Privacy Policy

Last updated: October 9, 2025

We're thrilled that you've chosen to use LitLab.ai!

LitLab.ai, a business alias of Koalluh, is the leading provider of reading software that aims to make reading more engaging, more personalized, and more "just right" for kids, regardless of their background or their current reading proficiency.

We deeply respect the privacy of all of our users. We know that as parents and educators, you care deeply about your and your students' privacy, too. Hence, we crafted this LitLab.ai Privacy Policy (our "Privacy Policy") to describe our commitment to privacy protection.

LitLab is built for teachers, students, parents, schools, school districts, school administrators, and other K-12 educational institutions — these individuals and entities make up our primary users. In order to browse, utilize, or gain access LitLab, each user, either independently or on behalf of a student who is under eighteen (18) years old ("user," "user's," "you" or "your") must agree to this Privacy Policy, which explains how we collect, use, safeguard, and share certain information about our users. This Privacy Policy is a crucial part of our Terms and Conditions (our "Terms"), and applies to every user's access to and use of (1) the LitLab Platform, which is our student- and educator-facing educational product used in classrooms and governed by COPPA, FERPA, and similar laws; and (2) the LitLab Website, which is our educator-facing public website (litlab.ai) where we may use cookies, analytics, and marketing tools. Collectively, these are referred to as the "Services."

To use our Platform, you must create an account. By creating an account or logging in, you acknowledge that you have reviewed and agreed to our Terms of Service and Privacy Policy. If you do not agree with any of the terms of this Privacy Policy, you should immediately stop using our Services.

This Privacy Policy applies to all data we process through our Services, including Student Data, usage data, device data, account data, and de-identified or aggregated data. This Policy does not apply to websites, apps, or services that we do not control. When you follow a link to a third party provider, their privacy policy governs.

This Privacy Policy is written in English. Translations are available upon request by contacting us at ops@litlab.ai. If there is any inconsistency between translations and the English version, the English version will govern.

Updates to this Privacy Policy

We may amend this Privacy Policy based on changes to our Services and to remain compliant with best practices and regulations. The "Last Updated" section at the top of this page shows when this Privacy Policy was last modified. Your continued use of the Platform following these modifications signifies your acceptance of the revised Privacy Policy.

If we make a material change, we will provide notice by email, if you have provided an email address to us, as well as to schools and districts whom we have service agreements with.

Our Commitment to Privacy

This Privacy Policy delineates how we gather, employ, and crucially, safeguard personal information gathered through the Services, with special focus on the information related to students ("Student Data"). Our cornerstone principle is the preservation of students' privacy. Accordingly, we are dedicated to the following tenets regarding Student Data protection:

• • Student Data is exclusively used for purposes sanctioned by the student's school, parent, or legal guardian.
• • We have established a Privacy Policy and a Platform that meets or surpasses our obligations under COPPA, FERPA, and relevant state laws governing student privacy.
• • We do not display third-party advertisements to students utilizing the Platform.
• • We strictly prohibit the use or disclosure of Student Data for targeted promotions or marketing and we do not create profiles of students for purposes of targeting advertising.
• • We honor schools' and parents' rights to maintain direct control over Student Data.
• • We implement industry-standard security measures and encryption technologies to safeguard Student Data.
• • We are committed to sharing our data practices in a transparent and understandable manner.
• • We are committed to not retaining Student Data longer than necessary to provide the Platform to students.
• • We are committed to notifying our users and customers of material changes to this Privacy Policy. If we make a material change, we will provide notice by email, if you have provided an email address to us.

How We Collect Information

The information we collect depends on whether you are using the LitLab Platform or simply visiting the LitLab Website.

We collect information regarding students and educators in the LitLab Platform various ways as follows:

• • The Platform is designed for use in schools, including children under 13. We collect only the minimum information necessary and rely on schools or parents to provide consent in compliance with COPPA. For children ages 13 or older, our data collection and usage practices are the same.
• • When an educator creates an account on the Platform, LitLab collects details such as name, email address, password, occupation, country, and school address.
• • Educators can roster a classroom with student names or initials and invite students to join a classroom or a session on the Platform. Students submit their interests in order to generate stories and other content. Teachers can determine whether stories created by students are visible between students.
• • No student data is collected without consent from the educator.
• • The majority of information is collected when users sign up for our Platform. Some information is collected automatically via third-party verification authentication services (for example, Google OAuth and Clever), from which LitLab receives personal details with your consent.
• • LitLab also passively collects information about how we are used to provide teachers with relevant student progress and usage data, and to improve our Services. This information includes access times, duration, content viewed, and user activities.
• • We also collect device-related information such as device and browser type, operating system, IP address, referral URL, and a unique identifier.
• • We do not collect or use precise geolocation data (e.g., GPS, Wi-Fi triangulation, or cell-tower data). We may infer a coarse location (e.g., city or region) from your IP address to comply with regional requirements and generate aggregate usage analytics (for example, understanding how many users access the Platform from different states).
• • We do not allow third-party advertising or behavioral tracking on our Platform.
• • LitLab does not collect sensitive details from students, such as biometric data, free or reduced lunch eligibility, health, or financial data.

Our Website, which is directed to educators, uses cookies, pixel tags, device or other identifiers, and local storage to provide a seamless and safe experience. We use third-party analytics tools to help us understand usage of our Website. These tools may collect information such as browser type, IP address, and usage patterns. This information is only used for aggregate analytics and not combined with student data.

How we Restrict Information Collection

We value our users' privacy, and have therefore imposed the following restrictions and procedures to limit the data we collect:

• • Teachers can roster with alternate profile names, including student initials or IDs, that conceal student identity within LitLab.
• • Educators have the right to access, correct, download, or delete any of their personal information collected by LitLab. Parents and educators can exercise these rights on behalf of their students. To request correction of inaccurate personal information, contact us at ops@litlab.ai with the requester's name, role, school/district, the data to correct, and supporting details. We will make corrections within 30 days.
• • We do not retain student data beyond the time required to support the school's educational purpose, unless approved by the school, educator, parent, or legal guardian.
• • Teachers, administrators, parents, and legal guardians may submit requests for data deletion. LitLab will erase or anonymize student data within the period required under applicable law.
• • To promote a safe learning environment, we use measures such as rate-limiting, keyword/phrase flags for potentially harmful content, and LLM moderation. Student content is not indexed for public search. We continuously review safety tooling for effectiveness.
• • Users can report inappropriate content using an in-product "Report" feature or by emailing ops@litlab.ai with the subject line "Content Report." We aim to acknowledge reports within 2 business days, investigate, and may notify the individual who reported the content of outcomes and actions taken.

How We Use Gathered Information

We exclusively use gathered information to offer our Services and to maintain, enhance, and develop LitLab. Specifically, the collected information may be used as follows:

• • To enable educators to evaluate students' work, observe students' performance and progress, design lessons, and further aid in their students' education.
• • To allow parents and guardians to review their children's work and monitor their children's performance and progress.
• • To provide feedback and assistance to students related to their educational progress.
• • To permit students to access information shared with them by their educators.
• • To let students monitor their own progress.
• • To enable students to build book collections.
• • To provide students the opportunity to maintain a portfolio of their work.
• • To personalize learning experiences for students, including generating tailored learning suggestions and proposing other assignments, educational content, or activities.
• • To customize user experiences, comprehending how our Services are accessed and used, and their performance, so we can enhance its design and functionality.
• • To perform analysis on aggregated and anonymized (which cannot reasonably be used to identify an individual) for internal analysis and improvement of our services, or in collaboration with research partners to study and improve reading instruction and learning outcomes.
• • To supply educators with various types of reports, like reports detailing the performance and progress of a specific classroom or student.
• • To collect feedback on our Services how we can improve it.
• • To diagnose issues, troubleshoot problems, and provide maintenance and support.
• • We use educator, parent, or legal guardian information to communicate with those individuals, including sending them marketing communications consistent with their selections and preferences. We do not send marketing communications to students.
• • We do not combine personal information collected through our Services with information from other sources unless necessary to provide the service (e.g. integrating assessment scores from a connected learning management system to display progress), and in such cases we treat all combined information as personal information.

Information Disclosure

We share student data only with contracted service providers necessary to operate and improve our service, including cloud hosting and storage providers, authentication and identity management providers, analytics and error monitoring providers, customer support platforms, and communication services.

These providers are contractually prohibited from selling, renting, or using student data for advertising, marketing, profiling, or any purpose other than delivering their services to us. They may access student data only as required by us to perform their contracted functions and must adhere to strict confidentiality and data security obligations.

