Data Sharing & Subprocessors
Last updated: July 5, 2026
Our commitments
Melaa ("the Service"), operated by IncluSend LLC, handles student data only on behalf of, and at the direction of, the educational institution. We act as a school official with a legitimate educational interest under FERPA. We commit that:
- We do not sell student data, and never have.
- We do not use student data for targeted advertising or to build advertising profiles.
- We do not use student data to train third-party AI models. Data sent to our AI subprocessor is covered by a zero-retention, no-training agreement, and student names are redacted before transmission.
- Student data remains the property of the school or district, who may request export or deletion at any time.
- We use student data solely to provide and improve the Service for that institution.
Categories of data
- Educator/account data: name, email, role, school assignment.
- Student data: name, grade, school, and WIDA ACCESS language-proficiency scores (and, when a district enables roster sync, class/section enrollments used to match teachers to their students).
- Usage data: AI message counts, audit logs of student-data access, and billing records.
Subprocessors
We use the following subprocessors to operate the Service. Each is bound by contractual obligations to protect data consistent with this page and our Privacy Policy.
| Subprocessor | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, and application hosting (US region) | Account data, student records, app content |
| Vercel | Web application hosting and serverless compute (US region) | Request data in transit; no durable student data store |
| Anthropic (Claude) | AI assistant that generates instructional strategies | Pseudonymized student context (names redacted before sending); no training on data |
| Stripe | Subscription billing and payments | Billing contact and payment data (no student data) |
| Resend | Transactional email (invites, account, billing) | Educator names and email addresses (no student data) |
| Clever / ClassLink | Optional roster sync and single sign-on, at district direction | Roster data the district shares: schools, staff, students, classes, enrollments |
| Cloudflare | DNS and content delivery / security | Request metadata in transit |
Roster providers (Clever & ClassLink)
When a district chooses to connect Clever or ClassLink, the district authorizes the sharing of roster data (schools, staff, students, classes, and enrollments) with Melaa. We ingest only the fields needed to provision accounts and align each teacher with their assigned students. OAuth credentials are encrypted at rest, and the connection can be revoked by the district at any time. We support providers' data-masking features (e.g., ClassLink DataGuard).
Retention & deletion
Student data is retained for the duration of the institution's subscription and deleted upon request or after account termination, subject to the timelines in our Privacy Policy. Usage and billing logs are retained for up to 12 months.
Contact
Questions about data sharing, subprocessors, or a Data Privacy Agreement (DPA)? Contact privacy@inclusend.com. Related documents: Privacy Policy, Terms of Service, Accessibility.