Flintolabs Privacy Policy
Effective Date: August 14, 2026 Last Updated: August 14, 2026
Flintolabs LLC ("Flintolabs," "we," "us," or "our") is a Delaware limited liability company operating an AI residency program for middle and high school students.
We wrote this policy in plain language on purpose. If anything here is unclear, email us at studentsuccess@flintolabs.com and a person will answer you.
This policy works alongside our Terms of Service, at flintolabs.com/terms, which covers enrollment, tuition and refunds, acceptable use, ownership of student work, and disputes. Where the two documents overlap, this Privacy Policy controls on privacy matters.
1. Who This Policy Covers
This policy applies to four groups of people:
- Parents, guardians, and paying customers who enroll a student, pay for the program, and communicate with us.
- Students who participate in the residency, use our platform, work in our Slack workspace, and present at Demo Day.
- School and partner staff who work with us on cohorts or sponsorships.
- Website visitors who browse flintolabs.com without enrolling.
It covers our website, our learning platform, the Flintolabs Slack workspace, Demo Day sessions on Zoom, and our email and marketing communications.
2. Information We Collect
2.1 From parents, guardians, and paying customers
| What | Why we need it |
|---|---|
| Name | To identify the account holder and the student's guardian |
| Email address | Enrollment confirmations, program updates, billing receipts, support |
| Mailing address | Billing, tax, and fraud-prevention purposes |
| Payment information | To process tuition (see Section 2.5) |
| Consent records | To document what you have and have not authorized, especially media consent and college credit registration |
| Messages you send us | To answer questions and support your student |
2.2 From students
| What | Why we need it |
|---|---|
| First and last name | To create the student's account and identify their work |
| Email address | Platform login, Slack and Zoom access, program communications |
| Grade level | To place the student in an appropriate cohort and calibrate content |
| School name | Cohort placement, program reporting, and partnership context |
| Date of birth | Only for students who choose to pursue college credit — required by our credit partner to register the student (see Section 5.1) |
| Work product | Projects, apps, pitch decks, code, and written submissions the student creates |
| Conversations with AI coworkers | To run the program, give feedback, and improve the product |
| Slack messages and activity | To operate the workspace where students ask questions and collaborate |
| Zoom participation and recordings | To run Demo Day and, with consent, to share highlights (see Section 6) |
| Platform usage data | Lesson progress, session activity, submission history |
We do not ask students for a home address, phone number, government ID, financial information, health information, or precise location.
We collect a student's date of birth only if the student chooses to pursue college credit, and we collect it at that point — not at enrollment. We use it to register the student with our credit partner and to confirm the student's age for the protections described in Section 7. See Section 5.1.
Please do not send us information we have not asked for. If a student sends us information we did not ask for, we delete it when we notice it.
2.3 From schools and partners
Where a school or organization enrolls students, we may receive student names, email addresses, grade levels, and roster information from that school. We use that information only to deliver the program the school contracted for.
2.4 Automatically, when you use our website or platform
- IP address and general region derived from it (city/state level, not precise geolocation)
- Browser type, device type, and operating system
- Pages viewed, links clicked, and referring site
- Cookie and similar identifiers (see Section 12)
- Session recordings of your visit to our website. We use a tool that reconstructs how visitors move through flintolabs.com — mouse movement, scrolling, clicks, and which parts of a page were on screen — so we can see where the site confuses people. We use this to fix the website, nothing else. It is not used for advertising, and it is not linked to your student's account. See Section 12 for what it captures and how to turn it off.
2.5 Payment information
Payments are processed by Stripe, Inc. You enter your card details directly into Stripe's payment form. Flintolabs never receives or stores your full card number, CVV, or bank account number. We receive from Stripe only what we need to run the business: your name, billing email, billing address, the last four digits of the card, the card brand, and the transaction amount, date, and status.
Stripe processes your payment data under its own privacy policy, available at https://stripe.com/privacy.
