The short version
- Your child's IEP is read by me and no one else. It is encrypted at rest in a private folder.
- It is never sold, never used for advertising, and never used to train any AI system.
- It is never shared with your school, district, or anyone else — unless you ask me to in writing.
- I delete it 12 months after your child's plan year ends, automatically.
- Ask me to delete it sooner and I will, then confirm in writing within 30 days.
- There is no advertising pixel, no Meta tracker, and no data broker anywhere in this.
Where things stand right now: The secure upload system is built and running. I tested it end to end on 12 August 2026 using a test file of my own, then deleted that file. No family has sent me a document through this site yet, so there is currently nothing of your child's for me to hold. Everything below describes how this works today, not how I hope it will work later.
The rest of this page says the same thing in more detail. If anything here is unclear, email me and I'll answer in plain English — lamont@kirtonlearning.com.
Who I am
Kirton Learning is a program of Our Rose LLC, which operates from Brooklyn, New York. I'm Lamont Kirton, and I run it. When this page says "I" or "me," that's who it means. When it says "you," it means the parent or legal guardian who signed up.
What I collect
Information you give me
- Your contact details — your name, email address, and phone number if you give it.
- Your child's IEP — the document you upload through the private link I email you after checkout.
- Intake answers — your child's first name, grade, what's going well, what's hard, what they're into, and how best to reach you.
- Anything you send me later — emails, notes on the monthly call, work samples you choose to share.
Payment information
Payments are processed by Stripe. Your card number is entered on Stripe's page and goes to Stripe, not to me. I never see or store your full card number. What I receive back is the last four digits, the card brand, and whether the payment succeeded.
Information collected automatically
Basic, aggregate website analytics: which pages were visited, roughly where in the world the visit came from, and what kind of device it was on. This is privacy-respecting analytics with no cookies used for advertising and no cross-site tracking. There is no Meta pixel, no Google Ads tag, and no advertising network on this site.
The IEP is never part of analytics. The upload page is behind a one-time authenticated link and its contents are never sent to any analytics, error-tracking, or third-party service.
How your child's IEP is handled
This is the part that matters most, so it gets its own section. These are the rules the intake runs on, and they don't loosen.
- You never upload it on the public site. After you pay, I email you a private, one-time link to a separate secure upload page. That link expires after it's used, or after 7 days.
- It is encrypted in transit (HTTPS the whole way) and encrypted at rest in a private storage bucket that is not publicly listable and not publicly readable.
- Only I can open it. Access is restricted to my account. There are no other staff, contractors, or volunteers with access.
- It is never emailed around. I will never ask you to send an IEP over regular email, and I won't send it back over regular email either.
- It is used for exactly one purpose: reading your child's goals so I can build the Blueprint and the weekly work. Nothing else.
What I use your information for
- Building your child's Blueprint, expeditions, weekly lessons, and Log.
- Emailing you those materials and the schedule.
- Processing your payment and sending receipts.
- Answering your questions and running the walkthrough and monthly calls.
- Keeping the records a business is required to keep — invoices, refunds, tax records.
That's the whole list. If I ever want to use your information for something not on it, I'll ask you first and you can say no without losing anything you paid for.
What I never do
- I never sell your information or your child's information. Not to anyone, not for any price.
- I never use it for advertising, ad targeting, or building marketing profiles.
- I never use your child's IEP or work to train an AI model, mine included.
- I never share it with your school or district. If you want something shared with your school, you share it, or you ask me in writing and I'll do exactly what you asked and nothing more.
- I never publish your child's name, photo, or work anywhere without your specific written permission for that specific item.
Who else touches the data
I run this on a small number of standard services. Each one only gets the piece it needs to do its job:
| Service | What it handles | Does it see the IEP? |
|---|---|---|
| Stripe | Payments, receipts, subscription billing | No |
| Supabase | Encrypted file storage and the intake form database | Stores it, encrypted. Cannot be read by anyone but me. |
| Vercel | Website hosting | No |
| Email provider | Sending you the secure link, lessons, and receipts | No — the IEP is never attached to an email |
These companies are service providers acting on my instructions. None of them has permission to use your information for their own purposes. I don't add new services that would touch your child's IEP without telling you first.
How long I keep things
| What | How long |
|---|---|
| Your child's IEP | 12 months after your child's plan year ends, then deleted automatically |
| Intake answers | Same as the IEP — 12 months after the plan year ends |
| The Blueprint and Log | Kept while you're an active family, so you can request a copy. Deleted on request at any time. |
| Your email and contact details | Until you ask me to remove them, or 24 months after our last contact |
| Payment and tax records | 7 years, because tax law requires it. These are invoices and amounts — never IEP contents. |
"Plan year" means the 36-week span your child's Blueprint covers.
How to have your data deleted
Email lamont@kirtonlearning.com with the word Delete and your child's first name. You don't have to give a reason and it won't affect anything you've paid for.
- I delete the IEP and the intake answers from storage.
- I confirm it to you in writing within 30 days, and usually much faster.
- The only things I keep are payment and tax records I'm legally required to hold, which contain no IEP content.
You can also ask me for a copy of everything I hold on you, or ask me to correct something that's wrong. Same address, same 30 days.
Security
These are the controls the intake system runs on today: files encrypted in transit and at rest; a private storage bucket that is not publicly listable or publicly readable, with row-level access rules that grant the public nothing; uploads through signed links that expire in ten minutes; the upload page gated by a one-time token that dies on first use or after 7 days. The file size and file type limits are enforced by the storage system itself, not just by the page, so a bad request can't get around them. Credentials live in environment variables, never in code.
No system is perfectly secure and I won't pretend otherwise. If a breach ever affected your child's information, I would tell you directly and promptly — by email and by phone if I have your number — along with what happened and what I was doing about it.
Children's privacy
Kirton Learning is bought by parents and guardians, not by children. I don't knowingly collect information directly from a child. The information I hold about your child comes from you: the IEP you upload and the intake form you fill out. Your child may write work that I read and log, and you can ask me to delete any of it at any time.
Kirton Learning is a private service you hire directly. It is not a school vendor, so I don't receive records from your school and I'm not acting as a "school official" under FERPA. The IEP I hold is the copy you chose to give me.
Your rights
Wherever you live, you can ask me to show you what I hold, correct it, delete it, or stop emailing you. If you're in a place with specific privacy laws — New York, California, the EU, or anywhere else — I'll honor the rights those laws give you regardless of whether I'm strictly required to. Email is the way to ask.
Every email I send has an unsubscribe link, except transactional ones like receipts and your secure upload link.
Changes to this policy
If I change this policy in a way that matters — new service touching your data, a shorter or longer retention period, anything that affects the IEP — I'll email active families before it takes effect. Small wording fixes get a new date at the top.
Contact
Questions, deletion requests, or anything that reads wrong to you:
lamont@kirtonlearning.com
Our Rose LLC, Brooklyn, New York