Privacy Policy

CAS Incubator OS Last updated: April 2026

1. Who We Are

CAS Incubator OS is an AI-powered project-based learning platform. This policy explains how we collect, use, and protect your personal information.

Contact: barry.py.chuang01@gmail.com

2. What We Collect

Account Information

• Name, email address, and profile information provided during sign-up (via Clerk)
• Role (student, teacher, mentor, parent)

Educational Data

• Project submissions, worksheet answers, checkpoint responses
• Progress records through the 10-stage method
• Mentor notes and feedback (visible to relevant parties only)

Usage Data

• Log data (IP address, browser type, pages visited, timestamps)
• Feature usage for improving the Platform

Parent/Guardian Data

• Name and email for consent and communication purposes (where applicable for students under 18)

We do not collect:

• Payment information (we do not currently charge fees)
• Sensitive categories of personal data (health, biometric, etc.)

3. How We Use Your Data

• To provide the Platform's educational features
• To communicate program updates and feedback
• To send parent/guardian progress updates (with consent)
• To improve the Platform based on usage patterns
• To comply with legal obligations

We do not sell your data to third parties.

4. Data Storage and Security

Data is stored on:

• Supabase (PostgreSQL database, hosted on AWS)
• Vercel (application hosting and edge functions)
• Vercel Blob (file storage)

We implement reasonable security measures including encryption in transit (TLS) and at rest. No system is 100% secure; we encourage users to use strong passwords and report suspected breaches immediately.

5. Minors (Under 18)

We take the privacy of minors seriously. Students under 18 require parental consent before using the Platform. We limit data collection for minors to what is necessary for educational use. Parents may request to review, correct, or delete their child's data at any time.

6. Your Rights

You have the right to:

• Access: Request a copy of your personal data
• Correction: Update inaccurate information
• Deletion: Request deletion of your account and data
• Portability: Receive your data in a machine-readable format

To exercise any right, email: barry.py.chuang01@gmail.com We will respond within 30 days.

7. Cookies

We use essential cookies for authentication session management (Clerk) and language preference (NEXT_LOCALE). We do not use third-party advertising cookies.

8. Third-Party Services

9. Data Retention

We retain your data for as long as your account is active or as needed to provide the Platform. Upon account deletion, personal data is removed within 60 days, except where required by law.

10. Changes to This Policy

We will notify you of material changes via email or a Platform notice at least 14 days before they take effect.

11. Jurisdiction

This policy is governed by the laws of Taiwan (Republic of China). For users in the United States, applicable U.S. federal and state privacy laws also apply where relevant.

Contact: barry.py.chuang01@gmail.com