3. How We Use Information
We use the information described above to:
- Deliver the program — create accounts, place students in cohorts, run lessons and residencies, operate the Slack workspace, and host Demo Day.
- Support students — answer questions, unblock projects, and give feedback on work.
- Communicate — send enrollment confirmations, schedules, progress updates, receipts, and service announcements to parents and students.
- Process payments — bill tuition, issue refunds, and handle chargebacks.
- Improve the program — analyze how students use the platform, which lessons work, and where students get stuck.
- Market Flintolabs — with the consents described in Section 6, share student first names, project descriptions, and Demo Day recordings publicly.
- Pursue college credit — where a student chooses it and a parent consents, register the student with our credit partner and support the credit application (see Section 5.1).
- Keep the platform safe — detect abuse, enforce our community standards, prevent fraud, and secure our systems.
- Meet legal obligations — tax, accounting, and responses to lawful requests.
We do not sell personal information for money. We do not serve advertising of any kind on the Flintolabs platform. We do not use student work product or student conversations to train third-party foundation AI models.
There is one exception to our position on advertising, and we want you to see it clearly rather than find it: our college credit partner, LivedX, operates under its own privacy policy, which permits behavioral advertising. This affects only families who choose the college credit pathway. Section 5.1 explains exactly what we send LivedX, what we know and do not know about how they use it, and how to decline. Please read it before electing that pathway.
4. AI Coworkers and Automated Processing
A core part of the Flintolabs residency is that students work alongside AI coworkers rather than human instructors. This means:
- Students' messages, questions, drafts, and project work are processed by AI systems in order to generate responses, assign tasks, and give feedback.
- These interactions are stored so students can pick up where they left off, and so we can review program quality and safety.
- We review AI conversations for safety and support reasons — for example, to catch misuse of the platform or a student in distress.
We do not use AI to make decisions that produce legal or similarly significant effects about a student. AI coworkers assign and review project work; they do not determine enrollment, pricing, or credentials without human review.
Who provides the AI. Our AI coworkers run on models from Anthropic, PBC, accessed through Anthropic's commercial API. Under Anthropic's commercial terms, Anthropic does not use inputs or outputs from our API usage — which includes everything your student writes to an AI coworker — to train its models. Anthropic processes that content under its own privacy policy, at https://www.anthropic.com/legal/privacy.
5. Third-Party Services We Use
We share information with service providers who help us run the program. Except where noted, they are permitted to use it only to provide services to us, and are bound by contract to protect it.
| Service | What it does | What it receives |
|---|---|---|
| Stripe, Inc. | Payment processing | Customer name, billing email and address, payment card details entered directly by you |
| Zoom Video Communications | Live sessions and Demo Day | Student name, email, video and audio during sessions, session recordings |
| Google (Google Meet) | Live sessions and Demo Day, alongside Zoom | Student name, email, video and audio during sessions, session recordings |
| Slack Technologies (Salesforce) | Student workspace for questions and project collaboration | Student name, email, and all messages and files posted in the workspace |
| LivedX Inc. | College credit registration and evaluation, only where a student elects it | Student first and last name, date of birth — see Section 5.1, which describes limits we have not been able to place on this partner |
| Google (Workspace and Gmail) | Program and marketing email | Parent and student names and email addresses |
| Vercel Inc. | Hosting for flintolabs.com | Website requests and server logs |
| Railway Corp. | Hosting for the AI workspace | All workspace data, including student project content |
| PostHog, Inc. | Website analytics and session recording | Website usage data, cookie identifiers, and session recordings of visits to flintolabs.com |
| Google (Google Analytics) | Website analytics | Website usage data and cookie identifiers |
| Anthropic, PBC | AI coworker functionality | Student messages and project content. Anthropic does not train its models on this content (see Section 4) |
We also share information:
- With schools and sponsors, where a school enrolled the student or an industry sponsor is attending a Demo Day, limited to what is necessary for that relationship.
- Publicly, only as described in Section 6.
