Privacy Policy

Effective September 28, 2026

This policy explains how Statecourse LLC (“StateCourse,” “we,” “us”) handles personal data when you use the StateCourse AI plugin, its MCP service, and related StateCourse account features.

Data we collect

• Account and identity data: name, email address, user and organization identifiers, account membership, authentication status, and verification status.
• Product and entitlement data: StateCourse AI plan, subscription status, billing customer reference, and the products or courses connected to your StateCourse account. We do not receive or store full payment-card numbers.
• Plugin activity metadata: request ID, user and account IDs, tool or skill used, entitlement decision, source-version IDs, outcome, latency, error category, and limited safety or product analytics metadata.
• Content you submit: the minimum text and project information needed to answer a request or save a StateCourse AI project. StateCourse AI is designed not to log full ChatGPT transcripts by default.
• Support data: information you provide when requesting help.

How we use data

We use data to authenticate users, enforce account and product access, perform requested plugin functions, preserve tenant isolation, provide regulatory-source traceability, prevent abuse and protected-content extraction, diagnose errors, measure service usage, provide support, and meet legal, accounting, and security obligations.

Sharing and service providers

We share only what is necessary with service providers that operate the service, including OpenAI for the ChatGPT plugin experience, Supabase for authentication and database hosting, Netlify for application hosting, and Stripe for subscription billing. These providers process data under their own terms and privacy commitments. We may also disclose data when required by law or to protect users, StateCourse, or the public. We do not sell personal data.

Retention

• Account, project, and entitlement data is kept while the account or related service is active, then deleted or de-identified within 30 days after a verified deletion request unless a longer period is legally required.
• Operational audit, security, and usage metadata is retained for up to 24 months.
• OAuth access tokens expire according to their configured lifetime; refresh credentials are retained only until expiration, rotation, revocation, or account deletion.
• Billing and transaction records may be retained for up to seven years for tax, accounting, fraud-prevention, and legal obligations.
• Support records are retained for up to 24 months after the request is closed.

Security and content minimization

StateCourse applies access controls, row-level security, tenant-scoped authorization, and logging redaction. Logs are designed not to contain access tokens, passwords, secrets, full protected course content, answer keys, question banks, or unnecessary personal data. No security measure is perfect, and users should not submit secrets or sensitive student records through the plugin.

Your controls

You may disconnect the plugin, revoke access, correct account information, or request access to or deletion of personal data by contacting us through the support page. Some records may be retained where required by law or necessary to resolve security, fraud, or billing matters.

Children

The service is not directed to children under 13, and StateCourse does not knowingly collect their personal information through the plugin. Users under 18 should use the service only with appropriate adult or institutional authorization.

Contact and changes

Questions or privacy requests may be submitted through StateCourse AI Support. We may update this policy and will post the effective date above.