Privacy Policy
Last updated: July 25, 2026
Scope & who we are
This Privacy Policy describes how Yilmaz Education LLC ("we," "us"), a Wisconsin limited liability company based in Brookfield, Wisconsin, handles information on this website (yilmazeducation.com) and in the Literacy Assessments platform. The platform is used in two ways: under an agreement with a school or district (where a Data Processing Agreement governs and controls if it conflicts with this policy), and by individual teachers who create their own accounts. This policy covers both.
Data we collect
Student data is deliberately minimal: first name, last name, grade level, class assignment, and assessment scores. We do not collect student dates of birth, addresses, parent or family contact information, demographic information, or free-text notes about students. Students do not create accounts and do not log in.
Teacher and staff accounts store name, school email address, and role. For individual paid subscriptions, payment is handled by Stripe, Inc.; we never see or store full card numbers.
This website itself sets no advertising or analytics trackers and makes no third-party requests. Standard server logs (IP address, request time, pages served) are retained briefly for security and operations.
How we use data
We use data for one purpose: providing the Literacy Assessments service to the educators and schools we serve. We do not sell data, use it for advertising, or use student data to train AI models. An optional AI-assisted narrative feature (off by default, enabled only with district sign-off) processes de-identified data only: student names are removed server-side and replaced with non-reversible references before any information reaches the AI provider.
Data ownership & control
Schools and teachers own their data. When we serve a district under agreement, we act at the district's direction, consistent with the school-official provisions of FERPA, and our Data Processing Agreement (structured to mirror the A4L National Data Privacy Agreement, NDPA v2.2) governs. Individual teachers control the data in their own workspace and may export or request deletion at any time.
Data sharing & subprocessors
We share data only with the subprocessors listed on ourSubprocessors page — currently Google LLC (hosting, database, authentication), Anthropic PBC (AI narrative generation, only where a district enables the feature, de-identified data only), and Stripe, Inc. (payment processing; teacher billing data only, never student data). We notify districts of subprocessor changes. Beyond that, we disclose information only if required by law, and we will notify the affected school or teacher unless legally prohibited.
Data security
The platform runs on Google Cloud / Firebase in U.S. data centers. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is role-based and enforced server-side in database security rules — not in the browser — and those rules are covered by an automated test suite that runs on every deployment. Secrets are managed through Google Secret Manager; our CI pipeline runs security and dependency audits before any production deployment.
Data retention & deletion
Data is retained while an account or district agreement is active. When an individual subscription lapses, the account becomes read-only and its data is retained through the current school year so a returning teacher loses nothing; it is deleted after that period or sooner on request. On district contract termination, or on any verified deletion request, we delete the relevant data. See ourData Requests page for the intake process.
Data breach notification
We maintain a documentedIncident Response Plan. If a breach affects personal data we hold, we will notify affected districts and account holders without undue delay, consistent with our contractual commitments and applicable law, and will share what happened, what data was involved, and what we are doing about it.
Your rights & data requests
District administrators (for their district's data) and teachers (for their own accounts) may request access to, correction of, or deletion of data. Submit requests through the process on ourData Requests page; we respond within 30 days.
Changes to this policy
When this policy changes, we update the date at the top of this page. For material changes, we notify account holders by email and notify districts per their agreements before the changes take effect.
Contact
Yilmaz Education LLC · Brookfield, Wisconsin ·hello@yilmazeducation.com