- For legal reasons — to comply with law, a subpoena, or a court order; to enforce our terms; or to protect the rights, safety, or property of Flintolabs, our students, or others.
- In a business transfer — if Flintolabs is acquired, merged, or sells assets, personal information may transfer as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
5.1 College Credit and LivedX — please read this section
Flintolabs partners with LivedX Inc. (1625 S Birch Street, 909, Denver, CO 80222) to help students apply the work they do in the residency toward college credit.
The credit pathway is open to every enrolled student, and no student is registered with LivedX automatically. Credit is earned — a student pursues it by completing the required work. We register a student with LivedX only at the point they choose to pursue credit, and only after the enrolling parent or guardian has given written, opt-in consent for that specific registration. Consenting to this Privacy Policy is not consent to register with LivedX.
Not pursuing credit has no effect on the residency. The student completes the same program, works with the same AI coworkers, presents at the same Demo Day, and receives the same Flintolabs credential.
What we send LivedX, and only this: the student's first and last name and date of birth. LivedX requires both to create the registration and begin the credit evaluation. We do not send LivedX your payment information, mailing address, school name, grade level, Slack messages, Demo Day recordings, project files, or AI coworker conversations.
What we want you to know before you consent. LivedX is an independent company. Once we transmit a student's name and date of birth, LivedX handles that information under its own privacy policy, available at https://livedx.com/#/privacy — not under this one. We have reviewed that policy, and you should know the following about it:
- LivedX states that it participates in behavioral-based advertising, and that it may use personal information for interest-based advertising built from information gathered across multiple websites, devices, and platforms, including third-party offers.
- LivedX states that it does not modify a user's experience based on Do-Not-Track signals.
- LivedX's privacy policy does not contain a children's privacy section, a provision addressing users under 13, or a stated minimum age.
We do not currently have a written agreement with LivedX restricting it to service-provider use of Flintolabs student information. We are seeking one. Until we have it, we cannot promise you that LivedX will limit its use of a student's name and date of birth to the credit evaluation, and we will not tell you otherwise. Under California law, this disclosure may constitute a "share" of personal information for cross-context behavioral advertising.
Because of this, and because our students are minors:
- We require opt-in written consent from a parent or legal guardian before any student is registered with LivedX, regardless of the student's age.
- We do not register any student under 13 with LivedX under any circumstances.
- The credit pathway is available to students aged 13 and older.
- We ask every parent to read LivedX's privacy policy in full before consenting.
Withdrawing. You may withdraw from the credit pathway at any time by emailing studentsuccess@flintolabs.com. We will stop sending information to LivedX and will request that LivedX delete the student's registration information. LivedX's response to a deletion request is governed by its own policy and its own legal obligations; you may also contact LivedX directly at hello@livedx.com. Credit already awarded by an institution is that institution's record, and neither we nor LivedX can rescind it.
We will update this section as soon as we have a written data protection agreement in place with LivedX, and we will notify parents when we do.
A note about Slack and Zoom
Slack and Zoom are independent companies with their own privacy policies and their own age requirements for account holders. When your student uses the Flintolabs Slack workspace or joins a Flintolabs Zoom session, those companies process data under their own terms:
Flintolabs administers its Slack workspace and can export, review, and delete workspace content. Students should treat the Slack workspace as a monitored, non-private environment.
6. Demo Day Recordings, Student Names, and Marketing
We record Demo Day. Every cohort's Demo Day session on Zoom is recorded. This is part of how the program works — students receive their recording, and industry sponsors and judges attend live.
What we may publish depends on what you told us at enrollment. When you enrolled your student, you were required to answer two media permission questions before registration could be completed. Your answers govern:
- Student first name. If you said yes, we may use your student's first name alongside their project in blog posts, on social media, and in our student app gallery.
- Video and audio. If you said yes, we may publish recordings or clips of your student — including their Demo Day pitch — on Flintolabs social media, our website, and in marketing materials.
If you did not give permission, we do not publish that student's name, image, or voice, and we edit them out of any clip we share.
Two things we ask permission for separately, before Demo Day. The enrollment answers above do not cover either of these. We ask for each in a signed media release sent ahead of the event, along with a sample recording from a past cohort so you can see exactly what the format looks like before deciding. If you do not return that release, we publish nothing featuring your student — they still present, and nothing about their participation or credential changes.
- The Flintolabs marketplace at flintolabs.com/marketplace. This page is fully public — no login, and search engines can find and index it. A listing shows the project and the student's grade level, with their first name if you permit it. Where you do not, the listing reads "Anonymous" with the grade.
- YouTube. Publishing a Demo Day pitch to the Flintolabs YouTube channel, where the student's face and voice are visible and audible, and from which the video may be shared to other channels.
What we never publish: a student's last name, email address, mailing address, school name, date of birth, or any payment information. We never publish a student's grade level together with their school name.
Changing your answer. You may change either permission at any time by emailing studentsuccess@flintolabs.com. No reason needed. When you withdraw permission, we remove the content from every channel we control — our website, blog, and our own social media accounts — within 30 days.
What we cannot undo. Once something has been public, others may have downloaded, reshared, screenshotted, or archived it. Platforms and search engines may retain cached copies. We will remove what we control; we cannot promise erasure from the internet.
Declining costs your student nothing. Demo Day participation, program completion, college credit eligibility, and every Flintolabs credential are fully available to students whose families decline both permissions.
Demo Day is a live audience. Industry sponsors and invited judges attend and will see and hear participating students live. That is core to the program and we cannot offer an exemption from it. If your student may not appear on live video before outside guests, tell us before the cohort begins and we will arrange an alternative format.
Content that needs no permission. We may always share screen recordings of a student's app, screenshots of the product, and descriptions of what was built, with no student name, face, or voice attached.
7. Children's and Teens' Privacy
Flintolabs serves middle and high school students. Many of our students are minors, and some are under 13.
Under 13 (COPPA)
We do not knowingly collect personal information from a child under 13 without verifiable parental consent. For students under 13:
- Enrollment must be completed by a parent or legal guardian, who provides consent to our collection and use of the child's information.
- Public use of a child's first name, image, voice, or work requires separate, explicit parental consent as described in Section 6.
- We do not register students under 13 with LivedX or any other college credit partner, and we do not collect their date of birth for that purpose.
- We do not disclose the personal information of a student under 13 to any third party for advertising, marketing, or profiling purposes.
- Parents may review the personal information we hold about their child, request its deletion, and refuse further collection at any time, by emailing studentsuccess@flintolabs.com. If a parent refuses further collection, we can no longer provide the program to that student and will refund under our Terms of Service at flintolabs.com/terms.
- We do not condition a child's participation on disclosing more information than is reasonably necessary to run the program.
If we learn we have collected personal information from a child under 13 without the required consent, we delete it promptly.
13 and older
For students 13 and older, we collect information as described in this policy with the enrolling parent's or guardian's authorization. Parents retain the rights described above for any student under 18.
Under California law, we do not sell or share the personal information of a consumer under 16 without opt-in consent. The college credit registration described in Section 5.1 is the only disclosure that may fall into this category, and we require written parental opt-in consent before it happens.
Schools
Where a school enrolls students, we act as a service provider to the school and handle student information only on the school's instructions and for the purposes the school authorized. Where the Family Educational Rights and Privacy Act (FERPA) applies to records a school shares with us, we handle those records under the school's direction as a "school official" with a legitimate educational interest, and we do not redisclose them without the school's authorization. We comply with applicable state student-privacy laws in the states where we serve students.
We do not sell student data, use student data for targeted advertising, or build advertising profiles of students.
Third-party age requirements
Slack and Zoom set their own minimum ages for account holders. We operate our Slack workspace and Zoom sessions as an organization-administered environment and provision student access ourselves rather than asking students to create independent consumer accounts. Parents who prefer their student not use a particular third-party platform should contact us before the cohort begins.
8. How Long We Keep Information
| Information | Retention |
|---|---|
| Account and enrollment records | Duration of enrollment + 3 years |
| Payment and billing records | 7 years, for tax and accounting purposes |
| Student work product and project files | Duration of enrollment + 2 years, so students can retrieve their work |
| AI coworker conversations | 2 years |
| Slack workspace messages | 1 year after cohort ends, then deleted |
| Zoom recordings (unpublished) | 1 year, then deleted |
| Date of birth and college credit registration records | Duration of enrollment + 3 years, or on request, whichever is sooner |
| Published marketing content | Until consent is withdrawn or we retire the content |
| Website analytics data | 26 months |
| Consent and media-release records | 7 years, as proof of consent |
We delete or de-identify information when we no longer need it, unless a longer period is required by law.
9. How We Protect Information
We use appropriate technical and organizational measures to protect personal information, including:
- Encryption in transit (TLS) and encryption at rest for stored data
- Access limited to Flintolabs personnel who need it to do their jobs
- Multi-factor authentication on administrative accounts
- Contractual data-protection commitments from our service providers
- Regular review of access permissions
No system is perfectly secure. If a breach affects your personal information, we will notify you and any required regulators within the timeframes the law requires.
10. Your Privacy Rights
10.1 If you are a U.S. resident
Depending on your state — including California, Colorado, Connecticut, Delaware, Oregon, Texas, Virginia, and others with comprehensive privacy laws — you may have the right to:
- Know what personal information we collect, use, and disclose about you
- Access a copy of your personal information in a portable format
- Correct inaccurate personal information
- Delete your personal information
- Opt out of the sale of personal information, of targeted advertising, and of profiling with significant effects
- Opt out of sharing personal information for cross-context behavioral advertising
- Limit the use of sensitive personal information
- Appeal a decision we make about your request
- Not be discriminated against for exercising any of these rights
Our position on selling and sharing. We do not sell personal information for money, and we do not serve advertising on the Flintolabs platform. The one disclosure that may constitute a "share" under California law is the college credit registration described in Section 5.1, which occurs only with written parental opt-in consent and can be withdrawn at any time by emailing studentsuccess@flintolabs.com. If you never elect the college credit pathway, no disclosure of this kind occurs.
California residents (CCPA/CPRA). In the 12 months before the effective date of this policy, we collected the categories of personal information listed in Section 2 — identifiers, customer records, commercial information, internet activity, audio/visual information, education information, and inferences from platform use. We collected it from you, your student, your school, and automatically from our platform. We disclosed it for business purposes to the service providers listed in Section 5. We did not sell personal information. The only disclosure that may constitute a "share" is described in Section 5.1, and we obtain opt-in parental consent before it occurs. We do not knowingly sell or share the personal information of consumers under 16 without the opt-in consent required by law, and we do not register students under 13 with our credit partner at all.
Delaware residents (DPDPA). Delaware residents have the rights listed above, including the right to obtain a list of the third parties to whom we have disclosed personal data. Email us and we will provide it.
To exercise a right: email studentsuccess@flintolabs.com with "Privacy Request" in the subject line and tell us what you want. We will:
- Acknowledge your request and verify your identity using information already in your account — we will not ask you for a government ID or new sensitive information to verify a request.
- Respond within 45 days, and tell you if we need up to 45 more.
- Handle requests free of charge unless a request is excessive or repetitive.
Parents and guardians may exercise these rights on behalf of a student under 18. Authorized agents may submit requests with written permission from you, which we will verify.
Appeals: if we deny your request, you may appeal by replying to our decision with "Appeal" in the subject line. We will respond to appeals within 60 days. If we deny your appeal, you may contact your state Attorney General.
10.2 If you are in the European Economic Area, the United Kingdom, or Switzerland (GDPR)
Flintolabs is based in the United States and operates primarily in the U.S. Where the GDPR or UK GDPR applies to you, you have the rights to access, rectification, erasure, restriction of processing, data portability, objection to processing, and the right to withdraw consent at any time without affecting processing already carried out.
