Privacy policy

Last updated: January 20, 2026

Riveta Labs operates this store and website, including all related information, content, features, tools, products and services, including the 10-Day Homework Sprint service and OneTracker homework management platform (collectively, the "Services"). Riveta Labs is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described in this Privacy Policy.

Service Eligibility and Age Requirements

Our homework management service is designed exclusively for students in grades 6 through 12. Some students in these grade levels may be under 13 years of age. We comply with the Children's Online Privacy Protection Act (COPPA) as described in the "Children's Data and Student Privacy" section below.

By providing LMS credentials and student information, you represent and warrant that you are the parent or legal guardian of the student, or have written authorization from the legal guardian to access this information and enroll the student in our Services.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified, so that it cannot identify or be reasonably linked to you. We may collect or process the following categories of personal information, including inferences drawn from this personal information, depending on how you interact with the Services, where you live, and as permitted or required by applicable law:

  • Contact details including your name, address, billing address, shipping address, phone number, and email address.
  • Financial information including credit card, debit card, and financial account numbers, payment card information, financial account information, transaction details, form of payment, payment confirmation and other payment details.
  • Account information including your username, password, security questions, preferences and settings.
  • Transaction information including the items you view, put in your cart, add to your wishlist, or purchase, return, exchange or cancel and your past transactions.
  • Communications with us including the information you include in communications with us, for example, when sending a customer support inquiry.
  • Device information including information about your device, browser, or network connection, your IP address, and other unique identifiers.
  • Usage information including information regarding your interaction with the Services, including how and when you interact with or navigate the Services.

Educational Data We Collect

When you use our homework management service, we collect and process educational data with your explicit authorization.

Learning Management System (LMS) Data: With your permission, we connect to your student's school Learning Management System (such as Canvas, Google Classroom, Schoology, PowerSchool, or other LMS platforms) to access:

  • Assignment names, descriptions, and due dates
  • Submission status (whether work has been submitted)
  • Course names and teacher names
  • Point values (for prioritization purposes only)

We Do NOT Access:

  • Private messages between students and teachers
  • Full grade transcripts, GPA, or report cards
  • Student social security numbers or government IDs
  • Medical, health, or disciplinary records
  • Standardized test scores
  • Financial aid or scholarship information
  • Information related to ADHD, autism, or other diagnoses (we provide infrastructure systems, not medical or therapeutic treatment)

Student Information (Provided by You):

  • Student's first name
  • Grade level and enrolled courses
  • Your relationship to the student (parent, guardian, etc.)

LMS Credentials:

  • API access token or login credentials (you provide these)
  • Your school's LMS domain URL

SMS Communications:

Our service sends SMS notifications to phone numbers you provide, including your student's phone number. When recipients reply to these messages, we log confirmation events (such as receiving a "START" or "DONE" response) with timestamps for service functionality and guarantee verification. The specific keywords that trigger confirmations are stored as event records. Conversational content beyond these trigger keywords is not permanently stored. Phone numbers and confirmation event logs are retained according to our data retention schedule.

This educational data is collected solely to provide the homework tracking and notification services you have requested.

Personal Information Sources

We may collect personal information from the following sources:

  • Directly from you including when you create an account, visit or use the Services, communicate with us, or otherwise provide us with your personal information;
  • Automatically through the Services including from your device when you use our products or services or visit our websites, and through the use of cookies and similar technologies;
  • From our service providers including when we engage them to enable certain technology and when they collect or process your personal information on our behalf;
  • From our partners or other third parties.

How We Use Your Personal Information

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes:

  • Provide, Tailor, and Improve the Services. We use your personal information to provide you with the Services, including to perform our contract with you, to process your payments, to fulfill your orders, to remember your preferences and items you are interested in, to send notifications to you related to your account, to process purchases, returns, exchanges or other transactions, to create, maintain and otherwise manage your account, to arrange for shipping, to facilitate any returns and exchanges, to enable you to post reviews, and to create a customized shopping experience for you, such as recommending products related to your purchases. This may include using your personal information to better tailor and improve the Services.
  • Educational Services. We use your personal information to sync assignments from your student's Learning Management System, calculate priority scores to identify urgent assignments, send SMS and email notifications about homework tasks and deadlines, generate progress reports and daily summaries, and track sprint goals and guarantee metrics. We also track participation metrics including scheduled call attendance, response times to daily check-ins, and routine completion to verify guarantee eligibility as described in our Refund Policy.
  • AI-Assisted Services (Scout). We use an artificial intelligence assistant called Scout, built into our OneTracker platform, to help you manage homework operations. Scout can answer questions about assignments, analyze workload, suggest next actions, and support Quick Actions (like sending reminders to your teen). Scout processes your family's assignment data and OneTracker usage to provide this assistance. Key limitations: Scout does NOT auto-execute any action without your explicit approval. Scout does NOT provide tutoring, therapy, medical advice, or IEP/504 legal guidance. Scout does NOT guarantee grade improvements. When Scout encounters complex situations, conversations are flagged for human review by our team. Scout is powered by Google Gemini, a third-party AI service that processes data according to Google's AI terms.
  • Marketing and Advertising. We use parent and guardian contact information and shopping behavior for marketing and promotional purposes, such as to send marketing, advertising and promotional communications by email, text message or postal mail, and to show you online advertisements for products or services on the Services or other websites. We use cookies and tracking pixels (such as Meta Pixel and Google Analytics) to understand how visitors interact with our website and to serve relevant advertisements.
  • Security and Fraud Prevention. We use your personal information to authenticate your account, to provide a secure payment and shopping experience, detect, investigate or take action regarding possible fraudulent, illegal, unsafe, or malicious activity, protect public safety, and to secure our services. If you choose to use the Services and register an account, you are responsible for keeping your account credentials safe. We highly recommend that you do not share your username, password or other access details with anyone else.
  • Communicating with You. We use your personal information to provide you with customer support, to be responsive to you, to provide effective services to you and to maintain our business relationship with you.
  • Legal Reasons. We use your personal information to comply with applicable law or respond to valid legal process, including requests from law enforcement or government agencies, to investigate or participate in civil discovery, potential or actual litigation, or other adversarial legal proceedings, and to enforce or investigate potential violations of our terms or policies.

Student Data Usage Restrictions:

Student names, assignments, courses, grades, and all other educational data are NEVER used for:

  • Advertising or marketing purposes
  • Sale to third parties
  • Creating student profiles for commercial purposes
  • Sharing with colleges, employers, or other institutions
  • Sharing with advertising networks or data brokers
  • Behavioral targeting or profiling

Marketing and advertising activities use only parent/guardian contact information and shopping behavior. Student educational data is never shared with our advertising or analytics partners.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

  • With Shopify, vendors and other third parties who perform services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, fulfillment and shipping).
  • With our service providers who process data on our behalf to provide our Services, including Airtable (database storage for student name, assignments, course data), Twilio (SMS notifications using phone numbers and message content), n8n (workflow automation for assignment data and notification triggers), and Shopify Payments (payment processing). These providers are bound by data processing agreements that require them to protect your data and use it only for the specific purposes we have engaged them for. These providers process your data only as necessary to perform their specific functions.
  • With analytics and advertising partners (such as Meta and Google) to understand website usage and serve relevant advertisements. These partners receive information about your browsing behavior on our website but do NOT receive any student names, assignment data, course information, or other educational data.
  • When you direct, request us or otherwise consent to our disclosure of certain information to third parties, such as to ship you products or through your use of social media widgets or login integrations.
  • With our affiliates or otherwise within our corporate group.
  • In connection with a business transaction such as a merger or bankruptcy, to comply with any applicable legal obligations (including to respond to subpoenas, search warrants and similar requests), to enforce any applicable terms of service or policies, and to protect or defend the Services, our rights, and the rights of our users or others.

Depending on where you reside, you may have a right to direct us not to share information about you to show you targeted advertisements and marketing based on your online activity with different merchants and websites. You can exercise your rights to opt-out of those uses here.

