Privacy Policy

1. Introduction

TrueCourse ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Google Workspace Add-on and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when using our Service:

• School Profile Information: School name, location address, licensing number, phone number, and instructor names you enter in the add-on settings. This information is stored on our servers to populate your generated reports.
• Account Information: Your Google Workspace email address and basic profile information (name) when you authenticate with Google.
• Billing Information: We do not directly collect payment details. Stripe, our payment processor, handles all credit card and billing information securely. We receive only your subscription status and Stripe customer ID.

2.2 Information We DO NOT Collect or Store

Important: We do not collect, store, or have access to student data. This includes:

• Student names, dates of birth, or contact information
• Student enrollment records or rosters
• Student Students from Google Forms
• Student eligibility data or test scores
• Parent or guardian contact information

Student data remains entirely in your Google Sheets and Google Forms — we only read it temporarily to generate your reports, then discard it. No student data is stored on our servers.

2.3 Information Automatically Collected

When you use the Service, we may automatically collect certain information:

• Service Activity: Limited account, subscription, billing, and credit-usage events needed to operate the Service and improve reliability.
• Activity Logs: Account, billing, and credit-related actions, timestamps, and IP addresses for security, troubleshooting, and account history.
• Cookies and Tracking: Session cookies to maintain your login and enable authentication.

2.4 Google Drive and Workspace Data Access

Our add-on accesses your Google Drive and Workspace data only as necessary to provide the Service. Importantly:

• Google Docs: We access and modify Google Docs you specifically choose to generate reports into. Generated documents remain in your Google Drive.
• Google Sheets: We read data from Google Sheets containing your session configuration and student rosters. We do not store this data on our servers.
• Google Forms: We create and manage Google Forms for student registration when you use that feature. Students are stored in your Google Drive, not on our servers.
• Google Drive: We create folders and files at your request to organize your reports. All files belong to you and remain in your Drive.

Key point: We do not download, copy, or store any Google Drive or Workspace data on our servers. We only read and process it temporarily to generate your reports.

3. How We Use Your Information

We use the collected information for the following purposes:

• Provide the Service: Generate course reports, manage school profiles, organize your Drive, and provide all advertised features.
• Maintain and Improve: Analyze usage patterns to improve functionality, fix bugs, and develop new features.
• Customer Support: Respond to your inquiries, provide technical support, and communicate service updates.
• Billing and Payments: Process subscription payments, manage your account status, and track credit usage.
• Compliance and Safety: Comply with legal obligations, enforce our Terms of Service, and protect against fraud or security threats.
• Security and Troubleshooting: We use activity logs to investigate technical issues and potential security threats.

4. Data Storage and Security

We implement appropriate technical and organizational security measures to protect your information:

• Data is encrypted in transit using SSL/TLS and at rest in our databases.
• We use secure cloud infrastructure (Supabase) with industry-standard security practices.
• Access to personal data is restricted to authorized personnel only.
• We regularly review and update our security practices to address new threats.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share information in the following circumstances:

5.1 Service Providers

We may share data with third-party service providers who assist in operating our Service:

• Supabase: Database hosting and authentication
• Stripe: Payment processing
• Google Cloud Platform: Apps Script hosting and Google Workspace API integration

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

5.2 Legal Requirements

We may disclose your information if required by law or legal process, including:

• Responding to subpoenas, court orders, or legal requests
• Protecting our rights, property, or safety
• Investigating fraud or security issues
• Complying with regulatory requirements

5.3 Business Transfers

If TrueCourse is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

6. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy:

• Active Accounts: We retain your school profile and account data while your subscription is active.
• Inactive Accounts: If you cancel your subscription, we may retain certain data (school profile, account info) for up to 90 days to allow for reactivation, then delete or anonymize it unless legally required to retain it longer.
• Activity Logs: We retain activity logs for up to 90 days for security, support, and troubleshooting purposes, then permanently delete them.
• Legal Compliance: We may retain information longer if required by law, regulation, or legal proceedings.

7. Your Rights and Choices

You have the following rights regarding your personal information:

7.1 Access and Correction

You can access and update your school profile information directly within the add-on sidebar. For other data access requests, contact us at the email below.

7.2 Deletion

You can request deletion of your account and associated data by contacting us. Note that we may retain certain information as required by law or for legitimate business purposes.

7.3 Google Permissions

You can revoke the add-on's access to your Google account at any time through your Google Account settings at myaccount.google.com/permissions. Revoking access will prevent the Service from functioning.

7.4 Marketing Communications

You can opt out of marketing emails by clicking the unsubscribe link in any marketing message. We will still send you transactional emails related to your account and subscription.

8. Children's Privacy

Our Service is intended for use by driving schools and their administrative staff, not by children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately, and we will take steps to delete such information.

Note on Student Data: While driving schools using our Service may work with student drivers (some of whom may be minors), we do not collect, store, or process student personal information on our servers. Student data remains entirely in your Google Sheets and Forms. Schools using our Service are responsible for complying with all applicable educational privacy laws (such as FERPA if applicable) for any student or parental data they manage in their own Google Workspace.

9. Important: We Are Not a Data Processor for Student Data

Key Distinction: TrueCourse does not process, store, or have access to student personal data. This is important because many data privacy regulations (GDPR, FERPA, CCPA) have specific requirements for "data processors."

When you use our Service:

• Student rosters and Students remain entirely in your Google Drive
• We only read this data temporarily and in-memory to generate your reports
• We do not download, store, copy, or retain any student data on our servers
• We do not have a separate data processing agreement (DPA) because we are not a processor of student data

If you have questions about how you should comply with data privacy laws (FERPA, GDPR, etc.) for the student data you manage in your own Google Workspace, please consult your legal counsel. We can help you understand what we do and don't store, but compliance obligations for your student data rest with you as the school.

10. Google API Services User Data Policy

TrueCourse's use and transfer of information received from Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request the minimum Google permissions necessary to provide the features you use.
• We use your Google user data solely to provide or improve our Service's user-facing features.
• We do not transfer your Google user data to third parties except as necessary to provide the Service, comply with law, or as part of a merger or acquisition (with your notice).
• We do not use your Google user data for serving advertisements.
• We do not allow humans to read your Google user data unless with your explicit consent for security purposes, to comply with law, or for internal operations (limited to debugging/troubleshooting).

11. International Data Transfers

Your information may be transferred to and processed in the United States or other countries where our service providers operate. These countries may have different data protection laws than your country of residence. By using the Service, you consent to such transfers.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending an email notification for significant changes (if you have provided an email address)

Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: