COPPA & FERPA Compliance Statement
Last Updated: February 20, 2026
For Schools: Imakie is designed to help educational institutions comply with federal student privacy laws. This document outlines our commitments and your responsibilities.
COPPA Compliance (Children Under 13)
The Children's Online Privacy Protection Act (COPPA) requires parental consent for collecting personal information from children under 13. Imakie supports COPPA compliance through:
- School Authorization: Schools act as agents for parents in the educational context, authorized to consent to data collection necessary for educational purposes
- Limited Data Collection: We collect only information necessary to provide educational services
- No Behavioral Advertising: We do not use student data for targeted advertising
- Parental Rights: Parents can review, correct, or delete their child's data through the school
FERPA Compliance (Student Education Records)
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. Imakie's FERPA safeguards include:
- School-Only Access: Student stories and progress data default to organization-only visibility
- Educator Control: Teachers and administrators control who can access student work
- Data Portability: Schools can export all student data at any time
- Deletion Rights: Schools can delete student accounts and data upon request
Data Processing Agreement (DPA)
For schools requiring a formal DPA, please contact us at contact@imakie.ai. We provide:
- Business Associate Agreement (BAA) templates
- Data security documentation
- Incident response procedures
- Third-party service provider disclosures
Your Responsibilities as a School
To maintain compliance, schools must:
- Obtain appropriate parental consents as required by local policy
- Ensure educators are trained on student privacy requirements
- Configure organization settings appropriately (org-only visibility for students)
- Monitor student activity and respond to privacy concerns
- Review and approve any student content before public publication
Security Measures
Imakie implements industry-standard security practices:
- Data encryption in transit (HTTPS) and at rest
- Role-based access controls
- Regular security audits and penetration testing
- Incident response and breach notification procedures
- SOC 2 Type II certification (in progress)
Third-Party Services
Imakie uses the following third-party services for core functionality:
- Google Cloud Platform: Hosting and database (GDPR/COPPA compliant)
- OpenAI: Text generation (Business tier with data protection)
- Stability AI / Replicate: Image generation (data not used for training)
All third-party providers have signed data processing agreements and comply with applicable privacy laws.
Data Retention
- Active Accounts: Data retained while account is active
- Deleted Accounts: All data deleted within 30 days of account deletion
- Backup Retention: Encrypted backups retained for 90 days for disaster recovery
Questions or Concerns
For compliance questions, contact: