Eccleston Education Consulting LLC ("IEPVue," "we," "us," or "our") operates IEPVue, an educational guidance platform for adults supporting students through the Individualized Education Program (IEP) and Section 504 processes. This Privacy Policy explains what information we collect, why we use it, when service providers process it for us, how long we keep it, and the choices available to you. It applies to iepvue.com, app.iepvue.com, and related IEPVue services that link to this Policy.
The short version: Student information is private account information. We do not sell personal information, use it for targeted advertising, or opt in to the use of your content to train general-purpose AI models. Uploaded source documents are held only temporarily for the analysis you request, while information you deliberately save—such as a profile, report, or optional memory—may remain available in your account until you delete it or your account is deleted. Limited service-provider retention and legal exceptions are explained below.
IEPVue is designed for adults who are at least 18 years old, including parents, guardians, and authorized adult advocates. It is not directed to children, and children may not create accounts. The adult account holder is responsible for having authority to provide information about a student and to upload the student's records.
We collect information needed to create and protect your account, such as your name, email address, authentication identifiers, account status, and security information. If you use a third-party sign-in option, the sign-in provider sends us the information needed to authenticate you. We do not receive your password from that provider.
You may create a profile using a student's name or nickname, grade or school level, plan type, state and locality, stage in the special-education process, areas of concern, meeting information, and optional school-team contact details. These details help IEPVue apply the appropriate context and keep work associated with the correct student. You control what optional profile information you provide.
Documents may contain names, contact information, disability information, health-related information, evaluations, assessment results, educational services, signatures, handwriting, and other sensitive content. We use the document only to provide the analysis or related feature you request. Source documents and temporary processing files are stored privately for the processing period, deleted after completion, failure, or cancellation when the system can confirm deletion, and covered by a one-day lifecycle backstop. An unused upload authorization expires after 60 minutes. A storage provider's final removal after lifecycle expiration may take additional time.
Deleting a source document does not automatically delete a report, excerpt, or other output that you choose to save. Saved outputs may contain information derived from that document and are governed by the retention rules for the saved output.
We process the messages you send to Vue, Vue's responses, report context, meeting-preparation content, and drafts you request. Unless you deliberately save a conversation, report, or memory, IEPVue does not keep a user-accessible transcript after the applicable session ends. If you choose a feature that saves information for later use, the app will identify what is being saved. Saved memory is intended to contain limited profile context or a concise user-approved summary—not a hidden copy of the original source document—and can be reviewed, corrected, or deleted by you.
We maintain subscription status, plan, purchased profile slots, analysis-credit activity, transaction identifiers, and limited billing history. Stripe processes payment-card information. IEPVue does not receive or store full payment-card numbers.
We collect information you send to customer support, privacy support, waitlists, surveys, or feedback tools. If you choose to submit a report excerpt, chat excerpt, screenshot, or document with a support request, we use it to respond to that request. Do not send more student information than is needed.
We may collect authentication events, device and browser information, approximate location derived from an IP address, timestamps, feature-use events, performance information, and privacy-filtered error and security events. Our monitoring is designed to exclude document text, chat content, report findings, student names, school names, and original filenames. We do not use session replay on sensitive IEPVue surfaces.
Information about a student's disability, health, education, and status as a minor can be sensitive personal information. We limit sensitive-information processing to what is reasonably necessary and proportionate to provide the feature you request, protect the service, comply with law, or establish and defend legal rights. Where separate consent is required—or where an optional feature will retain additional sensitive information—we request that consent separately and provide a way to withdraw it.
We do not sell sensitive information or use it for targeted advertising.
We use information to:
IEPVue does not use personal information to make eligibility, placement, service, or other decisions that produce legal or similarly significant effects.
IEPVue uses commercial artificial-intelligence services to provide document analysis and conversational guidance. Depending on the feature and current configuration, relevant content may be processed by Anthropic, OpenAI, or an application-platform AI service acting on our behalf. We send only the information needed for the requested operation.
IEPVue does not opt in to using your documents, messages, reports, student information, or saved memory to train or improve a provider's general-purpose AI models. This no-training commitment is different from retention. Under standard commercial API terms, an AI provider may retain inputs and outputs for a limited period—commonly up to 30 days—for security, abuse prevention, legal compliance, or service operation unless a different approved retention control applies. Additional details appear in our How We Use AI notice and Data Retention Policy.
We use service providers under agreements and controls appropriate to the services they perform. Providers may change as the Platform evolves; material changes will be reflected in this Policy.
We may also disclose information when reasonably necessary to comply with applicable law or valid legal process; protect a person from serious harm; investigate fraud, abuse, or a security incident; enforce our agreements; or complete a merger, financing, reorganization, or sale subject to appropriate confidentiality and continued protection of the information.
We do not sell personal information, disclose it to data brokers, or share it for cross-context behavioral or targeted advertising. We do not display third-party behavioral advertising in IEPVue. Where a recognized opt-out preference signal such as Global Privacy Control is legally applicable, we honor it. Because IEPVue does not sell personal information or use it for targeted advertising, there is no separate sale or targeted-advertising opt-out needed for those practices.
IEPVue is an adult-directed service. A parent, guardian, or other authorized adult—not the student—creates the account and submits student information. An adult's submission of information about a child does not by itself mean the service collects information online directly from a child. If we learn that a child under 13 has created an account or submitted personal information directly without the authorization required by law, we will restrict the account and delete the information or take other legally required steps.
IEPVue is offered directly to families and is not, merely because a parent uploads a record, an educational agency subject to the Family Educational Rights and Privacy Act (FERPA) or a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). If IEPVue later provides services on behalf of a school, district, healthcare entity, or other regulated organization, those services require a separate written agreement and any additional safeguards required for that relationship. We do not describe the consumer Platform as "FERPA compliant" or "HIPAA compliant."
Different information serves different purposes and therefore has different retention periods. Temporary source documents are removed on the short processing schedule described above. Account, profile, saved-output, consent, billing, security, and support records follow the schedule in our Data Retention Policy.
Canceling a subscription does not delete an account. You can keep a free account after cancellation or separately request account deletion. Deletion may not immediately remove limited records that we must retain for billing, fraud prevention, security, legal compliance, insurance, dispute resolution, or proof of consent. Residual copies may remain temporarily in protected backups until the applicable backup cycle expires.
Subject to applicable law and appropriate identity verification, you may ask us to:
Submit a request through Account Settings when available or email [email protected] with “Privacy Request” in the subject line. We may request information needed to verify your identity and authority. We generally respond within 45 days and will notify you if applicable law permits and requires additional time. We do not discriminate against you for exercising a privacy right.
Transactional messages provide account, billing, privacy, security, and service information. Marketing messages are optional. Every marketing email includes an unsubscribe method, and we honor valid opt-out requests within 10 business days. We may retain a minimal suppression record so that we continue to honor the request.
We use administrative, technical, and organizational safeguards designed for the nature and sensitivity of the information, including encrypted connections, provider-supported encryption at rest for stored sensitive information, access controls, environment separation, private temporary storage, restricted credentials, monitoring, and incident-response procedures. Additional information appears in our Security Overview. No system is completely secure, and we cannot guarantee that unauthorized access or loss will never occur.
We investigate suspected security incidents and provide notices required by applicable federal and state law. If the FTC Health Breach Notification Rule applies to a particular incident, we will follow its notice requirements. This statement does not represent that every item of student information or every incident falls within that Rule.
IEPVue is intended for users in the United States. Information may be processed in the United States or in another location where a service provider operates, subject to the provider's contractual and security obligations.
We may update this Policy to reflect changes in the Platform, providers, or law. If a change materially affects how we use previously collected personal information, we will provide advance notice and obtain consent where required. The “Last Updated” date identifies the current version.
For privacy questions or requests, contact [email protected] and use “Privacy” in the subject line.
Eccleston Education Consulting LLC
New Market, Maryland, United States