At SchoolAI, we are committed to protecting the privacy and security of our users’ information, especially that of students and educators. This COPPA Notice explains how SchoolAI (“SchoolAI”, “Platform”, “Service”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information of children under 13 in the United States who use our Product through their Institution.
A Child may only use our Product through an Institution. The Institution is in charge of that child’s personal information. Under U.S. privacy law the Institution is the “controller” of the information and we act as a “processor” on the Institution’s behalf. What we may do with the information is governed by our agreement with the Institution.
Each Institution may also have its own privacy policy. That policy — together with our agreement with the Institution — controls how personal information is collected, used, and shared, including any rights you may have to access, correct, or delete it.
If you send a request to us about personal information we process for an Institution, we can’t act on it directly. We will forward your request to the Institution, or follow the process we’ve agreed with them, so the Institution can respond.
If you are located outside the United States, please visit our privacy notices page in our Trust & Safety Hub to learn more about our privacy practices.
Capitalized terms have the meanings given below.
- “Child” and “Children” mean a user, or users, of the Product in the United States who are under the age of 13.
- “Child Account” means the Authorized User (defined in the Terms of Service) account, made available through an Educator, through which a Child accesses and uses the Product.
- “Educator” and “Educators” mean an individual, or individuals, authorized to act on behalf of the Institution contracting with SchoolAI for use of the Product.
- “Institution” has the meaning given in our Terms of Service; for convenience, it refers to the school, district, or other educational organization that provides the Product to your Child.
- “Parent” means a legal guardian of a Child.
- “Personal Information” means individually identifiable information about a Child that is collected online, and includes the categories enumerated in the Children’s Online Privacy Protection Rule (16 C.F.R. § 312.2). For convenience, that means:
- first and last name;
- a home or other physical address including street name and name of a city or town;
- online contact information (such as an email address, instant messaging user identifier, VoIP identifier, or video chat user identifier);
- a screen or user name that functions as online contact information;
- a telephone number;
- a Social Security Number;
- a persistent identifier that can be used to recognize a user over time and across different websites or online services (such as a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or a unique device identifier);
- a photograph, video, or audio file that contains a Child’s image or voice;
- geolocation information sufficient to identify street name and name of a city or town;
- a biometric identifier that can be used for the automated or semi-automated recognition of an individual (including a fingerprint or handprint, retina or iris pattern, genetic data including a DNA sequence, or a voiceprint, gait, or facial template);
- a government-issued identifier; and
- information concerning the Child or the Child’s Parents that we collect online from the Child and combine with one of the identifiers listed above.
“Personal Information” also includes any other information about a Child that can reasonably be used, alone or in combination with other reasonably available information, to identify, locate, or contact a specific Child.
- “Products” means the educational software products, websites, mobile applications, and any other online interactive features or services that collect Personal Information from Children and that SchoolAI provides to Institutions under a Terms of Service agreement. Our Terms of Service is available on schoolai.com — see the “Terms of Use” section.
A Child may only use the Products with prior consent — either from a Parent, or from an Institution acting on behalf of the Child’s Parent under the “school-as-agent” model permitted by COPPA. We will not collect, use, or disclose Personal Information from a Child without that consent. An Institution provides this consent by agreeing to use or purchase the Products on behalf of its Children.
Scope of Institution consent. An Institution’s consent under the school-as-agent model authorizes us to collect, use, and disclose Personal Information from Children solely for school-authorized educational purposes — that is, for the use and benefit of the Institution and the educational experience of its Children. It does not authorize us to use Children’s Personal Information for any other commercial purpose, including:
- targeted advertising to Children;
- building user profiles for purposes unrelated to the Institution’s educational use of the Products;
- selling, renting, licensing, or otherwise disclosing Personal Information to third parties for those parties’ own commercial purposes; or
- training artificial intelligence or machine-learning models for any use outside the direct educational features of the Products.
If we want to use a Child’s Personal Information for any purpose beyond this school-authorized educational scope, we will obtain separate verifiable parental consent in advance.
