Data Use Policy

What Data We Use

• Parent Emails: Only emails already provided to your PTA are used to verify signup.
• Tasks, Events & Information: Leto extracts tasks and events (like deadlines and sign-ups), and Information, from PTA-distributed emails and / or from an email account you have connected. Information means facts about your family's schools and organizations that their emails contain, such as a policy, a schedule, an announcement, or a contact detail (for example, "dismissal is at Door 3").
• Minimal Family Info: Parents may optionally add children's first names and grade levels to organize their family calendar.

Organization Signup Pages

Your PTA may provide a dedicated signup link for parents to join Leto.

What We Collect

• Your email: Captured before you create your account, used to pre-fill signup and track if you complete registration
• Your IP address: Recorded for security purposes (preventing abuse)

Why We Collect It

• To connect you to your PTA automatically when you complete signup
• To follow up if you start but don't complete registration
• To prevent automated abuse of signup pages

Security

• Signup links contain a security token—only links from your PTA will work
• Organizations can rotate or revoke signup links if a link is shared beyond the intended community.
• Pages are not indexed by search engines
• Rate limiting prevents automated signups

Retention

• If you complete signup, your lead data is linked to your account
• If you don't complete signup, your data is automatically deleted after 30 days
• You can request immediate deletion by emailing [email protected]

Email Inbox Connection

If you connect your Gmail inbox, Leto automatically discovers organization-related emails and extracts tasks, events, and Information. Here's how it works:

What We Access

• Email Metadata (past 45 days): Sender addresses, subject lines, and dates to identify and map organization-related senders to organizations.
• Email Content (past 14 days): We temporarily read email body content from recognized organization senders to extract tasks, events, deadlines, and Information.
• Linked web pages: When emails from approved senders contain links to external pages (such as online newsletters or school event pages), we follow those links and fetch the page content to extract tasks, events, and Information. This is done directly by Leto's servers — the content is never sent to a third-party scraping service.
• PDF attachments: PDF files attached to emails from approved senders are processed to extract text and dates. Image-based PDFs are analyzed by AI.
• Images: Images embedded in or attached to emails from approved senders are analyzed by AI to extract text content such as event dates and announcements.
• All content extraction — email body, web pages, PDFs, and images — is performed by Anthropic's Claude AI.

What We Don't Access

• We do not access your drafts or sent mail.
• We do not read who you emailed (recipients/CC/BCC).
• We do not access email metadata older than 45 days, or email content older than 14 days.
• We do not access links or attachments from senders you have not approved.

How Long We Keep Email Data

• Email content is deleted immediately: After we extract tasks, events, and Information, the actual email content is deleted immediately. In the event of a processing failure, content is deleted within 24 hours. We only keep the extracted tasks, events, and Information, each with a short context snippet, and each email's fingerprint (see "What We Store" below).
• Sender mappings, email fingerprints, and identity keys are organizational: When you delete your account, we remove everything personal to you. The only data we retain is organization-level sender mappings, email fingerprints, and organization identity keys, which help other families and cannot be traced back to you. See our Privacy Policy for full details.
• What we extract persists: The tasks, events, deadlines, and Information we extract become part of your Leto account. Tasks and events stay until you delete your account, or an organization cancels one, or your child leaves that organization. Information from your own inbox stays until you delete your account or ask us at [email protected] to delete it; your copies of an organization's shared Information are removed if your family leaves that organization.

Connecting Multiple Inboxes

Families can connect up to 3 email accounts, such as both parents’ inboxes. Tasks and events that Leto extracts from any connected account are shared with the whole family, so a deadline that arrives at only one parent’s address still reaches everyone—nobody has to forward anything. Family members can see which accounts are connected, shown as a partly hidden address. Connecting an account does not give other family members access to that mailbox or let them read your email.

How We Process Your Emails

When you connect your email inbox, here's what happens:

What We Process

• Sender addresses and subject lines: To match emails to organizations you follow
• Email body content: To extract tasks, events, and relevant context
• Linked web pages: URLs in emails from approved senders are followed and the page content is fetched and processed to capture information not included in the email body (e.g., online newsletters, school event pages). Web page content is fetched directly by Leto's servers — it is not sent to any external scraping service. Fetched content is processed in memory and deleted after extraction.
• PDF attachments: Text is extracted from PDFs. Image-based PDFs (e.g., scanned flyers) are sent to Anthropic for visual text recognition. Original PDF files are deleted after extraction.
• Images (inline and attached): Images in emails from approved senders are analyzed by Anthropic's AI to identify text content (dates, event titles, deadlines). Original images are deleted after extraction.

What We Send to Our AI Provider

• Email body text, linked web page content, PDF documents, and images from approved senders are processed by Anthropic's Claude AI to extract tasks, events, and Information
• Anthropic does not use your content to train its models. Anthropic does hold it for a limited period under its own commercial terms—we do not have a zero-retention arrangement with them—and its terms govern how long
• Text content: We redact family member names before sending to Anthropic to minimize personal information shared
• Images and PDFs: Name and personal information redaction is not technically possible before visual analysis. Images and PDFs may contain names or contact information that is sent to Anthropic as part of visual processing. This is a necessary limitation of image-based content extraction.
• Anthropic is the only third-party service that receives your email content, attachments, or linked page content. No web scraping service or other vendor receives this data.
• We review Anthropic's data handling practices regularly and will notify you of any material changes that affect how your data is processed
• See Anthropic's Privacy Policy for details

What We Store

• Extracted tasks and events: The actionable items we find in your emails
• Information: Facts about your family's schools and organizations that their emails contain, such as a policy, a schedule, an announcement, or a contact detail. Information from your connected inbox is kept for your family only and is never shared with your organization or any other family. Information from emails an organization sends to its own Leto address is shared with every family in that organization. When a newer email corrects an earlier one, the newer version becomes current and the earlier one is kept, marked as replaced.
• Context snippets: A short excerpt for each task, event, or piece of Information, limited to what is needed to explain the extraction (e.g., the sentence containing the date, deadline, or action item)
• Email fingerprints: Cryptographic hashes generated per email message for deduplication (cannot be reversed to recover content). Maintained at the organization level. We also record each processed email's fingerprint on that email's own record, to recognize when the same message reached several families at your organization. For an email from your connected inbox, or one you pasted into Leto before, that record is in your account and is deleted with your account.
• Sender mappings: Which email senders are associated with which organizations. Maintained at the organization level.

What We Delete

• Email body content: Deleted immediately after successful processing. In the event of a processing failure, deleted within 24 hours.
• Fetched web page content: Processed in memory and never stored beyond the duration of the processing pipeline. No web page content is retained after extraction.
• PDF attachments: Deleted immediately after successful processing. In the event of a processing failure, deleted within 24 hours.
• Images: Deleted immediately after successful processing. In the event of a processing failure, deleted within 24 hours.

What We Retain as Organizational Data

Organization-level sender mappings, email fingerprints, and organization identity keys (list and signing identifiers — such as List-ID and the signing domain — that tell us a message came from a particular organization) are retained to help other families and prevent duplicate processing. This data cannot be traced back to you. Identity keys are de-individualized organizational metadata, retained on a rolling 365-day basis, with the personal per-recipient portion of unsubscribe links stripped and never stored. See our Privacy Policy for full details.

What We Do NOT Store

• Full email bodies (deleted immediately after processing)
• Email-level summaries

High School Fit Score Spreadsheet

If you use the High School Fit Score spreadsheet, you can describe your child in your own words. That description is optional, and here is exactly what happens to it.

• It is sent to Anthropic once. Your description goes to Anthropic’s Claude AI in a single request, along with the shortlist of schools your other answers already qualified—not the whole school directory.
• It sets the order, not the score. The Fit Score is calculated from four objective factors, and your description is not one of them, so the same score means the same thing in every family’s spreadsheet. What your description does is suggest which of the qualifying schools are worth looking at first, and supply the short reason given for that ordering.
• It is not kept after the job that reads it. Your description is held only by the job that reads it, and that job removes it when it finishes, whether it succeeds or fails. If that job never gets to run, it is deleted within about a week. What remains afterwards is whether a description was given and roughly how long it was—never the words. (A database backup taken in that time can still hold it; see “Backups” below.)
• It is never written to our logs.
• Anthropic does not use it to train its models; Anthropic’s own retention terms apply.

Your Address

The spreadsheet asks for your home street address, with its ZIP code. We also use it to tick your borough for you on the form, so you don't have to tell us something your address already says.

• Who sees it: to find it on the map, we send it to NYC Planning GeoSearch (New York City Department of City Planning) and, if needed, the U.S. Census Bureau Geocoder, after removing any apartment or unit number we recognise, such as “Apt 4B”. These free public government services send back the standardized address, its ZIP code and its borough. We ask them when you move on from the address box, to tick your borough, so this happens even if you never ask for a spreadsheet.
• What we use it for: to measure how far each school is from home, to build a transit-directions link for each school in your spreadsheet, and to tick your borough for you on the form. Your address is never sent to Anthropic.
• It is deleted when the building of your spreadsheet finishes, whether it succeeds or fails—within about 15 minutes of your request. We keep only its ZIP code and borough. If you leave without asking for a spreadsheet, we don't store it at all.

Your Spreadsheet File

You download your spreadsheet from the page. We keep the file, encrypted, until the link stops working—an hour after it’s ready, or 30 minutes after your first download, whichever comes first—and delete it then or within minutes after. The file holds your choices, each school’s distance from your home, and the sentences explaining why each school fits, which draw on your description if you wrote one. It is never emailed.

What We Keep

One record per email address, and one for each spreadsheet requested without an email address: your email and when you gave your consent (if you gave an email address), your ZIP code and borough, the web address you used to reach the spreadsheet, and whether you wrote a description and roughly how long it was. A record without an email address can't be linked to you, so we delete it 12 months after the spreadsheet was requested. Our Privacy Policy lists it in full. The rest of your questionnaire answers are deleted with your address.

Backups

A database backup taken while your spreadsheet was being built or waiting to be downloaded can contain your address, your description or the file until that backup is deleted, about one day later.

Organization Email Addresses (PTA Partnerships)

Some organizations receive a Leto-provided email address (such as [email protected]) for distributing organization communications.

How This Works

• Emails sent to Leto-provided organization addresses are organization-wide communications shared by your PTA or school
• These are not private family emails — they are communications the organization intends to share with all member families
• These emails are processed on behalf of the organization and distributed to member families as tasks, events, and Information
• Email content is deleted after processing (or within 24 hours if processing fails)

This Is Different From Your Personal Inbox

• When you connect your personal Gmail inbox, only you control which emails are processed
• Organization email addresses are managed by the organization, not individual families

Organization Partnerships

Leto partners with PTAs (Parent-Teacher Associations) and PAs (Parent Associations) to distribute organization communications to families. These partnerships are provided at no cost to the organization.

What Organizations Receive

• Organizations may receive aggregated engagement metrics (such as overall completion percentages) when sufficient users exist to prevent individual identification
• We do not share metrics for groups with fewer than 10 users
• We may further withhold metrics if the cohort is small or the metric is sensitive
• Aggregated metrics are designed to reduce re-identification risk
• Organizations do not receive access to:
  • Your email content
  • Your personal tasks or family data
  • Your connected inbox information
  • Any individually identifiable information
• Note: While sender mappings and email fingerprints are maintained at the organization level, organizations cannot view, access, or export this data. It is used internally by Leto only.

Independence from organization partnerships

Connecting your email inbox is independent of any organization partnership. You can connect your inbox directly to Leto and specify which emails to process, regardless of whether an organization has partnered with Leto.

Marketing Emails

During signup, you can choose to receive occasional emails about product updates and new features.

• You control this — it's opt-in during registration
• If you request a High School Fit Score spreadsheet, we also subscribe you to our marketing list. We send Mailchimp your email address and the name of the page you came from — not your address, ZIP code, borough or questionnaire answers.
• You can unsubscribe anytime using the link at the bottom of any marketing email
• Unsubscribing won't affect important emails like billing confirmations or task notifications
• We never sell or share your email address with third parties for their marketing purposes

Deleting Your Data

Your tasks and your account

Your tasks come from your emails. You can't delete them one at a time, but deleting your account deletes them, except a task from an email an organization also sent to another family, which stays for that family.

Deleting Your Account

When you delete your account, we delete your personal data, including:

• Your personal information
• Extracted tasks, events, and Information, and the fingerprint recorded on each of your emails. An item an organization also sent to another family stays for that family, as its own.
• Your connection credentials and sync history

Data is removed from active systems within 30 days of your deletion request. Our database backups are kept for about one day, so deleted data leaves them within about a day.

Organization-level sender mappings and email fingerprints are retained as described in our Privacy Policy.

Third-party processors (such as Stripe) retain records as required by their policies and applicable law. Aggregated, anonymized metrics that cannot identify you may be retained for service improvement.

