Privacy Policy

Last updated: 18 August 2026

StudioLoom is a learning platform for design and project-based classrooms. This policy explains what we collect, why, who we share it with, and the rights you have over your information. We try to keep it short and plain.

1. Who we are

StudioLoom (“we”, “us”) is operated by Loominary, a registered business name of Matthew Burton (ABN 86 298 757 166), based in Australia. You can reach us at hello@loominary.org.

2. Who uses StudioLoom

Teachers create classes, design units, and review student work.
Students access StudioLoom through their school’s class — they do not sign up directly.
Some students are under 13. Their access is controlled by the school. We rely on the school to obtain any consent required under local law (e.g. COPPA in the U.S., GDPR in the EU/UK, the Privacy Act in Australia, PIPL in China).

3. What we collect

Account information

Teachers: name, email address, role (teacher / lab tech / admin), and school affiliation. If you sign in with Google or Microsoft, the provider tells us your name and email — nothing else.
Students: a class code plus a short display name set by the teacher. We recommend schools use initials rather than full names, and we do not require or store a student email address. Students never sign up directly or enter personal contact details — their teacher creates their access.

Content you create

Units, lessons, classes, and uploaded files (e.g. STL or SVG fabrication files).
Student work: text, drawings, files, peer reviews, reflections.
Your interactions with AI features (such as feedback requests) and any feedback signals (e.g. pace ratings).

Usage data

Pages visited, actions taken, time on task. Used to improve teaching analytics.
Browser type and approximate location (from IP) — not stored long-term.
We use Vercel Web Analytics and Speed Insights, which are cookie-free and do not collect personal data or track individuals across sites.

4. Why we collect it

To provide the platform — hosting your classes, units, and student work.
To power AI features with the context they need to give relevant feedback.
To give teachers visibility into student progress and wellbeing signals.
To keep the platform safe (content moderation, abuse prevention).
To improve the product. We do not sell data and do not use it for advertising.

5. AI features

StudioLoom uses large language models from Anthropic (Claude) to generate lesson scaffolding and give feedback on student work. When an AI feature is used, the relevant context — the prompt and surrounding lesson content — is sent to Anthropic for processing. Under Anthropic’s terms, this content is not used to train their models.

Student names are never sent to the AI. Before any student text leaves StudioLoom, names are automatically replaced with a placeholder and restored only in the response you see — an automated check blocks this data path if a name is present.

We are putting formal data-processing agreements in place with our AI provider; the current status is available to schools on request.

6. Sub-processors

We rely on third-party providers for the following services:

Database, authentication, and file storage.
Application hosting and edge delivery.
AI language models, for feedback and lesson generation.
Text embeddings, for knowledge base search.
Transactional email (account invites, status updates).
Privacy-friendly, cookie-free analytics.
Fabrication file scanning (Preflight feature only).

A current sub-processor list — naming each provider, the data it receives, its processing region, and its data-processing agreement status — is available on request, and is provided to schools as part of onboarding.

7. Where data is stored

StudioLoom’s primary data — teacher and student accounts, class content, and student work — is stored in South Korea (our managed database and authentication provider operates in a Seoul / Northeast Asia region). AI processing takes place in the United States, and application hosting is provided across multiple regions. Because data is processed outside your own country, your school decides what cross-border transfer is permitted for its students and which legal basis applies in its jurisdiction (for example, standard contractual clauses, or consent under PIPL or GDPR). A current sub-processor list — naming each provider, the data it receives, its processing region, and its data-processing-agreement status — is available on request.

8. Your rights

Access: request a copy of your data.
Correction: ask us to fix inaccurate data.
Deletion: ask us to delete your data. For students, the school administers this on your behalf.
Portability: export your content in a machine-readable format.
Objection / withdrawal of consent: stop a specific use of your data.

Email hello@loominary.org with the subject line “Privacy request”. We respond within 30 days.

9. Retention

Active account content: kept for as long as the school maintains the account.
Inactive accounts (no sign-in for 18 months): pruned after notice to the school.
Audit logs (security): kept for 12 months.
AI conversation logs: kept for 12 months for safety and quality review.

10. Children’s data

StudioLoom is designed for school use. We do not knowingly collect data from children outside of an authorised school relationship. Schools determine which students access the platform and obtain any parental consent required by local law.

11. Security

Data is encrypted in transit (TLS) and at rest. Access to production systems is restricted, audited, and protected by multi-factor authentication. We notify affected schools without undue delay if we become aware of a breach affecting their data.

12. Cookies

We use only essential cookies needed to keep you signed in. We do not use advertising or tracking cookies. Our analytics (Vercel Web Analytics) is cookie-free.

13. Changes

We will post material changes to this page and update the “last updated” date. For significant changes affecting student data, we will also notify schools by email.

14. Contact

Questions or requests: hello@loominary.org.