Limits on collection and retention. We collect only the Personal Information that is reasonably necessary for a Child to participate in the Products, and we will not condition a Child’s participation in the Products on the disclosure of more Personal Information than is reasonably necessary for that participation. We retain Personal Information only for as long as is reasonably necessary to fulfill the educational purpose for which it was collected, after which we delete or de-identify it in accordance with our written data retention policy. Our written data retention policy is published in our Trust Center at trust.schoolai.com.
Institution and Parent rights. An Institution, or a Parent acting through the Institution, may at any time:
- review the Personal Information we have collected from a Child;
- refuse to permit our further collection, use, or disclosure of that information; and
- request that we delete that information from our systems.
If consent is missing. If we learn that a Child’s Personal Information has been collected through the Products without the appropriate consent of the Child’s Institution or Parent, we will take appropriate steps to delete the information. If you are a Parent or Institution and discover that your Child — or a Child who is your student — has a registered account with the Products without an Institution’s or Parent’s consent, please contact the Child’s Institution and ask the Institution to request that we delete that Child’s Personal Information from our systems.
SchoolAI collects only the Personal Information from a Child that is reasonably necessary for the Child to use the Products for purposes authorized by an Institution. We do not collect more than that. We collect Personal Information from Children in three ways: information provided directly by an Institution, an Educator, or a Child; information generated as a Child uses the Product; and information collected automatically through standard internet technologies.
Information provided by an Institution, an Educator, or a Child. When an Institution creates a Child Account (or a Child signs in through an Institution’s third party single sign-on), or when a Child joins a Space Session (lesson) using the unique code provided by an Educator, we receive the Personal Information needed to set up and use the account, which may include:
- First and last name;
- Email address; and
- The Child’s Institution, and where provided, grade level or class assignment.
If a Child signs in through an Institution’s third-party single sign-on integration, we may receive additional Personal Information from that SSO provider, as described immediately below.
Sign-in through Institution’s Identity Provider. If a Child signs in to the Products through an Institution’s Identity Provider single sign-on integration (“SSO Provider”), the Institution has authorized SchoolAI to receive certain Personal Information about the Child from SSO Provider through SSO Provider’s application programming interface (“API”). The information we receive from SSO Provider is limited to what the Institution has configured to be shared and what is reasonably necessary for the Child to access and use the Product, and may include:
- First and last name;
- Email address;
- The Child’s SSO Provider username and unique SSO Provider identifier;
- The access token used to authenticate the SSO Provider session;
- The Child’s Institution, grade level, and class or section assignments; and
- A profile picture, where the Institution has elected to share one.
We use this information solely for the purpose described in this Notice and in our Agreement with the Institution. We do not request fields from the SSO Provider that are not necessary for the Products to function.
Google User Data. Where the Institution uses Google (for example, Google Workspace for Education), a Child sees a Google permission prompt in only three places: signing in with Google (we receive the Child’s name, email address, profile picture, and Google account identifier); joining a SchoolAI Space from a Google Classroom assignment (we receive the Child’s own submission and class enrollment, used only to confirm the Child is assigned to the Space, match the Child’s Classroom and SchoolAI accounts, and mark the Child’s own work as turned in, never classmates’ work); and uploading a file from, or saving a presentation to, Google Drive (only files the Child picks or that SchoolAI creates for the Child). When an Educator uses SchoolAI’s Google Classroom integration or browser extension, we may also receive the Child’s name, email address, profile picture, class membership, assignment submissions, and the text of a Google Doc containing the Child’s work that the Educator asks SchoolAI to review, used only to help the Educator give feedback. We do not use this information to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models, and we otherwise handle it as described in this Notice.
SchoolAI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Section 13.3 (Google SSO and Integration) of our Platform Privacy Notice & Data Protection Addendum provides more detail.