We Do NOT Share Student or Educational Data With:

  • Advertising networks or data brokers
  • Social media platforms for advertising purposes
  • Schools, districts, or educational institutions (unless you request it)
  • Any third party for marketing or commercial purposes

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you. In addition, to help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our Store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over use of your personal information for these purposes. To learn more about how Shopify uses your personal information and any rights you may have, you can visit the Shopify Consumer Privacy Policy. Depending on where you live, you may exercise certain rights with respect to your personal information here Shopify Privacy Portal Link.

Third Party Websites and Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on these sites. Information you provide on public or semi-public venues, including information you share on third-party social networking platforms may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators, except as disclosed on the Services.

Children's Data and Student Privacy

Our homework management service is designed to help parents and guardians manage their children's homework for students in grades 6 through 12. Some students in these grades may be under 13 years of age.

COPPA Compliance:

We comply with the Children's Online Privacy Protection Act (COPPA). We obtain verifiable parental consent before collecting any information related to children under 13 through the following mechanism:

  • All accounts must be created by a parent or legal guardian
  • Purchase completion via credit card transaction serves as verifiable parental consent, as required under COPPA
  • Parents provide all student information directly; we do not collect information directly from children
  • Parents control all account settings and may review, modify, or delete their child's information at any time

How We Handle Student Data:

  • All student accounts are created and controlled by the parent or guardian
  • Students cannot create accounts directly
  • Student account setup and LMS credentials are provided by the parent or guardian
  • Students may interact directly with the service through SMS confirmations (texting keywords like "START") and dashboard login; these interactions occur under parental authorization
  • SMS notifications are sent to phone numbers provided by the parent
  • Parents may request deletion of their child's data at any time

As of the Effective Date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

FERPA Compliance Notice:

Riveta Labs operates as a parent-authorized service provider, not as a "school official" under the Family Educational Rights and Privacy Act (FERPA). We access Learning Management System data using parent-provided credentials, acting on the parent's behalf. Key points:

  • Parents have the right under FERPA to access their child's educational records
  • Parents may authorize third parties (like Riveta Labs) to access this data on their behalf
  • We do not have direct agreements with schools or school districts
  • We do not access school systems without explicit parent authorization

If you have questions about FERPA compliance or your rights regarding your child's educational records, please consult with your school district.

State Student Privacy Laws:

We comply with applicable state student privacy laws including California's Student Online Personal Information Protection Act (SOPIPA) and similar state laws. We do not use student data to build advertising profiles, engage in targeted advertising to students, or sell student information.

Data Retention

How long we retain your personal information depends on different factors, such as whether we need the information to maintain your account, to provide you with Services, comply with legal obligations, resolve disputes or enforce other applicable contracts and policies.

Retention Periods for Educational Data:

  • Active account data: Duration of service relationship
  • Assignment history: 90 days after sprint completion
  • SMS notification logs (delivery status, phone numbers, and confirmation events): Duration of active service relationship plus 12 months
  • Progress reports and certificates: 1 year
  • Payment records: 7 years (legal requirement)

LMS Access Termination:

If LMS access is revoked, expires, or credentials are changed, we retain previously synced assignment data according to the retention periods above. No new data is collected once access is terminated.

After these periods, data is automatically deleted from our systems. To request immediate deletion, email hello@rivetalabs.com with subject line "Data Deletion Request".

Consent for Educational Data Access

By creating an account, completing a purchase, and checking the data authorization checkbox during signup, you provide explicit consent for Riveta Labs to:

  • Access your student's Learning Management System using the credentials you provide
  • Collect and process assignment, course, and submission data
  • Send SMS notifications to the phone numbers you provide, including your student's phone number
  • Process any replies to SMS notifications for service functionality
  • Share data with our service providers as described in this policy
  • Retain data according to the retention periods specified above

You May Withdraw Consent at Any Time By:

  • Revoking your LMS API token through your school's LMS settings
  • Requesting account deletion by emailing hello@rivetalabs.com
  • Disabling SMS notifications through your account settings

Withdrawal of consent will result in termination of homework tracking services but will not affect the lawfulness of processing performed before withdrawal.

