EducAIte Privacy Notice

1. Scope of this Privacy Notice

EducAIte handles personal information in different capacities depending on the context.

Student Data Processed on Behalf of Schools as a Processor

Schools and school districts (“Schools”) license the Service and provision accounts for their teachers and students. Students do not currently self-register for the Service.

EducAIte provides its AI platform to Schools as a service provider and data processor, and each School acts as the data controller and determines the scope, purpose, and legal basis for collecting and using student data. EducAIte handles this information in accordance with its agreement with the School, including any applicable data privacy agreement (“DPA”), the Family Educational Rights and Privacy Act (“FERPA”), the Children’s Online Privacy Protection Act (“COPPA”), applicable state student privacy laws, and other applicable law.

If the terms of this Privacy Notice conflict with a DPA or other written agreement governing student and staff information, the applicable agreement will control with respect to that student and staff information.

Information EducAIte Collects for Its Own Business Purposes as a Controller

EducAIte acts as a data controller for personal information collected directly in connection with its public website, communications, newsletters, demo requests, customer and prospect relationships, and operation of its business. EducAIte determines the purposes for which this information is used, as described in this Privacy Notice.

2. Personal Information We Collect

Depending on how you interact with EducAIte, we may collect the following categories of information.

Student and Staff Information as a Processor

When acting as a data processor on behalf of a School, EducAIte processes student and faculty information strictly as directed and authorized by the School. This information may include:

• First and last name or other identifier;
• Grade level;
• Class or section assignment;
• Role or job title;
• School and district affiliation;
• School or business email address;
• Grade levels and subject areas;
• Prompts and messages submitted through the Service;
• Responses and other content generated through use of the Service;
• Account and authentication information;
• Usage and engagement information, such as session duration, topics engaged, and interactions with the Service; and
• Other information provided by the School that is reasonably necessary to provide the Service.

The Service includes unstructured fields (such as prompts, messages, and custom inputs) where users may submit free-form text. EducAIte does not request or require personal information in these fields and employs technical safeguards designed to discourage and mitigate the submission of unprompted personal data.

Website Visitors, Prospects, and Other Business Contacts as a Controller

When acting as a controller, EducAIte may collect the following when you visit our website, request information, schedule a demonstration, subscribe to communications, or otherwise contact us:

• Name;
• Email address;
• Telephone number, if provided;
• School, district, company, or organization;
• Job title or role;
• Information submitted through forms or communications with us;
• Demo or meeting scheduling information; and
• Newsletter and marketing preferences.

Automatically Collected Information

When you access our website or Service, we may automatically collect certain technical information, including:

• IP address;
• Browser type and version;
• Device information;
• Operating system;
• Pages or features accessed;
• Date and time of access;
• Session identifiers;
• Usage information; and
• Other diagnostic and security information.

We use this information to operate, secure, maintain, and understand use of our website and Service.

Google Sign In: If your School enables Sign in with Google, we receive from Google only your email address and a Google account identifier, which we use solely to sign you in. We store only a one-way hash of that identifier and do not use or share Google user data for any other purpose.

3. Sources of Personal Information

We may collect personal information from different sources depending on our role:

Information Processed on Behalf of Schools as a Processor

• From Schools and school districts;
• From teachers, administrators, and other authorized School personnel;
• Through your use of our website and Service;
• From School-authorized integrations and data sources; and
• Student roster information may be provided directly by a School or, as integrations become available, through School-authorized student and staff information systems, single sign-on providers, or other educational technology platforms.

Information Processed as a Controller

• Directly from you;
• Automatically through cookies, analytics technologies, and similar technologies;
• From service providers that assist us in operating our business; and
• From other sources where permitted by applicable law.

4. How We Use Personal Information

We use personal information as appropriate to the context in which it was collected.

Student and School Information as a Processor

EducAIte processes student and staff personal information solely to provide the Service under the direct instruction of the School. We process personal information to:

• Provide and operate the Service;
• Provide AI-assisted educational functionality and Socratic learning tools;
• Generate teacher- and administrator-facing learning trends and insights;
• Authenticate users and maintain accounts;
• Provide School-authorized reporting and analytics;
• Maintain security and prevent misuse;
• Troubleshoot technical issues;
• Respond to School-authorized support requests;
• Comply with our contractual obligations to Schools;
• Comply with applicable law; and
• Protect the safety, security, and integrity of the Service and its users.

Website Visitors, Prospects, and Business Contacts as a Controller

We use personal information collected from website visitors, prospects, and business contacts for our own business operations, including:

• To analyze website use;
• Manage customer and prospect relationships;
• Respond to support requests;
• To send administrative updates regarding your account, and communications concerning changes to our Terms of Service or Privacy Notice;
• To satisfy applicable legal obligations, respond to valid legal processes (such as subpoenas or court orders), and protect our legal rights, safety, and property;
• Send marketing communications where permitted by law or with consent (you may opt out at any time by using the unsubscribe link included in the communication or by contacting us); and
• Support our general business operations.