Our legal bases for processing:
| What we do | Legal basis |
|---|---|
| Deliver the program, run accounts, provide support | Performance of a contract (Art. 6(1)(b)) |
| Process tuition payments | Performance of a contract |
| Publish student first names, images, and Demo Day recordings | Consent (Art. 6(1)(a)) — parental consent for minors under Art. 8 |
| Register a student with our college credit partner | Consent (Art. 6(1)(a)) — parental consent for minors under Art. 8 |
| Improve the program, secure the platform, prevent fraud | Legitimate interests (Art. 6(1)(f)) |
| Tax, accounting, and legal compliance | Legal obligation (Art. 6(1)(c)) |
Where processing relies on consent, you may withdraw it at any time by emailing studentsuccess@flintolabs.com.
International transfers: if you are outside the United States, your information will be transferred to and processed in the United States, where privacy laws differ from those in your country. Where required, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) for these transfers, together with supplementary technical and contractual safeguards. You may request a copy of the relevant transfer mechanism by emailing us.
Complaints: you have the right to lodge a complaint with your local data protection authority, or with the UK Information Commissioner's Office at ico.org.uk.
11. Communications and Marketing Email
We send parents transactional messages about enrollment, scheduling, and billing. You cannot opt out of these while you have an active account, because they are how the program runs.
We also send marketing email about future cohorts, events, and the Flintolabs newsletter. You can unsubscribe from marketing email at any time using the link at the bottom of any message, or by emailing us.
We do not send marketing email to student addresses. Program communications to students are limited to what the residency requires.
12. Cookies and Tracking
Our website uses cookies and similar technologies for:
- Essential functions — login sessions, security, and load balancing. These cannot be turned off.
- Analytics — understanding how visitors use the site so we can improve it. We use Google Analytics and PostHog for this.
Session recording, in plain terms. PostHog also records sessions on flintolabs.com. A session recording is a replay of a visit: where the cursor moved, what was scrolled and clicked, and what was on screen. It is how we learn that a page confuses people without having to ask them.
- We use it to fix the website. It is never used for advertising, never sold, and never linked to a student's account or their program work.
- Recordings are held by PostHog on our behalf and deleted on our normal analytics schedule (Section 8).
- You can stop it. Turn on "Do Not Track" in your browser or use a tracker blocker, and no recording is made. You can also email us and we will delete any recording associated with you.
- Session recording does not run on the student learning platform. It is on our public marketing website only. We do not record your student's screen, cursor, or keystrokes while they are working in the program.
We do not use advertising or cross-site tracking cookies anywhere — not on our website, and not on our student platform. We run no advertising pixels: no Meta, LinkedIn, TikTok, X, or Google Ads tags.
You can control cookies through your browser settings. We honor the Global Privacy Control (GPC) signal as a valid opt-out request where applicable law requires it.
13. Links to Other Sites
Our website, Slack workspace, and program materials may link to third-party sites and tools. We do not control them and are not responsible for their privacy practices. Read their policies before providing information.
14. Changes to This Policy
We may update this policy as the program changes or the law changes. When we make a material change — especially one affecting how we use student information or publish student work — we will:
- Update the "Last Updated" date at the top,
- Post the revised policy on our website, and
- Email active parents and guardians at least 14 days before it takes effect.
If a change would expand how we use a student's personal information beyond what you originally consented to, we will ask for new consent rather than relying on notice alone.
15. Contact Us
For any privacy question, request, or complaint:
Email: studentsuccess@flintolabs.com Subject line: "Privacy Request" (or "Appeal" for appeals)
Flintolabs LLC 614 N Dupont Highway, Suite 210 Dover, Kent County, DE 19901 United States
A person reads this inbox. If you have a concern about how we are handling your student's information, write to us first — we would rather fix it than have you find out about it somewhere else.