Privacy Policy

elevatED is an online learning management platform operated by SSYO (South Shore Youth Organization), a non-profit organisation serving youth and families on Montreal’s South Shore.

When this policy refers to “elevatED”, “we”, “us”, or “our”, it means SSYO acting as the data controller for information collected through the elevatED platform.

We are subject to the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec Law 25 (Act respecting the protection of personal information in the private sector). We also adhere to the principles of the U.S. Children’s Online Privacy Protection Act (COPPA) for users who may be located in the United States.

We collect only the information needed to deliver a safe and effective learning experience.

We use your information solely to:

• Create and manage your account and authenticate your identity.
• Deliver lessons, assessments, grades, and progress reports.
• Enable instructors to give timely, personalised feedback.
• Process tutoring bookings and Stripe payments.
• Send transactional emails (booking confirmations, grade notifications, password resets).
• Provide parents and guardians with visibility into their child’s learning progress through the observer portal.
• Generate aggregate, de-identified analytics that help us improve the platform (no individual student is identifiable in these reports).
• Meet legal obligations, such as responding to lawful requests from authorities.

We do not use your data for advertising, profile selling, or automated decision-making that has legal or similarly significant effects on you.

We share personal data with a small number of trusted service providers who help us operate the platform. Each provider is bound by a data processing agreement and may only use data for the purpose we specify.

We do not sell, rent, or trade your personal information to any third party. We will only disclose data outside the above if required by law or to protect the safety of our users.

elevatED is designed to be used by students, some of whom may be under 13 years of age. We take the privacy of minors seriously and comply with COPPA (United States), PIPEDA, and Quebec Law 25 regarding minors.

• Student accounts for minors are created by a school administrator or instructor — children do not sign themselves up independently.
• We collect only the minimum data necessary for a minor student to use the platform: name, email, class enrolment, and learning activity.
• Parents and guardians can request to review, correct, or delete their child’s data at any time by contacting us at privacy@southshoreyouth.org.
• We do not serve advertising to any user, including minors.
• Minor student profiles are not publicly visible; only assigned instructors and linked parent/guardian accounts can access them.

elevatED includes a dedicated observer portal that gives parents and approved guardians read-only visibility into a linked student’s progress.

• An observer account must be explicitly linked to a student account through an invitation sent by the student or approved by an administrator. No one can view a student’s data without an established, approved relationship.
• Observers can view grades, attendance, upcoming deadlines, and tutoring session history — but cannot submit work, modify grades, or access other students’ data.
• Observer access permissions (full visibility, logistics only, or progress only) are configured at the time the relationship is established and can be adjusted at any time.
• A student or administrator can revoke observer access at any time, immediately removing that person’s ability to view the student’s data.

We retain personal data for as long as your account is active and for a reasonable period after.

• Active accounts: data is retained for the duration of your enrolment or employment on the platform.
• After account closure: personal identifiers are deleted within 90 days of a deletion request. Aggregated, de-identified learning records may be retained for up to 3 years for platform improvement purposes.
• Payment records: Stripe transaction records are retained for 7 years to meet financial reporting obligations under Canadian law.
• Uploaded files: assessment submissions and attached resources are deleted from Cloudflare R2 within 30 days of an account deletion request.

Depending on your location, you have the following rights regarding your personal data. To exercise any of them, email privacy@southshoreyouth.org.

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate or incomplete information.
• Deletion: request deletion of your account and associated personal data, subject to legal retention requirements.
• Portability: request your data in a machine-readable format (JSON or CSV) where technically feasible.
• Objection: object to certain uses of your data, such as analytics.
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing.

We will respond to all verified requests within 30 days. If we cannot fulfil a request (e.g., due to legal obligations), we will explain why.

We implement technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction:

• All data is transmitted over HTTPS (TLS 1.2+).
• Database data is encrypted at rest.
• Uploaded files in Cloudflare R2 are accessed only via time-limited, signed URLs generated per-request — no file is publicly accessible by default.
• Passwords are never stored in plain text; authentication is managed through an industry-standard secure auth service.
• Access to production data is restricted to authorised SSYO staff and is logged.
• Role-based access controls ensure users can only access data relevant to their account type.

Despite these measures, no system is 100% secure. If you suspect a security issue, please notify us immediately at privacy@southshoreyouth.org.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page and, for material changes, send a notification to the email address associated with your account.

Continued use of elevatED after the effective date of any update constitutes acceptance of the revised policy.

If you have questions or concerns about this policy or your data, please contact us: