Privacy Policy

Overview

Evident is a product of 5minMindful LLC ("we," "our," or "us"), a Delaware limited liability company located at 2803 Philadelphia Pike, Suite B #569, Claymont, DE 19703. We are committed to protecting the privacy of educators, students, and families who use our service. This Privacy Policy explains how we handle information when you use Evident.

The short version: Evident offers two modes of use:

• Guest Mode: Create charts without an account. All data stays in your browser and QR codes. Nothing is stored on our servers.
• Registered Teacher Accounts: Create an account to save charts, track student progress over time, and communicate with parents. This data is encrypted and stored securely on our servers.

Guest Mode (No Account)

When using Evident without an account, we do NOT collect or store:

• Student names or identifying information
• Behavior goals or chart content
• Parent contact information
• Any personally identifiable information

All chart data exists only in your browser's local storage and in QR codes you generate.

Registered Teacher Accounts

When you create an Evident account, we store the following information to provide our behavior tracking and parent communication services:

Data We Store

• Account information: Your email address and display name for authentication and account management.
• Student display names: First names or nicknames only. We recommend avoiding full names or other identifying information.
• Daily behavioral logs: Goal status (met/not met), teacher notes, and timestamps for each day.
• Parent interactions: Signature timestamps and acknowledgment records from the parent portal.
• Access tokens: Secure tokens that allow parents to view their child's chart without creating an account.

Data Ownership

Teachers retain full ownership of all student data. You can:

• Export your data at any time in CSV format from your dashboard
• Permanently delete individual student records
• Delete your entire account and all associated data

When you delete data, it is permanently removed from our servers within 30 days. If your account is subject to a Data Processing Agreement (DPA), data disposition follows the 60-day timeline specified in that agreement. We do not retain backups of deleted data.

Security

We protect your data with industry-standard security measures:

• Encryption at rest: All data is encrypted using AES-256 encryption in our database.
• Encryption in transit: All connections use TLS 1.3 encryption.
• Access controls: Row-level security ensures teachers can only access their own students' data.
• Audit logging: All data access and modifications are logged for security monitoring.

Information We May Collect (All Users)

To improve our service and ensure reliability, we may collect limited anonymous usage data:

• Analytics data: Page views, feature usage, and general traffic patterns, via Vercel Analytics (aggregated and cookieless) and PostHog (first-party product analytics). For signed-in users, PostHog associates product events with an account identifier; session replay masks form inputs and is disabled on sensitive pages. We do not use this data for advertising.
• Error logs: Technical errors that occur during use, which help us fix bugs. These logs do not contain student data.
• Translation requests: When you translate chart content, teacher notes, weekly family summaries, or evidence packets, the content is sent to our translation service: OpenAI for the US deployment, and Mistral AI (a French provider, processed in the EU) for the EU deployment. For notes, summaries, and evidence packets, Evident removes the student's name before sending and teachers review the redacted text first; names are restored on your device after translation. We set translation requests not to be stored by OpenAI, Mistral retains request content for at most 30 days (abuse monitoring only) and does not train on it, and we do not log or store this content on our servers.

How Your Data is Stored

Browser Storage

Your chart data is stored in your browser's local storage. This data:

• Never leaves your device unless you print or share a QR code
• Persists until you clear your browser data
• Is not accessible to Evident or any third party

QR Code Encoding

When you generate a QR code, the chart data is encoded directly into the QR code image using compression. This means:

• The data travels with the printed chart, not through our servers
• Anyone with access to the QR code can decode and view the data
• We recommend not including sensitive information in charts

FERPA Compliance

Evident is designed with FERPA (Family Educational Rights and Privacy Act) compliance in mind.

Guest Mode

When using Evident without an account, no student data is stored on our servers. Data exists only in your browser and QR codes, so no data sharing agreement is required.

Registered Accounts

We support compliance through:

• Minimal data collection: We only store display names, not full student records
• Data encryption: AES-256 encryption at rest and TLS 1.3 in transit
• Access controls: Row-level security ensures data isolation
• Audit logging: Complete record of data access
• Data portability: Export all data at any time
• Right to delete: Permanently delete data on request

Recommendations

We recommend that educators:

• Use only student first names or nicknames (not full names)
• Avoid including sensitive behavioral, medical, or disciplinary information
• Consult their school's data privacy officer before using with student data
• Contact us for a Data Processing Agreement if required by your district

Third-Party Services

Evident uses the following third-party services:

