Privacy Policy

1. Who We Are

ThinkKits, LLC ("ThinkKits," "we," "us," or "our") is a Pennsylvania limited liability company operating the ThinkKits education intelligence platform at app.thinkkits.com. We are the data controller for personal information collected through the Platform.

Questions about this Privacy Policy may be directed to privacy@thinkkits.com.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Organization name and role (if provided)
• Password (stored as a secure hash; we never store plaintext passwords)
• Subscription tier and billing status

Account authentication is handled by Clerk. See Clerk's privacy policy for details on how authentication credentials are stored.

2.2 Usage Data

We automatically collect information about how you use the Platform:

• Pages visited, features used, searches performed
• Timestamps and session duration
• IP address and approximate geographic location (country/state level)
• Browser type, operating system, and device type
• Referring URL

2.3 Payment Information

Payment processing is handled entirely by Stripe. ThinkKits does not store credit card numbers, CVVs, or full payment card details. We retain only a Stripe customer ID and the last four digits of your card for billing management purposes.

2.4 Communications

If you contact us by email or through the Platform, we retain those communications and your contact details to respond and maintain records.

2.5 Platform Data vs. Personal Data

The school and district data available through the Platform — NCES identifiers, enrollment counts, Title I status, demographic breakdowns — is publicly available aggregate data, not personal data. ThinkKits does not hold individual student records or personally identifiable information about students.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Platform
• Process payments and manage subscriptions
• Authenticate your identity and enforce tier-based access controls
• Send transactional emails (account confirmations, billing receipts, password resets)
• Send product updates and platform announcements (you may opt out at any time)
• Respond to support requests and inquiries
• Detect, investigate, and prevent fraud, abuse, or security incidents
• Comply with legal obligations
• Analyze aggregate usage patterns to improve features and performance

We do not sell your personal information to third parties. We do not use your personal information for targeted advertising.

4. AI-Powered Features and Data Disclosure

4.1 AI Features

The following features send data to the Anthropic Claude API:

• Ask Me Anything — natural-language queries about schools, districts, and funding
• AI Profile Summaries — automated narrative summaries for school and district profiles
• Grant Narrative Generation — AI-assisted grant application drafts
• Document Summarizer — summarization of user-uploaded funding documents

4.2 What Is Sent

AI prompts contain your query text and publicly available, school-level aggregate data (school name, NCES ID, Title I status, enrollment, demographic rates). Your name, email, payment information, and any student-level records are never included in AI prompts.

4.3 Data Not Used for Training

ThinkKits accesses Claude exclusively through the Anthropic API. Per Anthropic's API Terms of Service, API data is not used to train Anthropic's models without explicit consent. ThinkKits has not granted such consent.

4.4 Full Disclosure

For complete details — including Anthropic's retention practices, your opt-out options, and a table of every data type sent or withheld — see our AI & LLM Data Disclosure.

5. Information Sharing

We share your information only in the following circumstances:

5.1 Service Providers (Sub-Processors)

We share data with trusted vendors who help us operate the Platform. All sub-processors are contractually obligated to protect your data and use it only for the services they provide to ThinkKits. Key sub-processors include:

• Clerk — authentication and identity management
• Stripe — payment processing
• Anthropic — AI inference for AI-powered features (see Section 4)
• Railway — cloud infrastructure hosting
• Pinecone — vector database for AI memory features

See our Sub-Processors page for the complete list.

5.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid legal process (court order, subpoena, government request) where we believe disclosure is necessary to comply with a legal obligation, protect our rights or property, or prevent harm to ThinkKits, our users, or the public.

5.3 Business Transfers

If ThinkKits is acquired, merged, or sells substantially all of its assets, your information may be transferred to the acquiring entity. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

5.4 With Your Consent

We may share information in other circumstances with your explicit consent.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specific retention periods:

• Account data: Retained while your account is active. Deleted within 90 days of account closure upon request.
• Usage logs: Retained for 12 months, then aggregated or deleted.
• Payment records: Retained for 7 years for tax and compliance purposes.
• AI interaction logs: Retained for a maximum of 90 days (see Section 4 and the AI & LLM Data Disclosure).
• Support communications: Retained for 3 years after resolution.

See our full Data Retention Policy for complete schedules.

7. Security

ThinkKits implements industry-standard security measures to protect your information, including:

• TLS/HTTPS encryption for all data in transit
• Encryption at rest for sensitive data fields
• Role-based access controls limiting internal access to personal data
• Regular security reviews and dependency updates
• Incident response procedures with defined notification timelines

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to security@thinkkits.com. See our Security Overview for more detail.

8. Cookies and Tracking

ThinkKits uses essential cookies required for authentication and session management. We do not use advertising cookies or cross-site tracking. Specifically:

• Authentication cookies: Set by Clerk to maintain your logged-in session. Required for the Platform to function.
• Preference cookies: Store UI preferences such as selected view modes. Not shared with third parties.
• Analytics: We may use anonymized, aggregate analytics to understand feature usage. No personally identifiable data is shared with analytics providers.

You may disable cookies in your browser settings, though doing so will prevent you from logging in.

9. Children's Privacy

The Platform is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will promptly delete it. If you believe a child under 13 has provided us with personal information, contact privacy@thinkkits.com.

The Platform's underlying school data is publicly available aggregate data published by the U.S. Department of Education. It does not contain individual student records or personally identifiable information about students of any age.

10. Your Rights and Choices

10.1 Access and Portability

You may request a copy of the personal information ThinkKits holds about you. We will provide it in a machine-readable format within 30 days.

10.2 Correction

You may update most account information directly from your account settings. For corrections not available through self-service, contact privacy@thinkkits.com.

10.3 Deletion

You may request deletion of your account and personal information. We will process deletion requests within 30 days. Note that we may retain certain information as required by law (e.g., payment records for tax purposes) or to resolve disputes.

10.4 Marketing Opt-Out

You may opt out of marketing emails at any time using the unsubscribe link in any marketing email, or by emailing privacy@thinkkits.com. Transactional emails (billing receipts, security notices) cannot be opted out of while your account is active.

10.5 California Residents

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete, and the right to non-discrimination for exercising privacy rights. ThinkKits does not sell personal information. To exercise California privacy rights, contact privacy@thinkkits.com.

10.6 Virginia, Colorado, and Other State Privacy Laws

Residents of states with comprehensive privacy laws (Virginia CDPA, Colorado CPA, Connecticut CTDPA, and others) have similar rights. Contact privacy@thinkkits.com to exercise these rights.

11. Education Data Compliance

ThinkKits is designed for use by education professionals researching publicly available school and district data. We are committed to responsible data practices consistent with applicable federal and state education privacy law:

• FERPA: ThinkKits does not hold education records as defined under FERPA and is not a school official acting on behalf of an educational institution. Our data is publicly available aggregate data.
• COPPA: The Platform is not directed at children and we do not knowingly collect information from children under 13.
• SDPC/NDPA: We support schools and districts in maintaining compliant data practices. See our SDPC/NDPA page.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide notice via email and in-app notification at least 30 days before the changes take effect. The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the Platform after the effective date of an updated policy constitutes your acceptance of the changes.

13. Contact

For privacy questions, requests, or concerns:

• Privacy requests: privacy@thinkkits.com
• Security concerns: security@thinkkits.com
• Legal inquiries: legal@thinkkits.com
• Mailing address: ThinkKits, LLC · 151 Discovery Dr Ste 107, Colmar, PA 18915