Who we are, and what we commit to
String (formerly STEAM Hub) is a Digital Learning Environment and AI-driven educational platform, operated by STEAM Hub Software Corp. We commit to respecting the privacy of the schools, teachers, and students who use our platform at string.education and our SaaS application, and to protecting their personal information.
Information we collect
From site visitors, administrators, and teachers, we collect what a demo, a payment, or account management requires:
- Name, email address, and job title
- School name and billing information
- IP address
From rostered students, we collect three categories only:
- Identifiable information: name, school email, grade level, and class enrollment.
- Performance data: grades and quiz results.
- AI behavioral data: interaction logs and "Learning DNA" insights.
What the forms on this website send is set out in the next two sections: "Forms on this website" for the school and company forms, and "Parents and the family app" for the two family forms.
Forms on this website
This website has three forms for schools and companies: booking a demo, applying to resell String, and applying to the startup programme. This is what each one collects.
| Form | What we collect |
|---|---|
| Booking a demo | Your name, email and phone number, the school's name and your role in it, your country, how many students the school has, which parts of String interest you, the programmes the school runs and anything you add to that list, the day and time you picked, whether you prefer a video or a phone call, and your notes. |
| Applying to resell String | Whether you apply as a company or an individual, your name, your company's name if there is one, your email, your phone number, your country, the kind of work you do, how many schools you work with today, and your notes. |
| Applying to the startup programme | Your company's name and website, your name and role in it, your email, your phone number, your country, the company's stage, the track you picked, the APIs you need, and a description of your product. |
We use this information to reply to you and to prepare the call or assess your application, and for nothing else. We do not sell it, use it for advertising, or add you to marketing emails you did not ask for.
How it reaches us: the form is sent as an email to the String team, and you receive a confirmation email. Both go through Brevo, the email provider we use. Cloudflare Turnstile checks that the form is sent by a person. This website does not store the form in a database.
These emails stay in the team's inbox while the conversation with you is open. To see, correct or delete your information, email hello@string.education, and we will complete your request within 30 days.
Google account data
If you choose to connect your Google account, String accesses specific data scopes only, and uses them for one purpose: running your account.
- What we access: your name, email, and profile picture; language preference; and classroom rosters, when authorized by a teacher.
- How we use it: to authenticate your identity and log you in, provision your account and role (Teacher or Student), and display your profile information in the interface.
- Google Workspace Data is NOT used for AI training.
- We do not share Google User Data with third parties, except as strictly necessary to provide the Service — and we do not sell Google User Data to advertisers or data brokers.
- Google User Data is stored encrypted: in transit over HTTPS (TLS 1.2 or higher), and at rest using AES-256 encryption.
String's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
How we use artificial intelligence
String uses proprietary AI and machine-learning algorithms to analyze learning patterns and build "Learning DNA" profiles.
- We do NOT use personally identifiable Student Data to train open or public AI models (like ChatGPT).
- For internal use only, we may use de-identified and anonymized data to refine our own internal algorithms.
- AI-generated insights — including "Learning DNA" — are probabilistic estimates. They are meant to support, not replace, professional educator judgment.
Compliance with education laws
| Law | What it means for you |
|---|---|
| FERPA (U.S.) | We access Student Data only as a "School Official" with a "legitimate educational interest." |
| COPPA (U.S.) | We knowingly collect data from children under 13 only for the use and benefit of the School, and rely on the School to provide consent on the parent's behalf, as COPPA permits. |
| SOPIPA (California) | We do not engage in targeted advertising to students, or build profiles of them for non-educational purposes. |
| GDPR (international users) | The School/District is the Data Controller; String is the Data Processor. Your data is processed in the United States, using Standard Contractual Clauses or the Data Privacy Framework to ensure a compliant transfer. |
Data retention and deletion
- Active accounts retain Student Data and Google User Data for the duration of the subscription.
- Upon contract termination, we delete or de-identify Student Data within 60 days of the termination date, or upon the School's specific written request.
- Deletion requests are processed within 30 days.
- Encrypted backups may persist for an additional 30 days.
Security of your data
- Data is encrypted in transit (TLS/SSL) and at rest (AES-256).
- Only authorized employees with a specific need (such as support engineers) can access database records, and every access is logged.
- We run regular internal security reviews of our access controls and infrastructure.
Your rights (parents and eligible students)
A parent or eligible student wishing to review, correct, or delete their data should contact their School administration directly. We assist the School in fulfilling these requests within a reasonable timeframe.
Schools may request that we stop processing their data by canceling their subscription.
Parents and the family app
When you join the family app waiting list, or ask for String at your child's school, you send us a form. This section explains what we collect from it, why, and what we do with it.
| Form | What we collect |
|---|---|
| Family app sign-up | About you: your email, name, phone number, relationship to the child, country and city, whether you work at a school, and where you heard about String. About your children: how many, their grades, their curriculum, and what you want most from the app. About the school: its type and name, its Ministry of Education code if you picked it from the list, and whether we may mention your name to it. |
| Asking for String at your child's school | The school's name and your email, plus anything you choose to add: your city and country, your child's grade, your name, your relationship to the child, and your notes. |
We use this information to:
- Keep your place on the waiting list, and contact you when the app is available to you.
- Approach the school you named. We mention your name to it only if you allowed it on the form.
- Understand which grades, curricula and cities to start with.
We do not sell this information, use it for advertising, or add you to marketing emails you did not ask for.
How it reaches us: the form is sent as an email to the String team, and you receive a confirmation email. Both go through Brevo, the email provider we use. Cloudflare Turnstile checks that the form is sent by a person. This website does not store the form in a database. Your waiting-list number is kept in your own browser, and is sent with the form itself.
We keep this information while the waiting list is open, or until you ask us to delete it. To see, correct or delete your information, email hello@string.education, and we will complete your request within 30 days.
Questions about this policy
To reach us about this policy, write to our Privacy Officer through the channels below.
- Hello@string.education
- +962 78 597 0011
- 301 Congress Ave, Floor 22, Austin, Texas, United States