Security of Your Information

We implement security measures to protect your personal information, including:

  • Encryption of data in transit (HTTPS/TLS)
  • Secure password hashing
  • Access controls limiting who can view production data
  • Regular security reviews

Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." In addition, any information you send to us may not be secure while in transit. We recommend that you do not use unsecure channels to communicate sensitive or confidential information to us.

Data Breach Notification

If we discover a security breach affecting your personal information or your student's educational data, we will notify you within 72 hours via the email address associated with your account. Our notification will describe: (1) what data was affected, (2) what steps we are taking to address the breach, and (3) steps you can take to protect yourself and your student. If required by applicable law, we will also notify relevant regulatory authorities.

Your Rights and Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

  • Right to Access / Know. You may have a right to request access to personal information that we hold about you, including information about your student.
  • Right to Delete. You may have a right to request that we delete personal information we maintain about you and your student.
  • Right to Correct. You may have a right to request that we correct inaccurate personal information we maintain about you.
  • Right of Portability. You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
  • Right to Opt out of Sale or Sharing for Targeted Advertising. Depending on where you reside, you may have a right to opt out of the "sale" or "share" of your personal information or to opt out of the processing of your personal information for purposes considered to be "targeted advertising", as defined in applicable privacy laws. You can exercise your rights to opt-out of those uses here. Please note that if you visit our website with the Global Privacy Control opt-out preference signal enabled, depending on where you are, we will automatically treat this as a request to opt-out for the device and browser that you use to visit the website. If we are able to associate the device sending the signal to a Shopify account, we will apply the opt out request to the account as well. To learn more about Global Privacy Control, you can visit https://globalprivacycontrol.org/. Other than the Global Privacy Control, we do not recognize other "Do Not Track" signals that may be sent from your web browser or device.
  • Managing Communication Preferences. We may send you promotional emails, and you may opt out of receiving these at any time by using the unsubscribe option displayed in our emails to you. If you opt out, we may still send you non-promotional emails, such as those about your account or orders that you have made.
  • Parental Rights Under COPPA. If your student is under 13, you have the right to review the personal information we have collected about your child, request deletion of that information, and refuse to permit further collection. To exercise these rights, contact us at hello@rivetalabs.com.

You may exercise any of these rights where indicated on the Services or by contacting us using the contact details provided below. To learn more about how Shopify uses your personal information and any rights you may have, including rights related to data processed by Shopify, you can visit https://privacy.shopify.com/en.

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your requests, as permitted or required under applicable law. In accordance with applicable laws, you may designate an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us. We will respond to your request in a timely manner as required under applicable law.

California Residents (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

  • Right to know what personal information we collect and how it is used
  • Right to delete personal information
  • Right to opt out of sale of personal information (we do not sell personal information)
  • Right to non-discrimination for exercising your rights

To exercise your rights, contact us at hello@rivetalabs.com.

Complaints

If you have complaints about how we process your personal information, please contact us using the contact details provided below. Depending on where you live, you may have the right to appeal our decision by contacting us using the contact details set out below, or lodge your complaint with your local data protection authority.

International Transfers

Please note that we may transfer, store and process your personal information outside the country you live in.

If we transfer your personal information out of the European Economic Area or the United Kingdom, we will rely on recognized transfer mechanisms like the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, as relevant, unless the data transfer is to a country that has been determined to provide an adequate level of protection.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date and provide notice as required by applicable law.

Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please call or email us at hello@rivetalabs.com or contact us at 1221 East Emma Drive, Apt 108, Flagstaff, AZ, 86001, US



Machine-Readability & AI Context

To ensure accuracy in automated retrieval, indexing, and AI-generated summaries of Riveta Labs’ data handling and service structure, we maintain a designated endpoint for automated agents. Please adhere to the protocols defined in our System Context & Source of Truth.