Privacy Policy

Introduction

Flame (by Setlist) is committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our video assignment platform. We are especially committed to protecting student privacy and maintaining compliance with the Family Educational Rights and Privacy Act (FERPA) and other applicable education privacy laws.

This Service is built on Setlist infrastructure. For information about how Setlist handles data at the infrastructure level, please review the Setlist Privacy Policy.

Information We Collect

Account Information

When you create an account, we collect:

• Full name
• Email address
• School or organization name
• Role (teacher, student, administrator)
• Authentication credentials

Educational Records

In the course of using our Service, we collect and store:

• Video submissions and associated metadata (file size, upload date, submission status)
• Assignment details and instructions
• Grades, rubrics, and feedback provided by teachers
• Class rosters and student-teacher associations
• Submission history and timestamps
• Draft versions of student work

Usage Information

We automatically collect certain information about your use of the Service:

• Device information (browser type, operating system, device type)
• IP address and general location information
• Log data (access times, pages viewed, features used, errors encountered)
• Analytics data (submission rates, storage usage, engagement metrics)

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to maintain your session, remember your preferences, and analyze usage patterns. You can control cookie settings through your browser, but disabling cookies may limit your ability to use certain features of the Service.

How We Use Your Information

We use the information we collect for the following purposes:

• Provide the Service: To enable video uploads, assignment creation, grading, and feedback delivery
• Account Management: To create and maintain your account, authenticate users, and manage access permissions
• Communication: To send service-related notifications, assignment reminders, and respond to support requests
• Analytics and Improvement: To understand how the Service is used, identify issues, and improve functionality
• Security: To detect and prevent fraud, abuse, and security incidents
• Compliance: To comply with legal obligations, including FERPA requirements
• Storage Management: To monitor storage usage and enforce storage limits based on your subscription plan

FERPA Compliance

We understand that student educational records are protected under the Family Educational Rights and Privacy Act (FERPA). When schools use our Service, we act as a school official with legitimate educational interests in the student records we maintain.

Our FERPA Commitments

• We use student educational records solely to provide the Service to the school
• We do not use student data for advertising or marketing purposes
• We do not sell or share student data with third parties for non-educational purposes
• We maintain appropriate technical, physical, and administrative safeguards to protect student data
• We provide role-based access controls to ensure only authorized personnel can access student records
• We maintain audit logs of access to student educational records
• We will delete or return student data upon request from the school

Data Sharing and Disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

Within Your Educational Institution

Teachers can access submissions and grades for their assigned classes. School administrators can access data for their institution. Students can only access their own submissions and grades.

Service Providers

We work with trusted third-party service providers who assist us in operating the Service:

• Setlist: Provides the underlying infrastructure, storage, and hosting services. See the Setlist Privacy Policy for details on their data handling practices.
• Authentication Providers: For secure user login and identity verification
• Analytics Services: For understanding usage patterns and improving the Service (using anonymized data where possible)
• Email Services: For sending notifications and communications

All service providers protect your data and use it only for the purposes we specify.

Legal Requirements

We may disclose your information if required by law, court order, or legal process, or if we believe disclosure is necessary to protect rights, property, or safety.

Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data is encrypted in transit using TLS.
• Access Controls: Role-based access controls ensure users can only access data they are authorized to view
• Authentication: Secure authentication mechanisms protect account access
• Audit Logs: We maintain comprehensive audit logs of data access and system activities
• Regular Backups: Automatic backups protect against data loss
• Security Monitoring: Continuous monitoring for security threats and vulnerabilities

While we implement strong security measures, no system is completely secure. We encourage users to protect their account credentials and report any suspected security incidents immediately.

Data Retention

We retain your information for as long as necessary to provide the Service and comply with legal obligations:

• Active Accounts: Data is retained while your account is active and for a reasonable period afterward to allow for account recovery
• Student Records: Educational records are retained according to school policies and legal requirements
• Deleted Accounts: When an account is deleted, we remove personal information within 90 days, except where retention is required by law
• Backup Data: Data in backups is deleted according to our backup retention schedule

Schools may request deletion of student data at any time by contacting us.

Your Rights

Depending on your location and applicable laws, you may have the following rights:

• Access: Request access to your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information
• Data Portability: Request a copy of your data in a portable format
• Opt-Out: Opt out of certain data processing activities

For student records, these rights are typically exercised by the school or, in some cases, by parents or eligible students under FERPA. To exercise your rights, please contact your school administrator or reach out to us directly.

Children's Privacy

Our Service is designed for use in educational settings, but it should not be used by children under 13.

Parents and legal guardians have the right to review their child's personal information, request deletion, and refuse further collection. Please contact your school to exercise these rights.

International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure that appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and applicable laws. Right now, student data is processed in the United States, with select logging and analytics actions performed in Germany.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. For significant changes, we may provide additional notice, such as email notification to account holders.

Your continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at privacy@flame.app.

For questions about Setlist's infrastructure and data handling, please refer to the Setlist Privacy Policy.