Information generated through use of the Product. Once a Child Account is created and/or otherwise accesses and uses the Product, we collect data generated by that use including:
- The Child’s interactions with the artificial-intelligence features of that Product, including prompts, responses, and chat history;
- The Child’s responses to checks for understanding, assessments, and other activities within a Space Session;
- Progress, completion, and performance data associated with the Child Account;
- Voice and audio recordings, where the Child uses the voice-enabled features. We send these recordings to our speech-to-text service provider, OpenAI, solely to convert the speech to text so the relevant feature can respond to the Child. We do not use voice or audio to identify the Child or to create a voiceprint or other biometric template. Audio is deleted in accordance with our data retention policy; We may also capture a Child’s voice and statements where an Authorized User (such as a teacher or administrator) initiates the AI Notetaker feature during a session in which the Child participates. In that case, the captured audio is transmitted to Deepgram solely to produce a written transcript and summary for the Authorized User and the Institution, the audio is deleted after transcription (within 30 days), and the resulting transcript and summary are processed on the Institution’s behalf, treated as Education Records under FERPA to the extent applicable, and are not used to identify the Child, to create a voiceprint or other biometric identifier, or to train any artificial intelligence or machine-learning model for any purpose outside the direct educational features of the Product. The Product displays a visible in-product indicator while the Notetaker is active so that participants are aware a session is being recorded for note-taking purposes;
- Images, video, audio recordings, and files that a Child uploads to or creates within the Products in the course of a learning activity, or that an Educator provides to the Products for review (for example, a Child’s assignment submissions or written work in Google Docs or Google Classroom), including any Personal Information contained in those files; and
- Session logs and timestamps.
Information collected automatically. When a Child uses the Product, we and our service providers may automatically collect certain technical information, including:
- A persistent identifier (such as a device identifier, browser cookie, or Internet protocol (IP) address) used to recognize the Child Account over time and across sessions, solely for the internal operation of the Products and for purposes authorized by the Institution. Internal operations include maintaining and analyzing the functioning of the Product, authenticating users, ensuring security and integrity, protecting against fraud, performing network communications, and complying with legal obligations. We do not place third-party marketing or advertising cookies, tags, or trackers on the Child-facing portions of the Products;
- Device type, operating system, and browser information;
- Approximate geolocation derived from the IP address (not precise enough to identify a street name or town); and
- Log data, including access times and feature usage.
We do not knowingly collect Personal Information from a Child beyond what is described in this section. If we change the categories of Personal Information we collect, or the way we use them, in any material respect, we will obtain new consent before doing so.
We use Personal Information from Children only for the purposes described below, and only within the school-authorized educational scope set out above in the Section titled: How does a Child access and use the Product?
- To Deliver the Product. We use Personal Information to create Child Accounts, allow Children to access and use the Product, deliver the features that Children and Educators select, customize a Child’s educational experience within the Product, evaluate usage patterns for the operation of the Product, and communicate with Children regarding the Product, through the functionality of the Product.
- To maintain and improve the Product. We use Personal Information to monitor the Products for performance and security issues, to fix bugs, and to improve features that are part of the Product’s direct educational use by Children and Educators. We do not use Personal Information from Children to train artificial intelligence or machine learning models, including any third party or general purpose foundation model, for any use outside of the direct educational features of the Product.
- To Create De-Identified Data. We may de-identify Personal Information so that it can no longer reasonably be used, alone or in combination with other reasonably available information, to identify a Child. We use and share de-identified data only for lawful business purposes – including aggregate reporting, research on the educational effectiveness of the Product, and the development of educational features and Product. When we share de-identified data with a third party, we (i) publicly commit not to re-identify the data and (ii) contractually require the recipient to make the same commitment consistent with the de-identification standard at 16 C.F.R. §312.2.
- For Compliance, Fraud Prevention, and Safety. We may use Personal Information as we believe necessary or appropriate to (i) enforce our Terms of Service; (ii) protect the rights, privacy, safety, or property of SchoolAI, the Institution, a Child, you, or others; and (iii) protect against, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity affecting the Product.
- To Comply with Law. We may use Personal Information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal processes, including responding to subpoenas, court orders, or requests from governmental authorities, and limited to what those laws and processes require.
- With Consent. We may use Personal Information for purposes not listed in this Notice only with the prior written consent of the Institution (where the use is within the school-authorized educational scope) or with verifiable parental consent (where the use is outside that scope).
We do not:
- Use Children’s Personal Information for targeted advertising or to build profiles for non-educational commercial purposes;
- Sell, rent, or license Children’s Personal Information; or
- Use Children’s Personal Information to train artificial intelligence or machine learning models for any purpose outside the direct educational features of the Product.
Because Child Accounts and access to the Products are authorized and provided by the Child’s Institution, the Institution –not SchoolAI– controls the Personal Information that the Products collects, maintains, and uses about each Child. SchoolAI acts as a processor on the Institution’s behalf and cannot delete, modify, or disclose a Child’s Personal Information without the Institution’s authorization.
As a Parent, you have the right to:
- Review the Personal Information SchoolAI holds about your Child;
- Request correction of inaccurate Personal Information about your Child;
- Refuse to permit our further collection or use of your Child’s Personal Information; and
- Request deletion of your Child’s Personal Information.
How to exercise these rights. Please contact your Child’s Institution. The Institution can review your request, respond directly, and – where action by SchoolAI is required – instruct us to act. This routing reflects the Institution’s role as the controller of the Child’s Personal Information under the school-as-agent model permitted by COPPA, and it is consistent with the Institution’s responsibilities under FERPA and applicable state student-privacy laws.
If you contact SchoolAI directly. You may also contact us at privacy@schoolai.com. We will acknowledge your message and forward it to your Child’s Institution (or follow the procedure we have agreed on with the Institution) so the Institution can respond. We will support the Institution in fulfilling any authorized request promptly. Contacting us does not replace contacting the Institution, and may not shorten the response timeline, but we will use reasonable efforts to help reach a timely resolution.
A Child’s Personal Information is never made available or visible to the general public through the Product. Visibility within the Products is limited as follows:
- Other Children. A Child’s Personal Information is not made visible to other Children using the Product. Space Sessions do not involve Child-to-Child collaboration or shared visibility of Personal Information; each Child interacts with the Products independently.
- Educators. The Personal Information visible to an Educator depends on the controls configured by the administrator of the Institution’s account. Subject to those controls, Educators may be able to view a Child’s name, account information, interactions with the AI features of the Product, responses to checks for understanding, assessments, progress and performance data, and other content the Child creates within the Space Session.
- Institution-designated Administrators. Administrators designated by the Institution may be able to view Personal Information associated with Child Accounts under the Institution’s contract, in accordance with the Institution’s policies and controls.
- SchoolAI Personnel. Personal Information is accessible to a limited number of authorized SchoolAI personnel, on a need-to-know basis, and only in connection with operating, supporting, and securing the Product.
- Sub-Processors. Certain third-party service providers process Personal Information on our behalf in the course of delivering the Product. A current list of our sub-processors — including the purpose for which each receives Personal Information — is published in our Trust Center at trust.schoolai.com. Each sub-processor is bound by a written agreement that restricts its use of Personal Information to the services it provides to us and prohibits it from using Children’s Personal Information for its own purposes.
- Parents. A Parent’s ability to view Personal Information about their Child is managed through the Institution, as outlined above.
We share Children’s Personal Information only in the limited circumstances described below, and only as permitted by our agreement with the Institution and applicable law.
- With the Institution and its Educators. We share Personal Information about a Child with the Child’s Institution and with their Educators authorized by the Institution to use the Products with the Child, in accordance with our Terms of Service agreement with the Institution. The Institution is responsible for its Educators’ handling of Personal Information; if you are a Parent and have questions about how a specific Educator uses Personal Information, please contact the Institution.
- With Sub-Processors that help us deliver the Product. We share Personal Information with third-party sub-processors that perform services on our behalf — for example, cloud hosting, information technology, customer support, data security, and operational analytics for the Product. A current list of our sub-processors, including the purpose for which each receives Personal Information, is published in our Trust Center at trust.schoolai.com. Each sub-processor is bound by a written agreement that restricts its use of Personal Information to the services it provides to us and prohibits any other use.
- For research the Institution directs. With the Institution’s prior written authorization, we may share Personal Information with researchers the Institution identifies, for educational research the Institution determines benefits its students or its educational mission — for example, a district analyzing its students’ engagement with a specific feature. The Institution acts as the controller of any such research. We share Personal Information only under a written agreement that restricts use of the data to the authorized research purpose and prohibits any other use.