LitLab does not share, sell, or rent Student Data or provide it to third parties for targeted advertising, marketing, or any commercial purposes.

In the event of a change to our organization—such as a merger, acquisition, bankruptcy, reorganization, or sale of assets—personal information we have collected from users may be transferred as part of that transaction. In such a case, this Privacy Policy will continue to apply to your information, and any successor entity will only be permitted to use your personal information in accordance with this Privacy Policy, unless you provide consent to a new policy.

We will provide notice of any such transaction within thirty (30) days following its completion, by posting on our homepage and, if you have provided us with an email address, by sending notice to that email. Subject to applicable law, if you do not consent to the use of your personal information by the successor entity, you may request deletion of your information.

Data Protection

Securing your data and information is critical to us, and safeguarding Student Data is our highest priority. Thus, in our efforts to keep user information secure, we implement the following measures:

• • We use industry-standard organizational, physical, technical, and administrative strategies aimed at maintaining the integrity and security of any personal information collected.
• • We use top-tier, industry-leading Secure Socket Layer (SSL) encryption technology to protect user data.
• • We encrypt personal information and Student Data at rest, including in databases, file storage, and backups, using industry-standard encryption.
• • Access to personal information is strictly limited to LitLab employees and contractors who need it to carry out their work responsibilities. Employees or contractors face disciplinary action, including termination or cancelling of their contracts with possible legal action, if they fail to uphold LitLab's privacy and confidentiality standards.

Data Breach

LitLab has designed its security program following the NIST Cybersecurity Framework v1.1. Although we make concerted good faith efforts to maintain the security of personal information, and we work hard to ensure the integrity and security of our systems, no practices are completely foolproof. Outages, attacks, human error, system failure, unauthorized use, or other factors may compromise the security of user information at any time.

• • Investigation of breach: Upon detecting a breach, we conduct a thorough investigation to determine the compromised information, the breach method, and the affected parties. This investigation also involves external experts when necessary.
• • Containment and mitigation: Simultaneously with the investigation, we implement immediate containment measures to limit data loss and patch any security vulnerabilities.
• • Notifying affected parties: If we learn of a security breach, we will attempt to notify the affected parties electronically (subject to any applicable laws and school reporting requirements) so that you can take appropriate protective steps. For example, we may send an email to the email address provided to us. If a user's school has a direct relationship with LitLab (such as in a paid contract or a school-wide trial), any school administrators who are points of contact for LitLab will be notified as well. Where required by law, we will notify relevant authorities (e.g., state Attorneys General, supervisory authorities, or other regulators) without unreasonable delay and in accordance with applicable timelines. Notices will describe the incident, categories of impacted information, our mitigation steps, and guidance on protective measures.

Data Retention

Parents, educators, or schools can request a copy of the personal information we hold about a student by contacting ops@litlab.ai with the requester's name, role, school/district, the data requested, and supporting details. We verify requests through school/district authentication or reasonable identity checks. We acknowledge requests within five (5) business days and will provide the requested information within sixty (60) days.

We do not retain personal information beyond the necessary time period to support our legitimate business needs as specified in this Privacy Policy, unless we have permission of the teacher, administrator, parent or legal guardian of the student. Teachers, administrators, and parents may contact us at ops@litlab.ai to request the deletion of Student Data.

We commit to delete Student Data within sixty (60) days of receiving a deletion request. If we do not receive a deletion request, LitLab may delete or de-identify personal information following a period of inactivity in accordance with our standard data retention schedule.

Please note: We may not always be able to instantly or entirely delete all data in every case, such as information kept in technical support records, customer service records, backups, and other similar business records, or as required to be retained by law. We will not be obliged to delete any information which has been de-identified or disassociated with personal identifiers such that the remaining information cannot reasonably be used to identify a particular individual.

Third Parties

Our Platform links to Google and Clever for authentication services, and we may use integrations with Schoology, Canvas, Seesaw, and other LMS and learning management providers. Educators will be given the option to allow LitLab to share information with these learning management providers where applicable.

Third parties are responsible for their own privacy policies which users are encouraged to review thoroughly. LitLab is not responsible for the privacy, information, or other practices of any third parties, including any third party operating any site or service to which the Platform or Website links. The inclusion of a link on the Platform or Website does not imply our endorsement of the linked site or service.

Copyright and DMCA

LitLab respects the intellectual property rights of others. If we receive a valid copyright infringement notice under the Digital Millennium Copyright Act ("DMCA"), we may remove or disable access to the reported content. When this happens, we will notify the user who provided the content. If you believe your content was removed in error, you may send us a counter-notice as permitted by the DMCA. We will then follow the procedures set out in the DMCA, which may include restoring the content unless the copyright owner seeks a court order. Copyright notices and counter-notices can be sent to ops@litlab.ai.

User Content and Ownership

Students and educators (or their schools/districts, as applicable) retain ownership of the submissions they directly upload to the Platform ("User Content"). LitLab does not claim ownership of User Content. LitLab will not use User Content for advertising, marketing, or resale, and will treat it as educational data under this Policy and applicable law. However, by submitting User Content, you (or your school/district) grant LitLab a limited, non-exclusive, revocable license to host, process, and display the User Content only as necessary to provide the Service at the direction of the school/district. This license does not allow LitLab to use User Content for marketing, advertising, or commercial resale.

All instructional materials, decodable texts (including AI- or system-generated texts), analytics, software, and other content developed by LitLab ("LitLab Content") are and remain the exclusive property of LitLab. Users and districts receive only a limited right to access and use LitLab Content in connection with their educational use of the Service, subject to their agreement with LitLab. No rights in LitLab Content are transferred to users, and all goodwill and intellectual property rights remain solely with LitLab.

LitLab acquires no ownership rights in User Content, and the limited license to User Content automatically ends once the school/district directs deletion or the account is terminated, subject to backup retention periods. Users acquire no ownership rights in LitLab Content, and may not copy, modify, distribute, or create derivative works from LitLab Content except as expressly permitted by LitLab in writing.

Our Compliance with Applicable Laws

When a user uses the Platform for an educational purpose, LitLab receives personal information provided by the school, educator, student, student's parent, or legal guardian. LitLab does not own or control this personal information, which belongs to each user as appropriate.

This Privacy Policy and the Platform have been developed thoughtfully to protect personal information in accordance with applicable federal and state privacy laws. Below are several key examples of these laws and, how our Privacy Policy and Platform adhere to them:

The Family Educational Rights and Privacy Act ("FERPA"). Student Data collected by LitLab includes personally identifiable information found in educational records that are subject to the federal law known as the Family Educational Rights and Privacy Act, or FERPA. LitLab collects and processes Student Data as a "School Official" as the term is defined by FERPA and its implementing regulations. We commit to working with schools to ensure mutual compliance with FERPA regulations.

The Children's Online Privacy Protection Act ("COPPA"). When a school uses the Platform for educational purposes, we depend on the school to provide consent for LitLab to collect personal information from students that are under the age of 13 for educational purposes only, as limited by COPPA. Upon written request, we provide schools the opportunity to review and delete any personal information collected about their students. If you are a parent or legal guardian and you have questions about your child's use of the Platform, please share your questions with your child's school, or, you may reach out to us with the contact information provided below.

The California Consumer Privacy Act ("CCPA") (California residents only). When LitLab provides the Platform to schools as a "School Official" as that term is defined in the California Consumer Privacy Act (or the "CCPA"), we only gather, retain, utilize, and disclose Student Data for the purpose of providing the Platform, and for no other commercial purpose. If you have further questions or if you would like to exercise your rights as a California resident, please contact your school or us by using the contact information below.

Consent to Receive Communications

By signing up for the Platform, you agree to receive communications from us, including email, and/or push notifications. We are not responsible for your receipt of, or failure to receive any messages, or for messages sent erroneously or with incorrect information. We are not responsible for your or someone else's action or failure to take action due to the receipt of any messages. If you make changes to your contact information, you are responsible for updating your Account Settings. You can also opt-out of notifications in your Account Settings.

You can also opt-out of marketing communications from us at any time. If you opt-out of marketing communications, you may still receive communications that are necessary for the Platform or otherwise exempt from anti-spam laws. By opting out of communications from Litlab, you acknowledge that this may impact your use of the Platform.

Contact

For questions or concerns related to privacy, we can be contacted by email at ops@litlab.ai, or by mail at: