Privacy Policy
Last updated: July 6, 2026, See what changed
The short version: We read the teacher emails you specify to pull out homework and event details, then we discard the email content. The extracted details (like assignment titles, dates, and event types) are saved to your account so we can build your calendar and nightly digest. Extraction runs on Anthropic's Claude AI, which processes the email content to do the job and, under Anthropic's commercial API terms, does not use it to train AI models. We do not sell or share your personal information.
Who We Are
BackpackBuddy is a product of Cultivate Data Solutions, LLC ("we," "us," "our"), a Maryland limited liability company. BackpackBuddy helps parents stay organized by automatically extracting homework assignments, school events, and deadlines from teacher emails and adding them to Google Calendar.
Data Controller: Cultivate Data Solutions, LLC
Contact: [email protected]
Address: Bethesda, Maryland, United States
What Information We Collect
We collect the minimum information needed to provide our service:
- Account information: Your name and email address (provided during signup).
- Child information: First name, grade, school, and teacher email address for each child, provided by you, used only to identify which emails to scan and which calendar to update.
- Extracted event details: Homework titles, due dates, event types, and the associated child's name, pulled from teacher emails during scanning and saved to your account so we can build your calendar events and nightly digest. This is separate from the email content itself, which we do not keep (see below).
- Google account access: When you connect your Google account via OAuth, we receive a token to read your Gmail, manage your Google Calendar, and save files to your Google Drive. We only access emails from teacher email addresses you specify.
- Payment information: Processed securely by Stripe. We never see or store your credit card numbers.
- Usage data: Number of emails processed, calendar events created, and scan history (for troubleshooting and improving the service).
- Policy acceptance: When you agree to this Privacy Policy, we record the version accepted and the timestamp.
How We Use Your Information
- Email scanning: We read emails ONLY from teacher email addresses you specify. We extract homework assignments, events, deadlines, and attachments. We do not read any other emails in your inbox.
- AI-assisted extraction: To identify homework, events, and deadlines, the email content is sent to Anthropic's Claude AI. Anthropic processes this content to perform the extraction and, under its commercial API terms, does not use it to train AI models. We discard the email content once extraction is complete; only the extracted details (see above) are saved.
- Calendar events: We create events on Google Calendars you designate for each child.
- Attachments: We download newsletter PDFs and worksheets from teacher emails and upload them to your Google Drive, then attach them to calendar events.
- Email archiving: After processing, we archive teacher emails from your inbox (they remain in your Gmail archive and are never deleted).
- Daily digest: We send you a summary of what we found and created.
- Service communications: We may send you account notices, policy updates, and security alerts. These are not marketing emails and cannot be opted out of while you have an active account.
We do NOT store the content of your emails. We process the message (including a hand-off to Anthropic's Claude AI to do the extraction), pull out the homework and event details, and discard the email content afterward. The extracted details, not the emails themselves, are saved to your account in our systems so we can build your calendar and digest; your original emails stay in your Gmail account and your calendar events stay in your Google Calendar.
Legal Basis for Processing (GDPR)
For users in the European Economic Area (EEA) and United Kingdom, we process your personal data on the following legal bases:
| Data Type | Legal Basis | Explanation |
|---|---|---|
| Name, email address | Contract performance | Necessary to create and manage your account |
| Child name, school, teacher email, calendar ID | Contract performance | Necessary to deliver the core service |
| Extracted event details | Contract performance | Necessary to build your calendar events and daily digest |
| OAuth tokens | Contract performance | Necessary to access your Google account on your behalf |
| Usage data (emails processed, events created) | Legitimate interest | Used for troubleshooting and improving service reliability |
| Policy acceptance record | Legal obligation | Required for compliance with applicable privacy laws |
| Payment data | Contract performance | Processed by Stripe to fulfill your subscription |
We do not use your data for automated decision-making or profiling.
What We Do NOT Do
- We do NOT store or copy your email content on our servers
- We do NOT read emails from anyone other than the teacher addresses you specify
- We do NOT sell, rent, or share your personal information with third parties
- We do NOT use your data for advertising or marketing purposes
- We do NOT delete any emails, archiving only moves them out of your inbox
- We do NOT access your email account for any purpose other than scanning teacher emails
- We do NOT build profiles on children or use child data for any purpose other than providing the service
- We do NOT engage in automated decision-making or profiling
Children's Privacy (COPPA)
BackpackBuddy is a tool for parents, not children. We do not knowingly collect information directly from children under 13.
The child-related information we collect (first name, grade, school name, and teacher email address) is provided by a parent or legal guardian and is used solely to deliver the service, specifically, to identify which teacher emails to scan and which Google Calendar to update. This information is:
- Never used for advertising, profiling, or any purpose other than providing the service
- Never shared with third parties except as required to deliver the service (e.g., creating a Google Calendar event)
- Deleted within 30 days of account cancellation
If you believe we have inadvertently collected information from a child without parental consent, contact us at [email protected] and we will delete it promptly.
Student data protection: We do not use student data to advertise or market to students or their families, build student profiles beyond what is necessary to provide the service, or sell student data under any circumstances.
Google API Services
BackpackBuddy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data Storage & Security
| Data Type | Storage | Retention | Encrypted |
|---|---|---|---|
| Email content (message body & attachments) | Never stored | Processed in real-time (including by Anthropic's Claude AI, for extraction) and discarded | N/A |
| Extracted event details (homework titles, dates, event type, child name) | Cloudflare KV (encrypted at rest) | Duration of subscription; deleted within 30 days of cancellation | Encrypted at rest (Cloudflare platform encryption) |
| OAuth tokens | Cloudflare KV (encrypted at rest) | Duration of subscription; deleted immediately on cancellation | Yes (AES-256) |
| Account & child info | Cloudflare KV (encrypted at rest) | Duration of subscription; deleted within 30 days of cancellation | Yes (AES-256) |
| Usage data | Cloudflare KV | Duration of subscription; deleted within 30 days of cancellation | Yes (AES-256) |
| Policy acceptance record | Cloudflare KV | Duration of subscription + 1 year | Yes (AES-256) |
| Payment data | Stripe (not our servers) | Per Stripe's retention policy | Yes (Stripe PCI-DSS) |
We maintain a written data security program that includes access controls, encrypted storage, and regular security reviews. In the event of a data breach affecting your personal information, we will notify you within 72 hours of discovery, as required by applicable law.
Third-Party Services & Data Processors
We use the following third-party services to operate BackpackBuddy. Each acts as a data processor under our instruction:
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| Google (Gmail, Calendar, Drive) | Email scanning, calendar events, file storage | OAuth tokens, calendar/drive operations | policies.google.com/privacy |
| Anthropic (Claude AI) | AI extraction of homework and event details from teacher email content | Email content, processed transiently for extraction; not used to train AI models under Anthropic's commercial API terms | anthropic.com/legal/privacy |
| Resend | Delivering your daily digest, welcome, and account emails | Email address, digest content | resend.com/legal/privacy-policy |
| Stripe | Payment processing | Name, email, billing info | stripe.com/privacy |
| Cloudflare | Website hosting, data storage (KV), Worker APIs | Account data, OAuth tokens | cloudflare.com/privacypolicy |
| Cloudflare Web Analytics | Privacy-first, cookieless website analytics (page views and load performance) | Aggregate page and performance metrics only. No cookies, no cross-site tracking, and no personal data or IP address is stored. The analytics script is not loaded for visitors in the EU/EEA. | cloudflare.com/web-analytics |
We have executed Data Processing Agreements with Cloudflare and Stripe. For users in the EEA or UK, these agreements include Standard Contractual Clauses to govern international data transfers.
International Data Transfers
We are based in the United States. If you use BackpackBuddy from outside the US (including from the European Economic Area or United Kingdom), your data will be transferred to and processed in the United States. We rely on Standard Contractual Clauses approved by the European Commission to ensure adequate protection for transfers to our service providers (Cloudflare, Stripe).