- For research with third-party academic partners. With the Institution’s authorization, we may collaborate with external academic researchers to study the use and educational effectiveness of the Product. For these collaborations, we share only pseudonymized data — that is, data from which direct identifiers (such as a Child’s name and email address) have been removed and replaced with non-identifying tokens that we maintain separately. Pseudonymized data remains Personal Information under applicable law; we share it only under a written research agreement that (i) limits use to the agreed research purpose, (ii) prohibits any attempt to re-identify the data or to combine it with other data sources for the purpose of identifying individuals, and (iii) prohibits onward disclosure of the data.
- To Comply with law and respond to legal processes. We may disclose Personal Information where we believe in good faith that disclosure is required to comply with applicable law, a subpoena, a court order, or another lawful request from a governmental authority, and limited to what those laws or processes require. Where permitted, we will provide notice to the Institution before disclosing Personal Information in response to legal processes.
- To protect rights, safety, and security. We may disclose Personal Information where we believe in good faith that disclosure is necessary to (i) protect the rights, privacy, safety, or property of SchoolAI, the Institution, a Child, you, or others; (ii) investigate or respond to fraudulent, harmful, or unauthorized activity affecting the Product; or (iii) enforce our Terms of Service.
- For business transitions. If SchoolAI is involved in a merger, acquisition, financing, sale of assets, bankruptcy, or other similar corporate transaction (including the due-diligence phase of any such transaction), Personal Information may be transferred to the acquiring or successor entity. We will require the successor entity to handle the Personal Information consistent with this Notice and our agreement with the Institution, and we will notify the Institution of any such transfer.
- With Affiliates. We may share Personal Information with a parent entity, subsidiary, or affiliate of SchoolAI that is bound by privacy commitments at least as protective as those in this Notice and our agreement with the Institution, and only as necessary to operate the Product.
- With Consent. We may share Personal Information for purposes not listed above only with the prior written consent of the Institution (where the sharing is within the school-authorized educational scope) or with verifiable parental consent (where the sharing is outside that scope).
We do not sell Children’s Personal Information.
We do not share Children’s Personal Information for targeted advertising.
We do not share Children’s Personal Information with third parties for those parties’ own marketing or commercial purposes.
Some content displayed in the Products may be hosted by third parties, and the Products may link to third-party websites. SchoolAI does not control those third parties, their websites, or their data practices, and we are not responsible for them. Their handling of Personal Information is governed by their own privacy policies. SchoolAI-provided content that appears on websites SchoolAI does not control is similarly outside the scope of this Notice.
This supplement adds disclosures required by certain state student-privacy laws. To the extent any provision in this supplement differs from the rest of the Notice, the supplement controls for Children using the Products through an Institution located in the relevant state.
California — Student Online Personal Information Protection Act (SOPIPA) and AB 1584.
For Children using the Products through an Institution in California, SchoolAI confirms that:
- we do not engage in targeted advertising directed at Children based on information acquired through their use of the Product;
- we do not create a profile about a Child except in furtherance of K-12 school purposes authorized by the Institution;
- we do not sell, rent, or trade Children’s Personal Information;
- we will delete Children’s Personal Information upon the Institution’s request;
- we maintain reasonable security procedures and practices appropriate to the nature of the Personal Information, including administrative, physical, and technical safeguards designed to protect against unauthorized access, destruction, use, modification, or disclosure of Personal Information; and
- we enter into a written agreement with each California Institution that addresses the matters required by California Education Code § 49073.1 (AB 1584).
Illinois — Student Online Personal Protection Act (SOPPA), 105 ILCS 85.
For Children using the Products through an Institution in Illinois, SchoolAI confirms that:
- our agreement with the Institution complies with the contractual requirements of SOPPA;
- we will not use Children’s Personal Information other than for the K-12 school purposes authorized by the Institution, or as otherwise expressly permitted by SOPPA;
- we will not sell, rent, or trade Children’s Personal Information, and we will not engage in targeted advertising based on Personal Information collected through the Product;
- the categories of Personal Information we collect, how we use it, and the third parties with whom we share it are described in this Notice;
- a Parent or guardian may inspect, review, correct, or request the deletion of the Child’s Personal Information by contacting the Institution; and
- in the event of a breach affecting a Child’s Personal Information, we will notify the Institution within the timeframe required by SOPPA so the Institution can notify affected Parents.
New York — Education Law § 2-d and the Parents’ Bill of Rights for Data Privacy and Security.
For Children using the Products through an Institution in New York, the Institution is required by Education Law § 2-d and 8 NYCRR Part 121 to publish a Parents’ Bill of Rights for Data Privacy and Security, together with a supplemental information page describing the SchoolAI engagement. That Parents’ Bill of Rights and the SchoolAI supplemental information are available from the Institution.
SchoolAI’s commitments under New York Education Law § 2-d include:
- Children’s Personal Information will not be sold or released for any commercial or marketing purpose;
- Parents may request to inspect and review their Child’s education records by contacting the Institution;
- safeguards — including encryption of Personal Information in transit and at rest, role-based access controls, written policies governing employee access, and ongoing security monitoring — are in place to protect Children’s Personal Information;
- a current list of SchoolAI’s sub-processors is published in our Trust Center at trust.schoolai.com; and
- complaints regarding a possible breach of Children’s Personal Information may be submitted to the Institution or to the New York State Education Department’s Chief Privacy Officer.
Other states.
Children using the Products through an Institution in other states are also protected by state student-privacy laws that may include similar or additional requirements (including, without limitation, Connecticut Public Act 16-189; Colorado HB 16-1423; Texas Education Code § 32.151 et seq.; and Maryland Education Code § 4-131). SchoolAI complies with applicable state student-privacy laws, and our agreements with Institutions reflect the specific requirements of the jurisdictions in which they operate.
California residents have the right under California Civil Code § 1798.83 to request information about a business’s disclosure of Personal Information to third parties for those third parties’ direct marketing purposes. As described above, SchoolAI does not disclose Children’s Personal Information to third parties for those third parties’ direct marketing purposes, and our commitments under SOPIPA prohibit such disclosures. To make a request under California Civil Code § 1798.83, please contact us at privacy@schoolai.com or at the mailing address listed in the Contact us section. We will respond to a valid request within 30 days as required by California law.
This privacy policy and the CARU icon shown on our website confirm that SchoolAI is a valid licensee and participating member in the CARU COPPA Safe Harbor Program (“CARU Safe Harbor”). To protect your privacy, we have voluntarily undertaken this privacy initiative. CARU has reviewed and certified that we meet established online information collection and use practices on SchoolAI online properties where this privacy policy is posted.
As part of the CARU COPPA Safe Harbor, we are subject to audits and frequent monitoring of our websites and/or apps and other enforcement and accountability mechanisms administered independently by CARU.
If you have any questions or concerns, please contact us at privacy@schoolai.com. If you believe that we have not responded to your inquiry or your inquiry has not been satisfactorily addressed, please contact CARU at:
CARU Safe Harbor
Attn: Director
1676 International Drive #550
McLean, Virginia 22102
InfoCaru@bbbnp.org
We may update this Notice from time to time. The “Effective Date” above will reflect the most recent revision.
What counts as a material change. A material change is a change in the way we collect, use, or disclose Children’s Personal Information. Examples include adding a new category of Personal Information that we collect, using Personal Information for a new purpose, or sharing Personal Information with a new category of third party.
What we will do before a material change takes effect. If we make a material change to this Notice, we will:
- post the revised Notice on our website and within our Product;
- notify each Institution of the change before it takes effect;
- obtain renewed authorization from the Institution under the school-as-agent model, or obtain new verifiable parental consent if the change involves collection, use, or disclosure outside the school-authorized educational scope; and
- where required by applicable law or by our agreement with the Institution, support the Institution in providing notice to Parents.
We will not collect, use, or disclose Personal Information from Children in a new way described in a material change until we have obtained the required consent.
Non-material changes. For non-material changes — for example, clarifying language, correcting typographical errors, or reorganizing existing content — we will update the “Effective Date” and post the revised notice without separate notice or consent.
If you have questions or concerns about this Notice or our privacy practices, please contact us:
If you are a Parent and you would like to review, correct, refuse further collection of, or delete your Child’s Personal Information, please contact your Child’s Institution. See Section titled: How can a Parent review and manage their Child’s Personal Information?. The Institution can review and respond to your request, and where action by SchoolAI is required, the Institution will instruct us. You may also contact us directly using the information above, and we will acknowledge your message and forward it to the Institution.
