How I look after your family’s information

Bright Spiral Literacy is my private literacy practice, based in Italy (Partita IVA 18182311003). I’m Dr. Jenn Overstreet, and I am the person responsible for the information you share with me (in privacy law, the “controller”). You can reach me about anything on this page at hello@brightspiralliteracy.com.

Because my practice is in Italy, the EU General Data Protection Regulation (GDPR) and Italy’s data protection law apply to how I handle your information. I give every family that same protection, wherever you live.

What I collect

About you: your name, email address and WhatsApp number, and the record of when you agreed to this policy.
About your child: their name, date of birth, age, grade, school, curriculum, country, time zone and languages, and what you tell me about them as a reader, a writer and a person.
Documents you choose to upload: for example school reports, assessment results, writing or spelling samples, teacher feedback, and learning plans or support documents.
Kind words, if you choose to share them: what you write about working with me, and how you said I may use it (with your first name, anonymously, or just for me). I only ever share it the way you chose, and you can change or withdraw it anytime.
My teaching notes: plans, lesson notes and progress updates you can see, plus private planning notes I keep for myself.

I only collect information about your child from you, never directly from your child. Your child does not use this portal.

Information about learning needs

Some of what you may share, such as an IEP, a diagnosis, or a description of learning differences, can count as health information. The law gives it extra protection. I only receive it if you choose to share it, I ask for your explicit agreement before you do, and I use it only to teach your child well.

Why I use it, and on what basis

To teach your child and keep you informed. This is the service you asked me to provide.
Information about learning needs: only with your explicit consent, which you can withdraw at any time.
Records the law requires me to keep, such as invoices.

I never sell your information, never use it for advertising, and never use it to train artificial intelligence. I do not make automated decisions about your child.

Who can see it

You see your own family’s information and nothing else. I see the information for every family I teach. My private planning notes are visible only to me. I do not share your information with anyone else unless you ask me to, or the law requires it.

The services I use

A few trusted companies run parts of the portal for me. They process information only on my instructions, under data protection agreements.

Supabase: stores the portal’s information and documents, in the European Union (Dublin, Ireland).
Resend: sends sign-in emails. It handles only your email address.
Cloudflare: delivers the portal’s pages. It does not store your family’s information.
Zoom and WhatsApp: lessons and messages, under their own privacy policies.

Where one of these companies is based outside the EU or UK, the transfer is protected by the European Commission’s standard contractual clauses or an equivalent safeguard.

How I keep it safe

Information is encrypted in storage and in transit. Database rules keep each family’s information separate, so one family can never reach another’s. Documents open only through links that expire within minutes. My own access is protected by two-step sign-in. If something ever went wrong, I would tell you promptly, and I would inform the Garante where the law requires it.

Cookies and storage on your device

The portal keeps you signed in using storage on your device, and remembers which child you last viewed and any message you are drafting. That is all. There are no advertising cookies or tracking tools.

How long I keep it

I keep your information while your child is working with me, and for 12 months after our last lesson in case you return. Then I delete it, except anything the law requires me to keep longer, such as invoices. You can ask me to delete everything sooner at any time.

Your rights

You can ask me to:

give you a copy of everything I hold about your family,
correct anything that is wrong (you can also change your answers in the portal yourself),
delete your family’s information,
limit how I use it, or object to how I use it,
send it to you in a format you can take elsewhere,
withdraw your consent, including for information about learning needs.

Email hello@brightspiralliteracy.com. I will reply within one month. There is no charge.

If you are unhappy with how I have handled your information, please tell me first so I can put it right. You also have the right to complain to a data protection authority. Mine is the Garante per la protezione dei dati personali in Italy (garanteprivacy.it). If you live elsewhere in the EU or in the UK, you can also go to the authority where you live.

Changes to this policy

If I change this policy in a way that matters, I will tell you and ask you to read it again when you next sign in.