwords are handled through Firebase Authentication. EZSupplyList application code does not store plaintext passwords
• Teacher name and email address, when an admin sends a supply-list review request to a teacher
• The parent-facing contact email an admin chooses to publish on the parent portal
• Subscription and billing information (processed by Stripe)
• A Firebase account identifier tied to your admin login
• Teacher suggestions and general notes submitted through a review link
• Supply-list content you upload or enter (items, grades, programs)
• IP addresses, for security, abuse prevention, and access records (see "Security and Access Data" below)
• Diagnostic and error logs generated while operating the service

Student and Child Data

• EZSupplyList is not designed to collect student-identifiable information — student names, records, health information, or accommodation details should not be submitted to the product, including in uploaded documents or free-text notes
• The parent portal's "Add Your Children" step does ask a parent for each child's first name, so it can build and display that child's supply list. Ordinarily, that name is used only inside the parent's browser: it is held in the page's local state, shown on screen, and included in anything the parent prints from that page. It is never sent to our database, never sent to any EZSupplyList server, and never written to any log we control. However, if a parent deliberately uses the page's "Share" button, the name is encoded into that link's URL fragment so the same list can be reopened later — which means the name is disclosed to anyone the parent sends that link to (and potentially to any third-party service that link passes through, such as a messaging app that generates a link preview). A parent who wants to keep a child's name out of any shared link should avoid the Share feature and share their grade selections another way

How We Use Your Information

• To operate and provide the EZSupplyList service
• To send transactional emails (account notices, billing alerts, teacher-review links and reminders)
• To process subscription payments via Stripe
• To extract and structure supply-list content from documents you upload, using an AI processing provider (see "AI Document Processing" below)
• For security, fraud and abuse prevention, and to maintain access records for teacher-review links

EZSupplyList does not sell personal information.

Third-Party Services

We use third-party services to operate EZSupplyList:

• Stripe — payment processing (stripe.com/privacy)
• Google Cloud / Firebase — database and authentication infrastructure
• Cloudflare — hosting, security, and performance (cloudflare.com/privacypolicy)
• A transactional email provider — for account, billing, and teacher-review notifications
• An AI processing provider — for extracting and structuring supply-list content from uploaded documents, and for optional teacher-name formatting

These services may process data as described in their respective privacy policies.

AI Document Processing

When you upload a supply-list document (PDF, Word, or Excel file), its content is transmitted to a third-party AI processing provider so it can be read. For PDF files, this may include the full document as submitted. For Word and Excel files, text extracted from the document — not the original file — may be transmitted instead. Either way, the file name and related metadata are included. The AI provider processes this content to identify, extract, and structure supply-list items, grades, and related details, and to flag possible duplicates for your review.

EZSupplyList does not intentionally store the original uploaded file after processing. The structured data produced from it (the items, grades, and programs you review and confirm) is retained as part of your account, along with limited diagnostic metadata about the processing run (such as file names, file types, page counts, and processing counts, but not full document content) used to monitor for errors. On certain processing errors, a short excerpt of the AI provider's raw response (up to a few hundred characters) may also be retained in our internal diagnostic logs to help us investigate the failure.

The AI provider's processing of this data is governed by its own applicable terms and privacy practices, which are outside our control. Do not upload documents containing student names, student records, or other personally identifiable student information — see the notice shown on the upload screen.

Security and Access Data

Teacher supply-list review links are bearer links — anyone with the link can open it, and a teacher may forward it to someone else. We log the IP address that first accesses a review link as part of that link's record, for security and access-record purposes. Separately, short-lived IP-based records are used to rate-limit requests (for example, to slow down repeated login or signup attempts) and are not retained long-term. We also keep an audit log (changelog) of key account actions — such as publishing a supply list or sending a teacher-review request — associated with the admin account that took the action.

Affiliate Links

The parent portal can display "Shop on Amazon" links next to supply-list items when an Amazon affiliate tag is configured for the site. When those links are shown, EZSupplyList may earn a commission from qualifying purchases made through them, at no additional cost to you. This does not affect what items appear on your school's list. If no affiliate tag is configured, these links — and any related commission — do not apply.

Data Retention

Account and school data may be retained after a subscription is cancelled or a trial expires. We may continue to retain this data for operational, security, legal, accounting, dispute-resolution, and recordkeeping purposes.

You may request access to, correction of, or deletion of your data by contacting us at [email protected]. Requests are handled manually and we will respond as promptly as we reasonably can. Certain records may still be retained after a deletion request — for example, where we are required to keep them for legitimate legal, security, fraud-prevention, accounting, or contractual purposes, or where they remain in a service provider's own logs or backups (including Stripe, Cloudflare, our email provider, our AI processing provider, and Firebase/Google) according to that provider's own retention practices, which we do not control.

Browser Storage and Cookies

EZSupplyList uses browser-based storage (such as local storage or similar client-side persistence provided by our authentication service) to keep a school administrator signed in between visits. This is essential to operating the admin dashboard and is not used for advertising or cross-site tracking. The current EZSupplyList application does not use analytics or advertising tracking.

Third-party services we use — including Stripe and Amazon — may set their own cookies or use their own browser storage on their own domains when you interact with them directly (for example, a Stripe checkout page or an Amazon product page). Those are governed by each provider's own policy, not this one.

Children's Privacy (COPPA)

EZSupplyList is directed at school administrators and other adults, not children. We do not knowingly collect personal information from children under 13. The parent portal asks for a child's first name to build a supply list, but that name stays in the parent's browser and is not sent to or stored on our servers — see "Student and Child Data" above for exactly how that works.

Your Rights

Depending on where you live, you may have rights regarding your personal information — for example, to know what we hold about you, or to request its correction or deletion. Rights available to you may vary by location. To exercise any rights that may apply to you, contact us at [email protected]. We will review and respond to your request, subject to applicable retention requirements and other lawful limitations, including those described under "Data Retention" above.

Changes to This Policy

We will notify account holders of material changes via email.