Privacy Policy

Account data (name, email, role, school, state), learning activity (lessons, quiz scores, simulated trades, class enrollment and grades), and — only if you purchase Pro or a coaching session — billing status. Payment card details go directly to Stripe; Divendo never sees or stores card numbers.

Divendo is designed for classroom use, including by students under 13. In compliance with the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501–6506; 16 CFR Part 312):

• We collect only the information reasonably necessary to provide the educational service — nothing more.
• Schools/teachers may provide consent on behalf of parents strictly for the educational context (per FTC guidance); teachers create classes and invite students via class codes.
• We show no advertising of any kind and perform no behavioral profiling of students.
• Student-to-student open chat and forums are disabled until moderated, consent-gated messaging ships.
• Purchases require confirmation that the buyer is 18+ or a parent/guardian.
• Parents and schools may review or request deletion of a child's data at any time (below).

When Divendo is used by a school, grades and coursework may constitute education records under the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g). We act as a “school official” with a legitimate educational interest: student records are used only to provide the service, are never sold, and are accessible to the student's own teacher — not to other users.

We do not use student data for targeted advertising, do not sell or share personal information as defined by the CCPA/CPRA, and do not build non-educational profiles of K-12 students (Cal. Bus. & Prof. Code § 22584). California residents may exercise access, deletion, and correction rights via the contact below or the delete-account button in Settings.

Data is stored with Supabase (Postgres) with row-level security so users can only read their own records (teachers, only their own students'). Passwords are hashed by Supabase Auth; we cannot read them. Payments are processed by Stripe, a PCI-DSS Level 1 service provider.

We send only transactional email (verification, password reset, receipts, booked-session confirmations). Any future marketing email will include a working unsubscribe link and our postal address, per the CAN-SPAM Act.

Delete your account (and all associated records) any time from Settings, or email hello@divendo.app to access, export, correct, or delete your data. Requests from parents or schools on behalf of a student are honored the same way.