Your Rights & Choices
Depending on where you live, you may have the following rights regarding your personal data. To exercise any of them, email [email protected]. We will respond within 30 days.
| Right | What it means | Who it applies to |
|---|---|---|
| Access | Request a copy of the personal data we hold about you | All users |
| Correction / Rectification | Ask us to correct inaccurate information | All users |
| Deletion | Request deletion of your account and all personal data within 48 hours | All users |
| Portability | Receive your data in a structured, machine-readable format | EEA/UK users (GDPR) |
| Restriction | Ask us to limit how we process your data in certain circumstances | EEA/UK users (GDPR) |
| Objection | Object to processing based on legitimate interest | EEA/UK users (GDPR) |
| Opt-out of sale/sharing | We do not sell or share your data. Nothing to opt out of. | California users (CCPA/CPRA) |
| Opt-out of profiling | We do not profile users. Nothing to opt out of. | All users |
| Appeal | If we deny a rights request, you may appeal by replying to our denial notice | US state law users |
| Lodge a complaint | You may complain to your local data protection authority | EEA/UK users (GDPR) |
You can also:
- Revoke Google access: Visit Google Account Permissions at any time to disconnect BackpackBuddy.
- Cancel subscription: Cancel anytime from your dashboard or by emailing us. OAuth tokens are deleted immediately on cancellation.
- Export your data: All calendar events and Drive files are already in your Google account and fully portable.
California residents: We do not sell or share your personal information as defined under the CCPA/CPRA. We do not use your data for cross-context behavioral advertising.
Data Retention
| Data Type | Retention Period |
|---|---|
| Email content | Never retained, processed in real-time and discarded |
| Extracted homework/event details | Active subscription + 30 days after cancellation |
| OAuth tokens | Active subscription only; deleted immediately upon cancellation |
| Account information (name, email, child info) | Active subscription + 30 days after cancellation |
| Usage statistics | Active subscription + 30 days after cancellation |
| Policy acceptance records | Active subscription + 1 year after cancellation |
| Payment records | Per Stripe's policy (typically 7 years for financial records) |
Changes to This Policy
We may update this Privacy Policy from time to time. For material changes, we will:
- Update the "Last updated" date at the top of this page
- Send an email notification to your registered email address
- Require your acknowledgment the next time you log in to the dashboard
If you do not agree to the updated policy, you may cancel your account at any time. Continued use of the service after acknowledging the updated policy constitutes acceptance.
Summary of changes from July 3, 2026 version:
- Added Cloudflare Web Analytics to the third-party data processors table. It is a privacy-first, cookieless analytics tool that stores no personal data or IP addresses; the analytics script is not loaded for visitors in the EU/EEA.
Summary of changes from April 6, 2026 version:
- Clarified that extracted homework and event details (titles, dates, event type, child name) are saved to your account to power your calendar and digest, distinct from the raw email content, which we never store
- Disclosed that email content is briefly processed by Anthropic's Claude AI to perform the extraction, and that, under Anthropic's commercial API terms, it is not used to train AI models
- Added Anthropic and Resend to the data processors table
- Added extracted event details to the data storage, data retention, and GDPR legal basis tables
- Corrected the data storage table so extracted event details are listed as encrypted at rest via Cloudflare's platform encryption, not field-level AES-256 (which applies to OAuth tokens specifically)
Summary of changes from April 2, 2026 version:
- Added GDPR legal basis table for each data type
- Expanded children's privacy section (COPPA compliance)
- Added full data subject rights table
- Added data retention table with specific timeframes per data type
- Added breach notification commitment (72 hours)
- Added international data transfers section with SCCs reference
- Added third-party processor table with DPA disclosure
- Added California CCPA/CPRA opt-out disclosure
- Added policy acceptance mechanism
- Expanded security section with encryption details
Contact Us
For privacy questions, rights requests, or concerns:
Cultivate Data Solutions, LLC
Email: [email protected]
Bethesda, Maryland, United States
EEA/UK users may also lodge a complaint with their local supervisory authority. A list of EEA data protection authorities is available at edpb.europa.eu.