Last updated: October 2026
This Privacy Policy explains how the Hey Hoolo educational chat service (“we”, “us”) collects, uses, and protects personal data. We are committed to compliance with the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA), the Children’s Online Privacy Protection Act (COPPA), and the Family Educational Rights and Privacy Act (FERPA). A school-facing parent notice template (including AI vendors) is maintained in the compliance pack for pilots involving children under 13.
The school or education authority that deploys this service is the data controller. We act as a processor on the controller’s behalf. Where this deployment runs in demo mode, the operator of the instance is the controller for any data entered.
We process personal data on the basis of consent (where obtained), performance of a contract (providing the educational service), and legitimate interests / legal obligation for security, moderation, and compliance. Children’s data is processed only with verifiable parental consent under COPPA and FERPA.
To exercise these rights, use the in-app privacy endpoints or contact the deploying school/controller. Residents of the EU also have the right to lodge a complaint with their supervisory authority.
We use strictly necessary cookies for sessions, authentication, and security. Non-essential cookies (e.g. analytics or personalization) are set only after you provide explicit opt-in via the cookie-consent banner. You may change your choice at any time by re-opening preferences.
To generate tutoring answers, message content may be sent to OpenRouter and the upstream AI model hosts it routes to. The application is typically hosted on cloud infrastructure such as Railway (SQLite volume for pilot data). Where a knowledge-base answer is sufficient, prompts may remain on the host and are not sent to OpenRouter for that turn. Optional email delivery for parental-consent links uses a configured email provider.
Where data is transferred outside your region, we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision, as documented in the school’s processor agreement and sub-processor register.
Data is retained only as long as necessary for the purposes above and is deleted automatically when it passes the configured retention period. Data is encrypted at rest, and access is restricted by role-based controls and audit logging.
For privacy questions or to exercise your rights, contact the data controller (your school/operator) or our privacy team via the deploying organization.