Privacy Policy — Supplemental Schedules

Version: 2026-07
Parent Document: 01-Privacy-Policy.md

This supplement provides additional detail referenced by the EverJoy Privacy Policy.

Schedule D: Multi-Tenant Architecture and Data Isolation

EverJoy operates a shared-database, multi-tenant architecture with logical isolation enforced through PostgreSQL Row-Level Security (RLS).

D.1 Tenant Scoping Model

Scope	Identifier	Isolation Mechanism
Family	`family_id`	All family members share family scope
Child	`student_id`	Access via `owns_student()` or family membership
School	`school_id`	School affiliation on child profile; partner assignments
Partner	`capture_partner_id`	Partner-scoped via `partner_serves_school()`
Platform	N/A	Platform admin bypass with audit logging

D.2 RLS Policy Summary

Parents can SELECT/INSERT/UPDATE/DELETE only on:

Their own profiles row
students where family_id matches or parent_id matches
memories where student ownership verified
consent_records for their profile

Parents CANNOT:

SELECT from student_roster (server-side matching only)
Access other families' data
Browse partner capture jobs for other schools

Capture Partners can SELECT on:

artifacts for assigned schools only
capture_jobs for their partner ID
partner_school_assignments for their assignments

D.3 Service Role Usage

Server-side API routes use Supabase service role for:

Roster activation matching (after parent authentication)
Account deletion execution
Admin operations
AI worker processing

Service role is never exposed to client-side code.

Schedule E: Notification and Communication Data

E.1 Transactional Email Categories

Category	Trigger	Provider	Data Included
Account verification	Signup	Postmark	Email, verification link
Password reset	User request	Postmark	Email, reset link
Billing receipt	Stripe webhook	Postmark	Email, amount, plan
Consent update	Policy change	Postmark	Email, policy link
Deletion confirmation	Deletion request	Postmark	Email, confirmation link
Capture notification	Artifact captured	Postmark	Email, child name, count

E.2 Email Retention

Transactional email logs retained per provider policy (typically 45 days). EverJoy stores delivery status metadata for 1 year.

E.3 SMS (Future)

SMS adapters may be configured for critical notifications. SMS consent will be collected separately if implemented.

Schedule F: Analytics and Product Improvement

F.1 PostHog Configuration

When NEXT_PUBLIC_POSTHOG_KEY is configured:

Page view tracking on dashboard and marketing pages
Feature usage events (timeline view, yearbook open, upload complete)
Session recording: disabled for dashboard (child content protection)
Autocapture: limited to non-sensitive UI elements

F.2 Events Explicitly Excluded

Analytics events do NOT include:

Child names or identifiers
Memory content or titles
Photo/image data
OCR text or AI outputs
Roster data
Billing amounts

F.3 Aggregated Analytics

EverJoy may use aggregated, de-identified analytics for:

Feature adoption metrics
Performance monitoring
Product roadmap decisions

Aggregated data cannot identify individual users or children.

Schedule G: Payment Data Handling

G.1 Stripe Integration

EverJoy uses Stripe for:

Subscription billing (Starter, Value, Premium)
One-time booklet payments
Customer Portal for self-service billing management

G.2 Data Flow

Parent initiates checkout
Redirected to Stripe Checkout (PCI-compliant)
Stripe returns session/subscription ID
EverJoy stores Stripe customer ID and subscription metadata
Webhooks update subscription status

G.3 Data NOT Stored by EverJoy

Full credit/debit card numbers
CVV/CVC codes
Bank account numbers
Stripe stores payment methods; EverJoy receives only tokens and last-4 digits

G.4 Billing Record Retention

Payment metadata retained 7 years for tax and accounting compliance.

Schedule H: International Users

H.1 Primary Jurisdiction

EverJoy is operated from the United States with primary focus on California schools and families.

H.2 EEA/UK Users

If you access the Service from the EEA or UK:

Legal bases for processing are described in Privacy Policy Section 3.7
You have GDPR rights as described in Section 11.4
International transfers use appropriate safeguards
Contact privacy@myeverjoy.com for DPO inquiries

H.3 Data Localization

EverJoy does not currently offer data localization outside the United States. Data is processed in U.S.-based cloud infrastructure.

Schedule I: Data Processing Activities Record

Activity	Purpose	Data Categories	Recipients	Retention
Account management	Provide Service	Account data	Supabase	Account + 365 days
Memory storage	Core feature	Photos, documents	Supabase Storage	~7 years
AI classification	Organization	Memory content	OpenAI	~7 years
Partner capture	School scanning	Artifact images	Supabase, Partner	~7 years
Roster matching	Activation	Roster data	Supabase	Agreement + 90 days
Billing	Subscriptions	Billing metadata	Stripe	7 years
Analytics	Improvement	Usage events	PostHog	Per provider
Email	Communications	Email address	Postmark	1 year metadata
Audit	Security	Action logs	Supabase	3 years

Schedule J: Privacy Impact Assessment Summary

EverJoy conducted an internal privacy impact assessment covering:

J.1 High-Risk Processing

Processing	Risk	Mitigation
Child photo storage	Unauthorized access	Private buckets, signed URLs, RLS
AI processing of child content	Third-party exposure	Separate consent, OpenAI DPA, TTL URLs
Roster DOB matching	Sensitive data exposure	Server-side only, no parent browse
Partner capture	Third-party access	Certification, scoped access, anonymous labels

J.2 Residual Risks

AI output inaccuracies (mitigated by parent review requirement)
Partner misconduct (mitigated by certification and audit)
Account compromise (mitigated by auth, rate limiting, notification)

J.3 Review Schedule

Privacy impact assessment reviewed annually or upon material feature changes.

Supplemental Schedules version 2026-07.