Privacy Policy

    Last updated: August 25, 2026

    The Service Signal ("Service," "we," "us," or "our") is operated by America Learns, LLC ("America Learns"). This Privacy Policy explains how we collect, use, disclose, retain, and safeguard information when individuals and organizations — including U.S. federal, state, local, tribal, and territorial government agencies and their grantees, contractors, and subrecipients ("Government Users") — access or use the Service. This Policy is designed to support compliance obligations commonly required under U.S. government contracts and grants, including the Privacy Act of 1974 (5 U.S.C. § 552a), the Federal Information Security Modernization Act (FISMA, 44 U.S.C. ch. 35), Section 208 of the E-Government Act of 2002, OMB Circular A-130, NIST SP 800-53 and 800-171, FedRAMP guidance, and applicable state privacy and information-security statutes. Where a fully executed contract, Data Use Agreement, Business Associate Agreement, Interconnection Security Agreement, or other written agreement between America Learns and a Government User contains terms that differ from this Policy, the terms of that agreement control.

    1. Scope and Roles

    • Data Controller / Agency Data Owner: When a Government User uploads or inputs records into the Service, the Government User remains the data owner and the responsible agency for purposes of the Privacy Act and equivalent state law. America Learns acts as a service provider, processor, or contractor and processes such records only on documented instructions from the Government User.
    • Service Provider: For information America Learns collects directly (e.g., account registration, billing, support requests), America Learns is the data controller.
    • Subcontractors: America Learns flows down applicable privacy and security obligations (including FAR 52.224-3, FAR 52.239-1, and DFARS 252.204-7012 where incorporated by reference) to subprocessors that handle Government User data.

    2. Information We Collect

    When you use The Service Signal, we collect:

    • Account information: Email address and display name provided during signup or via Google OAuth.
    • Organization data: Program name, mission, location, website, and social handles you enter in Settings.
    • Content you create: Chat messages, projects, saved pieces, uploaded documents, and voice samples.
    • Usage data: Timestamps, actions taken (audit logs), IP addresses, and browser user-agent strings for security monitoring and incident response.
    • Calendar events: Dates and descriptions you add or that the AI suggests.
    • Billing information: For paid tiers, payment method tokens and transaction metadata processed by our PCI-DSS compliant payment processor (Stripe). We do not store full payment card numbers.

    We do not knowingly collect Social Security Numbers, financial account numbers, protected health information (PHI) regulated under HIPAA, criminal justice information (CJI) regulated under the FBI CJIS Security Policy, classified national security information, or controlled unclassified information (CUI) unless a Government User has executed a written agreement with America Learns expressly authorizing such processing and establishing the required safeguards.

    3. How We Use Information

    For a plain-English summary, see How We Use Your Information.

    • Service delivery: To generate content, personalize recommendations, and maintain your projects.
    • Security and integrity: Audit logging, rate limiting, anomaly detection, session management, and incident response.
    • Legal compliance: To comply with applicable laws, regulations, court orders, and lawful government requests, and to enforce our Terms of Service.
    • Improvement: Aggregated and de-identified usage metrics to improve the platform. Government User content is not used for these purposes without written authorization.

    We do not sell personal information, do not use it for cross-context behavioral advertising, and do not use Government User data for any secondary purpose beyond providing and securing the Service.

    4. Data Sharing and Disclosure

    We do not sell your personal data. Data is shared only with:

    • AI service providers (Google Gemini, OpenAI) — your prompts are sent for content generation. These providers have their own data processing agreements.
    • Infrastructure providers — hosting and database services (located in the United States) necessary to operate the platform. Production systems supporting Government Users are operated on infrastructure that maintains, at minimum, SOC 2 Type II attestation.
    • Team members — if you invite team members, they can view shared projects and content.
    • Legal compliance and safety: In response to valid legal process (subpoena, court order, or government demand), to protect the rights, property, or safety of America Learns, our users, or the public, or as required by law. We will, where legally permitted, notify the affected Government User before disclosing their data.
    • Successors: In connection with a merger, acquisition, financing, or sale of assets, subject to continued protection consistent with this Policy.

    America Learns does not transfer Government User data outside the United States without the Government User's prior written authorization. Personnel with access to Government User data are U.S. persons unless otherwise agreed in writing.

    5. Information Security Program

    America Learns maintains an administrative, technical, and physical safeguards program designed to align with NIST SP 800-53 (Moderate baseline) and NIST SP 800-171 controls, including:

    • Encryption of data in transit using TLS 1.2 or higher and encryption of data at rest using AES-256.
    • Role-based access control, least-privilege principles, and multi-factor authentication for administrative access.
    • Row-Level Security (RLS) ensuring users only access their own data.
    • Centralized, immutable audit logging with one-year retention for security and compliance review.
    • Automatic session timeout after 30 minutes of inactivity.
    • Rate limiting and server-side input validation on all uploads and form submissions.
    • Vulnerability management, patching, secure software development practices, and annual security training for personnel with access to Government User data.
    • Background checks for personnel with privileged access, consistent with applicable contract requirements.
    • Documented business continuity, disaster recovery, and backup procedures.

    6. Incident Response and Breach Notification

    America Learns maintains a written Incident Response Plan. In the event of a confirmed or reasonably suspected breach of security involving Government User data, America Learns will:

    • Notify the affected Government User as soon as practicable, and in any event no later than seventy-two (72) hours after discovery, unless a shorter period is required by contract or applicable law (e.g., the one-hour reporting requirement of US-CERT for certain federal incidents, or state breach-notification statutes);
    • Provide the information reasonably required to evaluate the incident, including the nature and scope of data involved, the suspected cause, and the corrective actions taken;
    • Reasonably cooperate with the Government User's investigation, mitigation, and any notification obligations owed to data subjects or regulators.

    7. Data Retention and Return

    • Active accounts: Data is retained as long as your account exists.
    • Audit logs: Retained for 1 year for compliance purposes, then automatically deleted.
    • Deleted accounts: All personal data is permanently purged from active production systems within 30 days of account deletion. Encrypted backups containing that data are purged on our ordinary backup rotation, and file attachments are removed on the platform's ordinary cleanup schedule.
    • Deletion on request: On written request during your subscription or within the 30-day post-termination access window, we will delete your data from active production systems within 30 days, except data we must retain to comply with law, resolve a dispute, or enforce our agreement. We confirm deletion in writing on request.
    • End of contract: Upon termination or expiration of a Government User's agreement, America Learns will, at the Government User's election, return or securely destroy that User's data within thirty (30) days, and will provide written certification of destruction upon request. Destruction follows methods consistent with NIST SP 800-88 ("Guidelines for Media Sanitization").

    8. Individual Rights and Privacy Act Notice

    You may at any time:

    • Access your data through the Settings and Projects pages.
    • Correct your organization profile and personal information in Settings.
    • Delete your entire account and all associated data via Settings → Account Deletion.
    • Export your saved pieces from Settings.

    Individuals whose records are maintained in the Service by a federal agency may have rights of access, amendment, accounting of disclosures, and redress under the Privacy Act of 1974 and the agency's published System of Records Notice (SORN). Such requests should be directed to the responsible agency, which remains the Privacy Act system manager. Residents of states with comprehensive consumer privacy laws (including California, Colorado, Connecticut, Virginia, Utah, Texas, and others) may also have rights to know, correct, delete, and limit the processing of their personal information; America Learns will support Government Users in honoring verified requests as required by law.

    9. AI-Powered Features

    The Service Signal uses AI models to help you create content, answer questions, and provide suggestions. Here's how your data is handled:

    • No training on your data: Your conversations, content, and organizational information are never used to train, fine-tune, or evaluate AI models, and are never subject to human review for product improvement.
    • Which models we use: AI-assisted features are currently provided using Google Gemini models accessed through our AI gateway provider, with processing performed in the United States. We will provide written notice before adding or substituting an AI provider in a way that materially changes how your data is processed.
    • What is sent to AI: When you use an AI-powered feature (chat, content generation, suggestions, image generation), the content you submit for that request is sent to the AI provider to generate the response. Depending on the feature, this may include your organization profile, uploaded files and images, and member, participant, staff, or service-location identifiers contained in timesheets, survey responses, and chat attachments. Submit only the information needed for the output you want.
    • Stateless processing, with a narrow safety exception: AI providers do not retain your prompts or responses for their own purposes. A provider may retain a prompt or output for a short period solely to detect and prevent abuse, security incidents, or unlawful use, after which it is deleted.
    • Provider safeguards: Our AI providers operate under data processing agreements that prohibit using customer data for model training or improvement.
    • De-identified data: Where we use aggregated or de-identified information to understand product performance, it is processed so it cannot reasonably be used to identify your organization or any individual, and we do not attempt to re-identify it.
    • Support and diagnostics: In-app support and feedback conversations, error logs, and security audit records may contain your content and user identifiers. Our personnel may review this information solely to answer a support request, investigate a security or availability issue, or fix a defect — never for marketing or model training.
    • Cross-product handoff: If your organization also licenses the America Learns Impact Suite, an authorized user may send designated survey or timesheet data from the Impact Suite into The Service Signal. This transfer happens only when a user initiates it, is carried by a single-use token that expires in ten minutes, and delivers data only to the Service Signal account matching that user's Impact Suite email address. No account is created and no automatic sign-in occurs if no matching account exists. We will disable this handoff on written request.
    • Public share links: Content you publish through a public share link is accessible to anyone who has the link, without an account or password, until you disable or delete the link.
    • Human-in-the-loop: AI outputs are drafts intended for human review before publication or official use. America Learns does not warrant the accuracy of AI-generated content and Government Users remain responsible for review, approval, and any required clearance processes.

    10. Cookies and Tracking

    We use only essential cookies required for authentication session management. We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

    11. Children

    The Service Signal is not intended for children under 13. We do not knowingly collect data from children.

    12. Accessibility

    America Learns is committed to making the Service accessible in conformance with Section 508 of the Rehabilitation Act and WCAG 2.1 AA. A current Accessibility Conformance Report (VPAT) is available upon request from Government Users. You can also read our current accessibility report anytime on the Accessibility & VPAT page.

    13. Records, Audits, and Cooperation

    America Learns will reasonably cooperate with audits, security assessments, and inspections conducted by Government Users or their authorized representatives (including agency Inspectors General and the Government Accountability Office) to the extent required by an applicable contract, grant, or law. America Learns will retain records related to the processing of Government User data for the period required by the applicable agreement or, absent a specified period, for three (3) years following the end of the engagement.

    14. Changes to This Policy

    We may update this Policy from time to time. Material changes will be communicated to account holders via email or in-app notification at least thirty (30) days before they take effect, unless a shorter period is required to address a security risk or comply with law. For Government Users with executed agreements, changes that materially reduce protections will not apply to that User's data without the User's written acceptance.

    15. Contact

    For questions about this Policy, to exercise a privacy right, or to submit a security or privacy concern, contact:

    America Learns, LLC
    Attn: Privacy Officer
    Email: support@americalearns.net