We do not send marketing communications to students, nor do we use student data for marketing purposes. When a School provisions an account for a teacher or administrator to access the Service, EducAIte, acting as a controller, may use that individual’s business contact information to send our newsletter and other marketing communications about EducAIte. Provisioning of a teacher or administrator account automatically enrolls that individual to receive these communications; recipients may opt out at any time by using the unsubscribe link included in each communication or by contacting us.

Aggregated and De-Identified Information

EducAIte may create and use aggregated, anonymized, or de-identified information derived from the use of our services that does not constitute personal information.

Subject to applicable law and our DPAs with Schools, EducAIte may use aggregated or de-identified information for purposes such as:

• Analyzing use of the Service;
• Evaluating performance and educational trends;
• Improving and developing the Service;
• Developing new features;
• Product analytics;
• Preparing aggregated reports and insights; and
• Supporting business, research, funding, or partnership activities where individuals are not identified.

Where we process de-identified information, EducAIte commits to: (1) maintain and use the information solely in de-identified form; (2) not attempt to re-identify the information, except as permitted or required by applicable law; and (3) contractually obligate any third-party recipients of such data to comply with these obligations.

Where a School has separately authorized School-level or student-level analysis, EducAIte may perform that analysis in accordance with the School’s instructions and applicable agreement.

5. How We Disclose Personal Information

Depending on whether we are acting as a data processor for a School or as a data controller for our business, we may disclose personal information as described in this Section.

As a Processor

• To Schools. Teachers and authorized administrators may access student and staff information, learning trends, reports, and other information relating to students within their School as authorized by the School.
• At the Direction of a School. We may disclose student and staff information where instructed or authorized by the School and permitted by applicable law.
• Subprocessors and AI Infrastructure. We may disclose information to service providers that perform services on our behalf, including hosting, infrastructure, AI processing, security, and technical support.
  • AI Processing: Google Cloud Vertex AI, using Gemini models, is EducAIte’s primary underlying AI provider. Student prompts and EducAIte’s instructional or safety-related prompts may be transmitted to Vertex AI as necessary to generate responses. EducAIte uses commercial or enterprise AI services and configurations intended to prevent information submitted through EducAIte from being used to train third-party foundation models. A School may elect to use its own API credentials for another supported AI provider, such as Anthropic, OpenAI, or Microsoft Azure OpenAI, which is governed by the School’s agreement with that provider.
• Educational and School-Authorized Integrations. When authorized and configured by a School, we share or sync information with third-party educational platforms (such as LMS, SIS, or SSO providers) solely to deliver and support the Service.
• For Safety Purposes. The Service includes safeguards relating to certain sensitive or potentially harmful student interactions. Where a student’s use of the Service triggers a School-configured safety alert involving potential harm to the student, another person, or property, information relating to the alert may be made available to authorized School personnel for review and response.

As a Controller

• To Business Service Providers. We may disclose website visitor, prospect, and customer information to service providers assisting with website analytics (Google Analytics), meeting scheduling (Calendly), and accounting or payment processing (QuickBooks).

General Disclosures as Both Roles

In addition to the foregoing, EducAIte may disclose personal information in connection with:

• Business Transactions. If EducAIte is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its business or assets, information may be disclosed or transferred as part of that transaction, subject to applicable legal and contractual restrictions regarding student and staff information.
• Legal Obligations. We may disclose personal information where required by law, valid legal process, or binding regulatory order, or when necessary to protect the safety, rights, or security of EducAIte, our users, Schools, or the public.

Sale and Sharing Restrictions of Personal Information

EducAIte does not sell personal information, nor do we share or disclose personal information for cross-context behavioral advertising or targeted advertising. As used in this section, the terms “sell,” “share,” “cross-context behavioral advertising,” and “targeted advertising” have the meanings assigned to them under applicable state and federal privacy laws.

6. Children’s Privacy and COPPA

The Service is designed for use in K-12 educational settings, and students using the Service may be under the age of 13. Where COPPA applies, EducAIte relies on the licensing School to provide consent on behalf of parents for the collection and use of student personal information within the educational context.

We collect and process student information solely to provide and support the educational Service authorized by the School. We do not condition participation on providing unnecessary data, sell children’s personal information, use it for targeted advertising, or build commercial profiles.

7. Family Educational Rights and Privacy Act (“FERPA”) and State Student Privacy Laws

When EducAIte provides its platform to K-12 schools, we act strictly as a data processor or “school official” under FERPA (or analogous term under applicable laws) under applicable federal and state student privacy laws. We process student information solely under the direct instruction of the School. We do not sell or rent student data, use student data for targeted advertising, or build student profiles for commercial purposes outside authorized school uses. Student accounts are provisioned and managed directly by the School. Specific operational controls, security commitments, and state-specific statutory obligations are governed by our agreement and DPA with each School.

