Privacy Policy for Legislative Labs
Introduction
This privacy notice discloses the privacy practices for LegislativeLabs.ai. This privacy notice applies solely to information collected by this website. It will notify you of the following:
- What personally identifiable information is collected from you through the website, how it is used and with whom it may be shared;
- What choices are available to you regarding the use of your data;
- The security procedures in place to protect the misuse of your information;
- How you can correct any inaccuracies in the information;
- Your rights regarding your personal data, including rights under GDPR and CCPA;
- How long we retain your data and how to request deletion.
Information Collection, Use, and Sharing
We are the sole owners of the information collected on this site. We only have access to/collect information that you voluntarily give us via email or other direct contact from you, or that is automatically collected when you use our website (such as IP address, browser type, and usage data). We will not sell or rent information about you to anyone.
Types of Information We Collect:
- Account Information: Name, email address, password (encrypted), and profile information you provide during registration
- Payment Information: Billing address and payment method details (processed by third-party payment processors, not stored by us)
- Usage Data: Information about how you use the Website, including pages visited, features used, and interactions with the service
- Device Information: IP address, browser type, operating system, device identifiers, and other technical information
- User Content: Bills you track, preferences, saved searches, and other content you create or upload
- Communication Data: Records of communications with us, including support requests and feedback
How We Use Your Information:
- To provide, maintain, and improve our services
- To process your subscription and manage your account
- To communicate with you about your account, our services, and important updates
- To respond to your inquiries and provide customer support
- To send you marketing communications (with your consent, which you can withdraw at any time)
- To detect, prevent, and address technical issues and security threats
- To comply with legal obligations and enforce our terms of service
- To analyze usage patterns and improve user experience
Legal Basis for Processing (GDPR): We process your personal data based on: (1) your consent, (2) performance of a contract with you, (3) our legitimate interests in operating and improving our services, and (4) compliance with legal obligations.
We will not share your information with any third party outside of our organization, other than as necessary to fulfill your request or as described in the "Third-Party Services" section below. Unless you ask us not to, we may contact you via email in the future to tell you about specials, new products or services, or changes to this privacy policy.
Your Access to and Control Over Information
You have the following rights regarding your personal data:
- Right to Access: See what data we have about you, if any, and receive a copy of your personal data in a structured, commonly used format
- Right to Rectification: Change/correct any inaccurate or incomplete data we have about you
- Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
- Right to Restrict Processing: Request that we limit how we use your personal data
- Right to Data Portability: Receive your personal data in a portable format
- Right to Object: Object to processing of your personal data for certain purposes, including direct marketing
- Right to Withdraw Consent: Withdraw consent where processing is based on consent
- Right to Opt-Out (CCPA): California residents have the right to opt-out of the sale of personal information (we do not sell personal information)
- Right to Non-Discrimination: Exercise your privacy rights without discrimination
Security
We take precautions to protect your information. When you submit sensitive information via the website, your information is protected both online and offline.
Wherever we collect sensitive information (such as credit card data), that information is encrypted and transmitted to us in a secure way. You can verify this by looking for a lock icon in the address bar and looking for "https" at the beginning of the address of the Web page.
While we use encryption to protect sensitive information transmitted online, we also protect your information offline. Only employees who need the information to perform a specific job (for example, billing or customer service) are granted access to personally identifiable information. The computers/servers in which we store personally identifiable information are kept in a secure environment.
Registration
In order to use this website, a user must first complete the registration form. During registration a user is required to give certain information (such as name and email address). This information is used to contact you about the products/services on our site in which you have expressed interest. At your option, you may also provide demographic information (such as gender or age) about yourself, but it is not required.
Subscriptions
We request information from you on our subscription form. To purchase a subscription, you must provide contact information (like name and billing address) and financial information (like credit card number, expiration date). Payment information is processed by Recurly, our third-party payment processor, and is subject to Recurly's privacy policy and security standards. We do not store your full credit card number on our servers. This information is used for billing purposes and to authorize your account. If we have trouble processing an order, we'll use this information to contact you.
Cookies and Tracking Technologies
We use "cookies" and similar tracking technologies on this site. A cookie is a piece of data stored on a site visitor's hard drive to help us improve your access to our site and identify repeat visitors to our site. For instance, when we use a cookie to identify you, you would not have to log in a password more than once, thereby saving time while on our site. Cookies can also enable us to track and target the interests of our users to enhance the experience on our site.
Types of Cookies We Use:
- Essential Cookies: Required for the Website to function properly, including authentication and security
- Functional Cookies: Remember your preferences and settings to enhance your experience
- Analytics Cookies: Help us understand how visitors use the Website (via Microsoft Application Insights)
Third-Party Services and Data Sharing
We share aggregated and anonymized site activity information with our partners. This is not linked to any personal information that can identify any individual person.
