Version 1.2 · effective September 5, 2026
Privacy Policy
Milata LLC (“we”), Irvine, California, operates milatalearning.com and provides online Russian-language instruction to families and to California charter schools. This policy explains what we collect, why, and your choices. It is written to satisfy the California Online Privacy Protection Act (CalOPPA), the Children’s Online Privacy Protection Act (COPPA), and California’s Student Online Personal Information Protection Act (SOPIPA).
What we collect
- From parents and guardians through our forms: your name, email, phone (optional), your school and your teacher’s name and email (charter families), your child’s first name and grade band, your message, and your preferred times. We do not ask for your child’s birthdate, health, or IEP information.
- From enrolled families, in the learning portal: which lessons your child has marked complete, any work your child hands in (typed answers and files they upload), and the written feedback our instructor returns on it. This is the only information we hold that your child themself produced. You can read and download all of it at any time, and you can ask us to delete it — see Retention and deletion.
- From schools in the course of vendor work: purchase orders, teacher contacts, and invoicing details.
- Automatically: the IP address and browser type sent with a form submission (kept as evidence of your consent), and cookie-less, aggregate site analytics (page views by path) from Cloudflare Web Analytics.
Children
Parents and guardians create every account and submit every form. We never collect information directly from children under 13, and children do not log in to any Milata LLC system. Class recordings are covered below and in the Child Safety & Online Classroom Policy.
Why we use it
To answer your request, schedule trials and classes, write progress reports for your school, invoice the school (or you, for private pay), keep records that schools and the law require, and improve the site. We do not sell personal information, do not use student information for targeted advertising, and do not build profiles of students for any purpose other than the educational service — the commitments SOPIPA requires of a K-12 online service.
Who processes it for us
- Cloudflare — hosting, DNS, content delivery, bot protection (Turnstile), and cookie-less analytics.
- Resend — sending our transactional email (confirmations, notifications).
- Stripe — processing card payments for tuition invoices. Card details are entered on Stripe’s own payment page and never reach our servers; we receive only the amount, the outcome, and the last four digits.
- Video-class platforms (Zoom or Google Meet) for live sessions.
- Google (YouTube) — where a lesson includes a video, it is hosted as an unlisted YouTube video. See Lesson videos below. We do not share personal information with anyone else except your school (for your student’s records and invoicing) or when the law requires.
Cookies
The public pages set no cookies at all and our analytics are cookie-less, so there is no cookie banner.
The parent portal at /portal — which you only reach by signing in — uses strictly necessary cookies. We set no advertising, tracking or profiling cookies anywhere on this site or in the portal, and we do not share any of them with anyone. The one piece of content we do not serve ourselves is lesson video, described next.
| Cookie | Purpose | How long |
|---|---|---|
milata_session | Keeps you signed in. | Until 30 days of inactivity, and at most 90 days. |
milata_csrf | Security: proves a form was submitted by you, from our site. | The browser session. |
milata_lang | Remembers whether you chose English or Russian. | One year. |
milata_oidc | Carries the sign-in handshake between our site and our login service. | 15 minutes. |
milata_oidc_retry | Prevents a sign-in loop if something goes wrong. | 5 minutes. |
milata_learner | Remembers which of your children the portal opens on. Never used to decide what you are allowed to see. | One year. |
Signing in also passes through our login service at auth.milatalearning.com, which sets its own strictly necessary cookies to keep that session.
Lesson videos
Where a lesson includes a video, it is an unlisted YouTube video — unlisted meaning it is not searchable and not listed on any channel, but anyone with the link can view it. YouTube is operated by Google, a company whose main business is advertising.
Nothing is sent to Google until you ask for it. The video does not load with the page. You see a play button, and only when you press it does your browser contact YouTube. If you never press it, Google receives nothing — no request, no cookie, no record that you opened the lesson.
When you do press play, we use YouTube’s youtube-nocookie.com player, which Google states does not set cookies for advertising purposes. Once the player loads, your browser is talking to Google and Google’s own privacy policy applies to that connection. We cannot see or control what it stores.
We do not embed any other third-party content anywhere on this site or in the portal.
If this changes, this policy and the site will be updated first.
Retention and deletion
Form submissions that do not lead to an enrollment are anonymised after 24 months. Records that schools and California law require us to keep — invoices, purchase orders, attendance, progress reports, and consents — are retained for five to seven years and are not deleted on request, although we will remove any personal information that is not needed for those records. To request deletion or a copy of your information, email hello@milatalearning.com; we respond within 30 days.
Your child’s own work, specifically. You can read and download it at any time, for as long as you have an account — it stays available to you even if you withdraw from a class or a term ends. If you ask us to delete it, we delete every file your child uploaded and every word they and our instructor wrote. What we keep is the structure: which lesson, that something was handed in, and when it was returned — with the words removed. We keep that for the same reason we keep attendance, and only that reason: a progress report we have already filed with your school is assembled from those records, and deleting them outright would silently empty a document already in the school’s hands.
Deleted information also remains in our encrypted nightly backups for up to 14 further days before those backups age out.
Security
Data is stored in systems with access limited to Milata LLC staff who need it, transmitted over HTTPS, and backed up in encrypted form.
Changes and contact
We will post changes here with a new version number and effective date; material changes are announced by email to enrolled families. Questions: hello@milatalearning.com.