Privacy Policy

Thin Slides Live — a product of Learning Innovation Systems, LLC.
Effective Date: August 19, 2026  |  Last Updated: August 19, 2026

Thin Slides Live is a classroom tool where a teacher poses one prompt and every student answers on their own live slide — a short text response and, optionally, one image. We built it for educators, and we take student privacy seriously. This policy explains what data we collect, why, how we protect it, and when we delete it.

The short version: Students never create accounts — just a first name or nickname. All student work is automatically deleted 30 days after a session is created, and teachers can delete it sooner. There are no analytics or tracking scripts of any kind. We do not sell data, serve ads, or build student profiles.

1. Who We Are

Thin Slides Live is operated by Learning Innovation Systems, LLC ("LIS," "we," "us," or "our"). "You" refers to any user of Thin Slides Live — teachers, students, or school administrators.

2. What Data We Collect

We collect different information depending on your role.

Teachers

Teachers sign in with their EduProtocols Live account (Google sign-in). Through that sign-in we receive and store the teacher's name, email address, and Google account identifier, which are used solely to identify the teacher and associate them with the sessions they create. We also store the sessions a teacher creates: the deck title, the prompt, the class size, join codes, and the scores they assign to student slides.

Student Session Data

Students do not create accounts. They join a live session with a short class code shared by their teacher — no login, no email. During a session we collect:

All student session data above is retained for at most 30 days (see Section 5). We do not collect student email addresses, dates of birth, student ID numbers, device identifiers, IP addresses for tracking purposes, or any other persistent student identifiers.

3. How We Use Data

All data we collect is used exclusively to provide the Thin Slides Live service — running the live activity and showing the teacher their class's deck. We do not use student data to advertise, to build profiles, to sell to third parties, or to train machine learning models. Thin Slides Live contains no analytics, advertising, or tracking scripts of any kind; the only browser storage it uses is functional (keeping a student on their slide and a teacher signed in).

4. Where Data Is Stored

We use the following infrastructure providers, which store data in the United States:

All data is transmitted using TLS encryption in transit, and the database is encrypted at rest by Supabase.

The Google Slides Export

Teachers may optionally export a finished deck to Google Slides. This is teacher-initiated: the export copies the deck (student first names, slide text, and slide images) into the teacher's own Google account (Google Drive and Google Slides), using permissions the teacher grants in that moment. That exported copy belongs to the teacher and their school's Google environment; it is governed by the school's Google Workspace terms and is not covered by our 30-day automatic deletion. We never receive or store the teacher's Google credentials, and no student data is sent to Google unless a teacher chooses to export.

5. Data Retention & Deletion

Every session — including all student names, slide text, slide images, and per-student scores in it — is automatically and permanently deleted 30 days after the session was created. This purge is enforced by a scheduled job at the database level and requires no action from teachers, students, or administrators. Teachers can also delete any session sooner from their dashboard, which immediately and permanently removes all student work in that session. Teacher account data (name, email) is retained while the teacher has an EduProtocols Live account and is deleted on request.

Two things can outlive the 30-day window, neither of which contains student data we hold: (1) teachers may download a CSV of names and scores before the purge for their own gradebook — that file lives on the teacher's device or school systems, not with us; and (2) after a session is purged, we retain a de-identified class summary — the deck title, date, class size, and class-average score — so teachers keep a record of how their classes did. This summary contains no student names, no student work, and no individual scores.

6. FERPA Compliance

Thin Slides Live is designed to support schools' compliance with the Family Educational Rights and Privacy Act (FERPA). When a school or district enters into a Data Processing Agreement (DPA) with us, we act as a "school official" with a "legitimate educational interest" under FERPA: we use student data solely for the educational purpose for which it was provided, disclose it to no one except the infrastructure subprocessors listed above (and only as necessary to provide the service), maintain reasonable safeguards, and delete it automatically within 30 days. We are prepared to sign the Student Data Privacy Consortium (SDPC) National Data Processing Agreement or a district's own DPA upon request.

7. COPPA Compliance

Thin Slides Live may be used by children under 13 in a school setting. Under the Children's Online Privacy Protection Act (COPPA), schools may consent to the collection of student information on behalf of parents when the data is used solely for an educational purpose. By allowing students to use Thin Slides Live, the school represents that it has the authority to provide this consent. We do not collect more information than is reasonably necessary to participate: no student accounts, a display name only, and automatic deletion within 30 days.

8. State Privacy Laws

We have designed our data practices to align with common requirements across state student-privacy laws, including California (SOPIPA), New York (Education Law 2-d), Illinois (SOPPA), and Colorado (Student Data Transparency and Security Act): minimal collection, no sale or commercial use of student data, automatic deletion, and transparency about subprocessors. If your state has specific requirements not addressed here, please contact us.

9. Security

We implement the following technical safeguards:

• All traffic is TLS-encrypted; the database is encrypted at rest.
• Row-level security is enforced on every database table; a teacher can only ever access their own sessions.
• Students hold no credentials. Every student action goes through a narrow set of server-side functions that validate the session state and the student's membership — a student can only ever read or write their own slide, never anyone else's.
• Class codes are randomly generated, unguessable in practice, and released when a session closes.
• Access to infrastructure is restricted to authorized personnel using strong authentication.

10. Third-Party Access

We do not sell, rent, lease, or share student data with any third party for commercial purposes. The only third parties that process session data are the infrastructure subprocessors in Section 4, each only to the extent necessary to deliver the service and each bound by their own data processing terms — plus Google, only when a teacher chooses to export a deck to their own Google account (Section 4). We run no analytics, error-tracking, or advertising services — none.

The built-in photo search is proxied through our own server to Pixabay with safe-search enforced: Pixabay receives only the search words — never a student's name, session, or network address — and blocked or inappropriate queries return no results.

11. Data Breach Notification

In the event of a data breach affecting student information, we will notify affected schools and districts without unreasonable delay and no later than 72 hours after becoming aware of the breach, including a description of the data involved, the date or estimated date of the breach, and the steps we are taking in response.

12. Your Rights

Schools and districts may request confirmation of deletion, details about our data handling practices, or termination of processing under an active DPA. Teachers may delete any of their sessions at any time and may request deletion of their account data. Parents may contact their child's school to ask how Thin Slides Live is used in the classroom. Because students have no accounts and student data is deleted automatically within 30 days, there is no persistent student record beyond that window for us to provide or delete (any deck a teacher exported to Google Slides is under the school's control, not ours).

13. Changes to This Policy

We may update this policy from time to time. If we make material changes to how we handle student data, we will notify schools and districts with active DPAs at least 30 days before the changes take effect. The "Last Updated" date above reflects the most recent revision.

14. Contact Us

Learning Innovation Systems, LLC
20409 Yorba Linda Blvd. Suite K2 225
Yorba Linda, CA 92886
Email: support@eduprotocols.com