Third-Party Service Providers: We partner with third-party service providers to operate and improve our services. These providers are contractually obligated to protect your information and use it only for the purposes we specify:
- Recurly: Payment processing and subscription management. Recurly processes your payment information in accordance with their privacy policy and PCI DSS standards. We do not store your full credit card information.
- Microsoft Azure: Cloud hosting, data storage, and infrastructure services. Your data may be stored and processed on Microsoft Azure servers, which may be located in various geographic regions.
- Microsoft Azure AD B2C: Authentication and identity management services. Microsoft processes authentication data in accordance with their privacy policy.
- Microsoft Application Insights: Website analytics and telemetry services. This service collects usage data and performance metrics to help us improve the Website.
- Microsoft Azure AI Services: Artificial intelligence and machine learning services used to provide predictions and analytics features.
Legal Requirements: We may disclose your information if required by law, court order, or government regulation, or if we believe disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity, subject to the same privacy protections.
Data Retention and Deletion
We retain your personal data for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:
- Account Data: Retained while your account is active and for a reasonable period after account closure to comply with legal obligations and resolve disputes
- Payment Records: Retained as required by law (typically 7 years for tax and accounting purposes)
- Usage Data: Retained in aggregated and anonymized form for analytics purposes
- Communication Records: Retained for customer support and legal compliance purposes
Data Security and Breach Notification
We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption, access controls, secure data transmission, and regular security assessments. However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
In the event of a data breach that may affect your personal data, we will notify you and relevant authorities as required by applicable law, typically within 72 hours of becoming aware of the breach. Notifications will include information about the nature of the breach, the data affected, and steps we are taking to address it.
International Data Transfers
Your personal data may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your country. When we transfer your data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by relevant data protection authorities. By using our Website, you consent to the transfer of your data to these countries.
Children's Privacy
Our Website is not intended for children under the age of 13 (or the applicable age of consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information. If you believe we have collected information from a child, please contact us immediately.
California Privacy Rights (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to know what personal information we collect, use, disclose, and sell
- Right to delete personal information we have collected from you
- Right to opt-out of the sale of personal information (we do not sell personal information)
- Right to non-discrimination for exercising your privacy rights
European Privacy Rights (GDPR)
If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR), including the rights listed in the "Your Access to and Control Over Information" section above. You also have the right to lodge a complaint with your local data protection authority if you believe we have not adequately addressed your concerns.
Links
This website contains links to other sites. Please be aware that we are not responsible for the content or privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of any other site that collects personally identifiable information.
Contact Us
If you have questions, concerns, or wish to exercise your privacy rights, please contact us at:
Email: support@legislativelabs.ai
Website: Contact Us
We will respond to your inquiry within 30 days (or as required by applicable law).
Children's Privacy Notice
Effective Date: September 17, 2026
Last Updated: September 17, 2026
Organization: Legislative Labs
1. Our Commitment to Children's Privacy
Legislative Labs is committed to protecting the privacy of children who use our educational services.
Legislative Labs is designed so that students do not create accounts, authenticate, or provide personal information to use the service. Legislative Labs does not intentionally collect or maintain personally identifiable information about students.
Legislative Labs will operate its services in accordance with applicable requirements of the Children's Online Privacy Protection Act ("COPPA") and the Children's Online Privacy Protection Rule, including requirements concerning data minimization, security, use, and disclosure.
Our approach is intentionally privacy-preserving: a student should be able to participate without Legislative Labs knowing the student's identity.
2. How Students Access Legislative Labs
Students do not create or maintain Legislative Labs accounts.
A student does not directly authenticate to Legislative Labs. Instead, when a student participates in a session, the system assigns a temporary session identifier that is used to associate activity with that session.
The temporary identifier is designed to:
- Exist only for the applicable session
- Not identify the student's real-world identity
- Not be used to contact the student
- Not be used to recognize the student across unrelated sessions
- Not be used to build a persistent profile of the student
- Not be used to track the student across websites or services
3. We Do Not Collect Information From Students
Legislative Labs will never intentionally collect or maintain student personally identifiable information through the student experience.
In particular, Legislative Labs does not require students to provide:
- First or last name
- Home address
- Email address
- Telephone number
- Date of birth
- Social Security number or other government identification number
- Photograph
- Video
- Audio recording
- Biometric information
- Precise geolocation
- Personal contact information
- Other information intended to identify the student as an individual
4. Student Usernames and Session Identifiers
Where a student interface displays or uses a username or temporary identifier, Legislative Labs does not intend for that identifier to identify the student or function as a means of contacting the student.
Legislative Labs will not use a student identifier to:
- Contact a student
- Advertise to a student
- Sell or provide a student's information to advertisers
- Create a persistent profile of a student
- Track a student across unrelated services
- Determine the student's identity
Legislative Labs therefore intends its student identifiers to be temporary and session-specific rather than persistent identifiers.
5. Student Activity Information
During a session, Legislative Labs may record limited activity or usage information necessary to operate the service.