8. Data Retention and Deletion

EducAIte retains personal information only for as long as reasonably necessary for the purposes for which it was collected, as required or permitted by applicable law, to resolve disputes, and as provided in its agreements with Schools. If personal information needs to be retained longer for legal reasons or contractual obligations, we will do so in accordance with applicable laws. Once personal information is no longer required, it will be securely deleted or anonymized.

Aggregated or de-identified information that no longer reasonably identifies an individual may be retained as permitted by applicable law and contract.

9. Data Security

EducAIte maintains reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, destruction, loss, alteration, use, or disclosure.

These safeguards currently include measures such as:

• Encryption of information in transit using HTTPS;
• Authentication and access controls;
• Credential management through AWS Secrets Manager;
• Database access controls;
• Row-level security;
• Logging and monitoring;
• Restricted access to identifiable student and staff information; and
• Cybersecurity insurance.

No method of transmission over the Internet or method of electronic storage is completely secure. Accordingly, although EducAIte takes reasonable steps to protect personal information, we cannot guarantee absolute security. Transmission of any personal information is at your own risk.

10. Cookies and Analytics Technologies

EducAIte uses cookies and similar technologies in connection with its website and Service.

Some cookies are necessary for authentication, security, and core functionality. On our public marketing website, we also use limited analytics technologies, including Google Analytics and Google Tags (configured for analytics purposes only), to understand how visitors use our website and to improve our website and services.

EducAIte does not use student or staff information or activity within the educational Service for behavioral advertising.

The Service through which students, teachers, and administrators access EducAIte’s educational platform is separate from our public marketing website and requires a password-protected account to access. Only cookies that are strictly necessary for authentication, security, and core functionality are used within the Service; EducAIte does not deploy non-essential, analytics, or marketing cookies within the authenticated Service.

EducAIte provides a cookie banner on our public website that allows visitors to accept, reject, or manage non-essential cookies and similar technologies. You may access your cookie preferences at any time by using the “Your Privacy Choices” link located in the footer of our website. Browser-based privacy signals, including Global Privacy Control signals, will be recognized where required by applicable law. EducAIte does not currently respond to “Do Not Track” browser signals where no legal standard requires such response.

11. Your Privacy Rights

Depending on where you reside, applicable law may provide certain rights regarding your personal information. These may include the right to:

• Right to Know: Request confirmation that personal information is being processed, access to personal information, and obtain information regarding how it is collected, used, or disclosed.
• Right to Data Portability: Request a copy of personal information in a portable, readily usable format to transfer to another entity.
• Right to Correct: Request correction of inaccurate or incomplete personal information.
• Right to Deletion: Request deletion of personal information.
• Right to Opt Out: Opt out of targeted advertising, profiling, or the sale and sharing of personal information. EducAIte does not sell or share personal information, conduct targeted advertising, or engage in profiling.
• Right to Limit Use of Sensitive Personal Information: Request to restrict the use and disclosure of sensitive data strictly to necessary service operations. EducAIte does not collect or process sensitive personal information.
• Right to Non-Discrimination: Exercise your privacy rights without receiving discriminatory treatment.
• Request Appeal: Request an internal review or appeal if a privacy right request is denied or not acted upon within required statutory deadlines.

For student or staff information processed on behalf of a School, parents, guardians, and eligible students must submit requests through the applicable School.

For personal information EducAIte collects directly from adult website visitors, prospects, customers, and other business contacts, requests may be submitted to privacy@educaitelearning.com. EducAIte may need to verify your identity before processing a request.

12. International Transfers and Geographic Restrictions

Our Service is intended solely for individuals located within the United States. We do not target or knowingly collect personal information from individuals located outside of the United States. If you are located in another jurisdiction, please do not use our Service or provide us with any personal information. By accessing our Service, you represent that you are a resident of the United States.

13. Sensitive Personal Information

EducAIte does not intentionally collect, store, or process “sensitive personal information” (as defined under applicable U.S. state privacy laws) through our public websites, marketing channels, or user account management.

To the extent any sensitive personal information or student records are processed through the EducAIte platform on behalf of a School, EducAIte acts strictly as a data processor, and such data is governed exclusively by our agreement and DPA with the School.

14. Third-Party Links and Services

Our website or Service may contain links to websites, services, or resources operated by third parties.

EducAIte does not control the privacy practices of third-party websites or services that are not provided on EducAIte’s behalf. We are not responsible for the personal information on these third-party websites or services. By providing these links, we do not imply that we endorse or have reviewed these sites. Use of these third-party websites or services, including transmitting your personal information to them, is at your own risk. The personal information that you share with third-party websites or services will be governed by the specific privacy policies and terms of service of those respective platforms, and not by this Privacy Notice. We encourage you to review the privacy notices of third parties before providing personal information to them.

15. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our Service, business practices, technology, or legal requirements.

When we make changes, we will update the “Last Updated” date at the top of this Notice. Where required by applicable law, we will provide additional notice of material changes affecting personal information.