• Vercel: Hosting and analytics. See Vercel's Privacy Policy
• Supabase: Database and authentication for registered accounts. Data is stored in SOC 2 Type II certified data centers. See Supabase's Privacy Policy
• OpenAI: Translation services and optional AI note polish writing support. For note polish and for note, summary, and evidence packet translation, teachers review redacted text before sending; Evident does not send student IDs, student names, teacher emails, school names, class names, grades, IEP status, diagnoses, or app metadata. We have an executed Data Processing Addendum with OpenAI that includes the EU Standard Contractual Clauses for international transfers. OpenAI does not use API data to train its models; data is retained for up to 30 days for abuse monitoring and then deleted, and we set requests not to be stored. Subject to OpenAI's Privacy Policy
• Stripe: Payment processing for paid subscriptions. We do not store credit card numbers. See Stripe's Privacy Policy
• Resend: Transactional email delivery (e.g., parent signature notifications). See Resend's Privacy Policy
• Sentry: Error monitoring to detect and fix bugs. Error reports do not contain student data. See Sentry's Privacy Policy
• PostHog: First-party product analytics and session replay, used to understand how the product is used and to fix usability issues. Replay masks form inputs and is disabled on sensitive pages; analytics URLs are scrubbed of identifiers. See PostHog's Privacy Policy
• Upstash: Rate limiting to protect the service from abuse. No student data is stored. See Upstash's Privacy Policy

Cookies

Evident uses cookies that are necessary for the website to function, plus first-party analytics cookies (Vercel Analytics and PostHog) that help us understand how the product is used. We do not use advertising cookies, and we do not track you across other websites.

For visitors in the European Economic Area and the United Kingdom, we ask for consent before loading non-essential analytics cookies, and you can change your choice at any time from the "Cookie settings" link in the site footer.

Children's Privacy

Evident is designed for use by educators, not directly by children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can delete it.

Your Rights

Guest Users

Your data exists only in your browser:

• Access: Your data is in your browser's local storage and any QR codes you've generated.
• Deletion: Clear your browser's local storage to remove all chart data from your device.
• Portability: Print or save your charts as PDFs at any time.

Registered Teachers

You have full control over your data:

• Access: View all your data in your dashboard at any time.
• Export: Download your data in CSV format from the dashboard.
• Deletion: Delete individual students or your entire account from Settings. Deleted data is permanently removed within 30 days.
• Correction: Edit student information and logs at any time.
• Portability: Export and take your data to another service.

International Data Transfers & GDPR

Data Processing

Evident processes personal data on the basis of:

• Contractual necessity: Processing required to provide the Evident service (e.g., storing student behavior logs, managing teacher accounts).
• Legitimate interest: Processing required to improve our service, prevent fraud, and ensure security.
• Consent: Where required, such as for optional email notifications and analytics.

International Transfers

Evident is operated from the United States. If you are accessing our service from outside the US, your data may be transferred to and processed in the United States. We use standard contractual clauses and rely on our data processors' compliance frameworks (including Supabase's SOC 2 Type II certification and Vercel's GDPR compliance) to ensure adequate protection of your data during international transfers.

Your Rights Under GDPR

If you are in the EU/EEA, you have the following rights in addition to those listed in the "Your Rights" section above:

• Right to be Forgotten: Request permanent deletion of your personal data. Use the "Delete Student" feature in your dashboard, or contact us to delete your entire account.
• Right to Data Portability: Export your data in a machine-readable format. Use the "Export CSV" feature in your dashboard to download all student data at any time.
• Right to Restriction: Request that we limit the processing of your personal data under certain circumstances.
• Right to Object: Object to processing of your personal data for direct marketing or based on legitimate interests.
• Right to Lodge a Complaint: File a complaint with your local data protection authority if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@evidentk12.com. We will respond to all requests within 30 days.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information.

What We Do Not Do

• We do not sell your personal information to third parties.
• We do not share your personal information for cross-context behavioral advertising.
• We do not use sensitive personal information for purposes other than providing the Service.

Your California Rights

As a California resident, you have the right to:

• Know what personal information we collect, use, and disclose.
• Delete your personal information, subject to certain exceptions.
• Correct inaccurate personal information.
• Non-discrimination for exercising your privacy rights.

To exercise these rights, contact us at privacy@evidentk12.com. We will verify your identity and respond within 45 days.

Do Not Track

Evident does not track users across third-party websites. We do not respond to "Do Not Track" browser signals because we do not engage in cross-site tracking.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by posting the new policy on this page and updating the "Last updated" date.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us.