Google API Services Disclosure

When you connect your Gmail account to Leto, we access your email data through Google's APIs. Our use of this data is governed by Google's policies:

• Limited Use: Leto's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
• Purpose: We only use your Gmail data to identify which organizations send to you — including routing and list-identity headers such as List-ID and the message's signing domain, used to recognize the sending organization — and to extract tasks, events, and deadlines for your family calendar, and Information about your family's schools and organizations for your family's account.
• No Advertising: We never use your email data for advertising, and we never share it with advertisers or data brokers.
• AI Processing: Your email content, images, PDF attachments, and linked web page content are processed by Anthropic's Claude AI to extract tasks, events, and Information, under our data processing agreement. No other third party receives this email content. Web page content from linked newsletters is fetched directly by Leto's servers — no third-party scraping service is involved. The other services Leto uses, for other purposes, are listed in our Privacy Policy.
• Revoke Anytime: You can disconnect your Gmail account from Leto at any time in your account settings, or directly through Google's security settings.
• Direct Integration: Leto accesses your Gmail data directly through Google's APIs using our own Google Cloud Platform project. No third-party email middleware or intermediary processes your Gmail data.

What We Don't Do

• We do not store or process student grades, report cards, or sensitive educational records.
• We do not sell personal data, and we share it only with the services named in this policy and in our Privacy Policy, for the purposes described there.
• We do not allow outside advertisers or trackers.
• We do not use your email data for advertising or marketing purposes.
• We do not share your email data with data brokers or information resellers.
• We do not permanently store email body content, PDF attachments, images, or fetched web page content — all are deleted immediately after processing (or within 24 hours if processing fails).
• We do not send your data to any third-party web scraping service. Web page content from linked newsletters is fetched directly by Leto's servers.
• We do not read drafts or sent mail.

How Data Is Protected

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Access is limited to essential Leto team members only.
• PTA verification rosters (lists of parent emails for signup verification) are encrypted using AES-256-GCM before storage. The original uploaded file is not retained—only encrypted email data is stored for ongoing verification of new signups. Rosters from inactive organizations are automatically purged. This is separate from the connected email inbox feature, which has its own retention policy described above.
• Email Data Security: Sender email addresses are encrypted using AES-256-GCM encryption before storage. Email content is deleted immediately after processing.
• Secure Search: We use "blind indexing" to search encrypted data without decrypting it, adding an extra layer of protection.

Parent Control

• Families explicitly opt in to use Leto.
• Parents can opt out at any time; their data will be fully deleted within 30 days.
• PTAs act as initial gatekeepers for access—Leto never overrides their official roster.
• Email Connection Control: You can disconnect your email account at any time from your Leto settings. Disconnecting immediately stops all email processing and deletes your connection credentials.
• Data Deletion: When you disconnect your email, your extracted tasks, events, and Information remain in your account. Organization-level sender mappings and email fingerprints are retained as described in our Privacy Policy.
• Google Account Control: You can also revoke Leto's access directly through your Google Account security settings.

Data Ownership and Usage Rights

Raw Data Ownership

Leto does not claim ownership over content from users' connected email inboxes. This includes emails, attachments, and metadata accessed via inbox integrations. Users may disconnect their inboxes at any time; disconnecting deletes connection credentials and sync history. Organization-level sender mappings and email fingerprints are retained as described in our Privacy Policy.

Transformed Data Ownership

Leto retains intellectual property rights over the structured format and system-generated metadata of transformed data (including tasks, events, Information, sender mappings, and engagement metadata), not the underlying content. This applies solely when:

• (a) The original email was sent to a Leto inbox; or
• (b) The email was sent to a Leto-provided organization address via a PTA partnership.

Use of Transformed Data

Transformed data is used to provide and improve the Leto service. Tasks, events, and Information may be shared across verified accounts within a family to support coordination (e.g., both parents seeing the same signup task). No personal content is shared outside the family unit unless explicitly authorized.

Limitation on Private Emails

Leto does not process or retain direct one-on-one communications between families and organizations unless a user connects their inbox. Such content is treated as private and subject to deletion on request.

Requesting Deletion or Export

Families can request deletion or export of both raw and transformed data associated with their account at any time by contacting [email protected].

AI Processing Consent

By using email extraction features, you consent to the use of artificial intelligence (AI) to analyze email content, PDF attachments, images, and linked web page content to identify tasks, events, and Information, including visual analysis of images and documents. Leto uses Anthropic's Claude AI for this purpose under a binding data processing agreement.

Data Portability

Users may request an export of their extracted tasks, events, and Information together, along with sender mappings, in human-readable format (e.g., CSV or JSON). We do not retain or export raw email content after deletion.

Location & Compliance

• All data is securely stored on U.S.-based servers.
• Leto follows U.S. privacy laws and security standards, including encryption, access controls, and parent-first account management.
• Our practices are designed to support the needs of PTAs, organizations, and families.

Contact Information

Keith Harper
444 E 82nd St #17F
New York, New York 10028
Telephone: 206-351-4765
Email: [email protected]