Security Statement

Security Statement

Last updated: August 8, 2026

This Security Statement provides a high-level overview of how Learning-Focused protects information when delivering learningfocused.com, its Shopify-hosted online store, and Spark, our Thinkific-hosted professional learning platform, including the Spark Apps.

This statement is intended to support transparency for customers, educators, schools, districts, organizations, and partners. It is informational and should be read together with our:

This statement does not create a warranty, certification, or contractual security obligation beyond obligations established by applicable law or a written agreement signed by an authorized Learning-Focused representative.

1) Security Overview

Learning-Focused uses established third-party platforms to deliver the Services and follows a shared-responsibility approach to security. We seek to:

  • Collect and retain only information reasonably necessary to provide, secure, maintain, and support the Services and meet applicable legal obligations

  • Avoid unnecessary student information

  • Limit administrative access to authorized personnel with a business need

  • Use security capabilities provided by our hosting and service providers

  • Monitor relevant provider notices and security information

  • Respond to suspected and confirmed security incidents

The Services are designed primarily for adult educators, schools, districts, educational organizations, and customers purchasing Learning-Focused products or services.

No security program can eliminate every risk. Security depends on Learning-Focused, its providers, organizations that purchase or manage access, and individual users fulfilling their respective responsibilities.

2) Platform-Hosted Infrastructure

Learning-Focused does not operate its own physical data centers. The principal platforms supporting the Services include:

  • Shopify, which hosts learningfocused.com and the online store and supports website operation, customer accounts, carts, checkout, orders, commerce, and certain payments

  • Thinkific, which hosts Spark, including courses, memberships, professional learning resources, account access, and Spark App eligibility, and may process Spark purchases

  • Google Cloud Platform, which hosts the Spark API and related application services

  • OpenAI API, which processes relevant AI requests and generates responses for Spark Apps

  • Google Analytics and applicable measurement tools, which support website, search, and service-performance analysis

Other provider categories may support payment processing, fraud prevention, shipping and fulfillment, communications, customer service, tax and accounting, and professional services. Providers receive information only as applicable to the service or transaction they support.

Learning-Focused does not store full payment-card numbers. Payment-card information is handled by Shopify, Thinkific, and their payment partners, as applicable.

For the current provider list and a description of data flows, see:
https://learningfocused.com/pages/subprocessors

3) Data Minimization and Student Information

  • Spark and the Spark Apps are intended for adult educators and school- or district-authorized adult users.

  • Spark Apps do not provide student accounts and are not directed to children under 13.

  • Spark Apps are designed to function without student names, student identifiers, education records, or other student personal information.

  • Users and organizations must not submit or direct others to submit student personal information through Spark Apps.

  • Users must not submit passwords, payment-card information, Social Security numbers, medical information, or other prohibited sensitive information through Spark Apps.

  • Learning-Focused does not use Spark App inputs or outputs to train a generalized artificial intelligence model.

If prohibited student or sensitive information is submitted inadvertently, users should contact support@learningfocused.com so that Learning-Focused can investigate and take appropriate deletion or other remedial steps.

Unless Learning-Focused expressly agrees otherwise in a signed written agreement, the Services are not intended to receive or maintain education records or other student personal information on behalf of a school or district.

4) Encryption and Transmission Security

  • Connections to the Services are protected in transit using HTTPS/TLS as provided and configured through the applicable platforms.

  • Information stored by Shopify, Thinkific, Google Cloud Platform, OpenAI, and other applicable providers is protected at rest using provider-managed encryption where supported by the service.

  • Payment-card information is transmitted to and processed by the applicable payment provider rather than stored as a full payment-card number by Learning-Focused.

  • Provider-managed infrastructure controls, certificates, and encryption keys are operated by the applicable platform providers. Learning-Focused does not manage or access the providers' underlying raw encryption keys.

Encryption reduces risk but does not by itself prevent all unauthorized access or security incidents.

5) Identity and Access Management

  • Administrative access to provider platforms is limited to authorized Learning-Focused personnel and service providers with a legitimate business need.

  • Access is assigned according to role, job responsibility, and least-privilege principles.

  • Administrative authentication safeguards, including multi-factor authentication where supported and configured, are used to reduce unauthorized-access risk.

  • Access should be removed or adjusted when it is no longer required.

  • Users are responsible for maintaining the confidentiality of their credentials and for promptly reporting suspected unauthorized account access.

  • Schools, districts, and other organizations are responsible for authorizing appropriate users and requesting removal of access when a user is no longer eligible.

Learning-Focused does not currently offer single sign-on (SSO). This statement should be updated if SSO becomes available.

6) Website, Commerce, and Payment Security

Shopify and its supporting providers supply the principal infrastructure for website, store, cart, checkout, transaction, and payment security on learningfocused.com.

Learning-Focused relies on Shopify, Thinkific, and their payment partners to process payment-card information and payment authorization. Learning-Focused personnel may access order records, payment status, shipping information, refund information, and administrative reports needed to support transactions, but Learning-Focused does not store full payment-card numbers.

Fraud-prevention signals and transaction information may be processed by Shopify, Thinkific, payment providers, and other applicable commerce providers to detect, prevent, or investigate fraudulent or unauthorized activity.

7) Spark Application and AI Security

The typical Spark App request flow is:

  1. An authorized adult user opens a Spark App through Spark.

  2. The request is sent to the Spark API hosted on Google Cloud Platform.

  3. For an AI-assisted feature, relevant request content is transmitted to OpenAI through the OpenAI API.

  4. The generated response is returned through the Spark API to the user.

Spark Apps include instructions and safeguards designed to support appropriate use. Users are prohibited from bypassing safeguards, probing for unauthorized access, evading usage limits, submitting malicious content, or using Spark Apps for unlawful, harmful, or abusive purposes.

AI features are assistive and require human review. Spark App outputs may be inaccurate, incomplete, biased, or unsuitable for a particular context. They must not be used as the sole basis for decisions concerning student grades, discipline, eligibility, placement, special education, employment, teacher evaluation, or other consequential decisions concerning a person.

Learning-Focused does not opt in to use Spark App data to train or improve OpenAI models.

8) Logging, Monitoring, and Service Reliability

Learning-Focused and its providers may create and review technical, operational, diagnostic, usage, security, and error information needed to operate, troubleshoot, protect, and maintain the Services.

Learning-Focused reviews relevant platform-status notices, provider notifications, and security advisories. Providers are responsible for monitoring and protecting their underlying infrastructure under their respective agreements and practices.

Logs and diagnostic information are retained for limited periods appropriate to troubleshooting, fraud and abuse prevention, security, and service reliability, as described generally in our Privacy Policy.

9) Incident Response and Notification

Learning-Focused maintains procedures for receiving, evaluating, escalating, containing, and responding to suspected security incidents. Depending on the incident, response activities may include:

  • Coordinating with affected platform providers

  • Restricting or resetting access

  • Preserving relevant evidence

  • Investigating the scope and nature of the incident

  • Taking remediation steps

  • Evaluating legal, contractual, and notification obligations

If Learning-Focused becomes aware of a confirmed security incident that materially affects user data, we will take reasonable steps to contain and investigate the incident and notify affected customers without undue delay, consistent with applicable law and applicable written organizational agreements.

Notification timing and content may depend on the nature of the incident, the information involved, law-enforcement requests, provider investigations, and applicable legal or contractual requirements.

10) Provider Management and Shared Responsibility

Learning-Focused selects and uses providers to support hosting, commerce, learning-platform, application, AI, analytics, communications, fulfillment, and operational functions.

Each provider maintains and is responsible for its own infrastructure, personnel, security controls, availability, and service practices. Where appropriate to the relationship, Learning-Focused seeks contractual terms addressing confidentiality, security, permitted processing, and applicable data-protection obligations.

Learning-Focused monitors material changes to its providers and updates its provider and data-flow disclosures where appropriate or required.

11) Data Retention, Backup, and Deletion

Information is retained only for as long as reasonably necessary for the purpose for which it was collected, to provide and secure the Services, maintain accounts and user-requested content, complete transactions, meet legal and accounting requirements, resolve disputes, and enforce agreements.

  • Commerce, order, shipping, refund, tax, and accounting records are retained for applicable operational and legal periods.

  • Spark account, membership, enrollment, and user-saved information is retained while needed to provide the applicable account or feature and for limited administrative, legal, security, or dispute-resolution periods.

  • Operational, security, and diagnostic records are retained for limited periods appropriate to security, fraud prevention, troubleshooting, and reliability.

  • Deletion from active systems may not immediately remove information from encrypted backups. Backup copies are isolated from ordinary use and are removed or overwritten according to the applicable provider backup lifecycle.

Users and authorized organizations may request access, export, correction, or deletion as described in our Privacy Policy, subject to identity and authority verification and applicable legal or technical limitations.

12) Customer and User Responsibilities

Users and organizations should:

  • Use strong, unique passwords and keep credentials confidential

  • Use multi-factor authentication when it is available

  • Limit accounts and access to authorized users

  • Promptly remove or request removal of users who no longer need access

  • Keep contact, billing, and organizational information current

  • Use trusted devices, browsers, and networks and install relevant security updates

  • Avoid entering student personal information or other prohibited sensitive data into Spark Apps

  • Review AI-generated output before use

  • Report suspected unauthorized access, security concerns, or inadvertent prohibited-data submission promptly

Users must not test, scan, probe, bypass, or interfere with security controls without prior written authorization from Learning-Focused.

13) School, District, and Procurement Reviews

Schools, districts, and other organizations may contact Learning-Focused to request information reasonably needed for privacy, security, legal, or procurement review.

Where Learning-Focused and an organization enter into a written organizational agreement or data privacy addendum, that agreement may establish additional requirements concerning access, confidentiality, security incidents, providers and subprocessors, retention, deletion, and other safeguards.

Learning-Focused does not claim SOC 2, ISO 27001, or another independent security certification unless a current certification is expressly identified in writing by Learning-Focused.

14) Reporting Security Concerns

To report a suspected security issue, unauthorized account access, or inadvertent submission of prohibited information, contact:

support@learningfocused.com

Do not include passwords, full payment-card information, student personal information, or other unnecessary sensitive information in an ordinary email report. We may provide instructions for a more appropriate method of sharing information if needed to investigate.

15) Changes to This Statement

We may update this Security Statement as the Services, providers, security practices, or legal obligations change. We will post the updated statement and revise the "Last updated" date. Where required by law or an applicable organizational agreement, we will provide additional notice of material changes.

16) Contact

Questions about this Security Statement or security-related concerns may be directed to:

Learning-Focused
1070 Tunnel Road 10-292
Asheville, NC 28805, USA
Email: support@learningfocused.com