For example, the system may need to know that a particular temporary session identifier:
- Started an activity
- Completed an activity
- Submitted an answer
- Received a result
- Performed another action within the service
The information is associated with the temporary session identifier rather than the student's real-world identity.
Legislative Labs will limit the information collected to what is reasonably necessary to provide and operate the service.
6. No Student Authentication
Students do not authenticate directly to Legislative Labs.
A teacher or other authorized adult may establish or provide access to a classroom or educational session. The student then participates using the session mechanism provided by the service.
The student is not required to establish a Legislative Labs account or provide personal information to gain access to the student experience.
7. COPPA Compliance
Legislative Labs recognizes that COPPA places specific obligations on operators of online services directed to children under 13 or that otherwise fall within the scope of COPPA.
Among other things, COPPA addresses:
- Notice to parents
- Verifiable parental consent when required
- Parental access to children's personal information
- Parental deletion and control rights
- Data minimization
- Security of children's personal information
- Restrictions on disclosure
- Reasonable procedures for protecting the confidentiality, security, and integrity of children's information
Legislative Labs will not require a child to provide personal information as a condition of participating in an educational activity.
Where COPPA applies to Legislative Labs, Legislative Labs will adhere to the applicable COPPA requirements.
8. Data Minimization
Legislative Labs follows a data-minimization approach.
We collect and maintain only information necessary to provide and operate the service.
Legislative Labs will not collect student information merely because it might be useful in the future.
9. Security of Student Information
Legislative Labs maintains administrative, technical, and operational safeguards designed to protect the information maintained by the service.
These safeguards include, as applicable:
- Encryption of data in transit and at rest
- Access controls
- Authentication controls
- Multifactor authentication for applicable accounts
- Least-privilege administrative access
- Restricted production access
- Protection of credentials and secrets
- Vulnerability investigation and remediation
- Production backups
- Incident response procedures
10. Third-Party Disclosure
Legislative Labs does not sell student personal information.
Legislative Labs' current Information Security Program states that there is no third-party access to production systems or Legislative Labs data.
If third-party access or processing is introduced in the future, Legislative Labs will evaluate the arrangement for applicable privacy and security requirements before granting access.
Any such access will be limited to what is necessary and subject to appropriate security controls and contractual requirements.
11. Advertising and Marketing
Legislative Labs does not use student information to:
- Serve targeted advertising to students
- Build advertising profiles of students
- Sell student information
- Contact students for marketing purposes
12. Information About Teachers
Legislative Labs may maintain information about teachers or other authorized adults using the service.
For example, Legislative Labs may collect a teacher's email address and activity or usage information.
Teacher information is treated separately from the temporary information associated with student sessions.
13. Changes to This Notice
Legislative Labs may update this Children's Privacy Notice when its services, information practices, technology, or applicable legal requirements change.
Material changes affecting children's privacy will be addressed in accordance with applicable legal requirements.
Document Control
Document: Children's Privacy Notice
Organization: Legislative Labs
Effective Date: September 17, 2026
Version: 1.0
Primary Focus: Children's Online Privacy Protection Act (COPPA)
This document is intended to describe Legislative Labs' children's privacy practices and should be reviewed when the service, data practices, infrastructure, or applicable privacy requirements change.
Student Data Retention Policy
Effective Date: September 21, 2026
1. Purpose
Legislative Labs is committed to protecting student privacy and maintaining data practices consistent with the Children's Online Privacy Protection Act (COPPA).
Legislative Labs minimizes the collection and retention of student information and does not retain student personally identifiable information (PII).
2. Student Data Collected
Students do not create accounts or authenticate directly with Legislative Labs. Each student session is assigned a temporary, non-identifying session identifier.
Legislative Labs does not intentionally collect or retain student names, email addresses, dates of birth, photographs, addresses, or other student PII.
Legislative Labs may retain limited, non-identifying activity or usage information when reasonably necessary to provide, maintain, secure, or improve the educational service.
3. Retention Period
Student data will be retained only for as long as reasonably necessary to fulfill the specific educational, operational, security, or legal purpose for which it was collected.
Temporary student session identifiers and associated activity data will be deleted or rendered non-identifiable when they are no longer reasonably necessary for that purpose.
Legislative Labs will not retain student data indefinitely or retain information solely for potential future use.
4. Deletion
Legislative Labs maintains reasonable procedures to securely delete student data when it is no longer required.
Where a student or school-related record is determined to contain personal information subject to COPPA, Legislative Labs will delete that information when it is no longer reasonably necessary for the purpose for which it was collected, or when deletion is otherwise required under applicable law or a valid deletion request.
5. COPPA Compliance
Legislative Labs will maintain reasonable procedures for data minimization, retention, security, and deletion consistent with COPPA requirements.
Legislative Labs will not require a student to provide information beyond what is reasonably necessary to participate in the educational activity.