Privacy Policy
Privacy Policy
Last updated: June 8, 2026
Effective date: June 8, 2026
Last updated: June 8, 2026
Previous versions: available on request at privacy@ed.ai
Operator: Ed AI Technologies, Inc. · 56 Broad St STE 63766, Boston, MA 02109 · Delaware corporation · EIN 38-4380655
Privacy contact: privacy@ed.ai
Which privacy policy applies to you. This policy applies to Ed.ai in the United States: to schools and districts in the United States and their teachers, administrators and students, whose data is hosted in the United States, and to visitors of our websites who are in the United States. It is issued by Ed AI Technologies, Inc. under US federal and state law.
In France and the European Union, Ed.ai SAS operates our services under the GDPR and French law, and its privacy policy (in French) applies instead. For cookies, our websites treat a device set to a US time zone as being in the United States.
Introduction & scope
This Privacy Policy describes how Ed AI Technologies, Inc. ("Ed.ai," "we," "us," "our") collects, uses, shares, retains, and protects personal information in connection with our educational services for K-12 and higher-education institutions in the United States.
It applies to teachers, administrators, students, parents, and other users of Ed.ai products:
Math Grading & Feedback
Standards-Aligned Analytics
Targeted Practice Generation
AI Teaching Assistant
This policy reflects our obligations under FERPA (20 U.S.C. §1232g), COPPA (15 U.S.C. §§6501–6506), applicable state student privacy laws (SOPIPA, SOPPA, Ed Law §2-d, and others), and consumer privacy laws where they apply (CCPA/CPRA, VCDPA, and others).
Where Ed.ai services are used in France or the European Union, they are operated by Ed.ai SAS under its own privacy notice. This policy applies to US usage.
Our role
We act in two capacities, depending on who you are:
School Official
When a school or district contracts with Ed.ai, Ed.ai operates as a "school official with legitimate educational interest" under FERPA §99.31(a)(1)(i)(B). The school or district remains the controller of student education records; Ed.ai processes those records on the school's behalf and under its direction.
Operator
Under SOPIPA (California), SOPPA (Illinois), Ed Law §2-d (New York), and equivalent state laws, Ed.ai is an "operator" (sometimes "school service provider" or "third-party contractor"). Our obligations are detailed on the state-by-state coverage page and in the NDPA on the DPA page.
business
For non-student personal information (teachers, district administrators, website visitors), Ed.ai operates as a business or service provider under state consumer privacy laws (CCPA/CPRA, VCDPA, etc.), depending on the relationship.
Information we collect
From teachers and administrators
Name, professional email, school/district affiliation, role, grade level(s) taught
Authentication credentials (hashed)
Product usage metadata (logins, feature usage, session length)
Voluntary inputs (support messages, feedback, uploaded class lists)
From students
Identifying data: name, student ID (if provided by the school), grade level, class assignment
Educational records content:
Scanned images of handwritten math work
OCR transcriptions of that work
Teacher-assigned grades
AI-proposed grades (before teacher validation)
Mastery analytics derived from responses
Remediation exercises generated and submitted
Automatically collected
IP address, browser/device type, OS, referral URL
Pages visited, timestamps, error reports (via Sentry)
Website and product analytics via Google Analytics and Amplitude: on by default in the United States, where visitors can opt out at any time, and only with consent elsewhere. In the teacher app, Amplitude may record sessions, with text, form fields and images masked.
From integrations
Rosters via Edlink, which connects Clever, ClassLink, Canvas, Google Workspace for Education, and more
SSO attributes (name, email, school affiliation)
What we do NOT collect
Biometric identifiers
Government-issued IDs
Health information (beyond any incidental data in student work)
Social Security numbers
Precise geolocation
Behavioral profiles for advertising
How we use data
Grade and give feedback on student math work — Student work, teacher inputs · FERPA school-official exception; school authorization under COPPA
Standards-aligned analytics for teachers and departments — Student performance data, standards metadata · FERPA school-official exception
Generate personalized practice (Remediation) — Student response patterns · FERPA school-official exception
Power the AI Teaching Assistant — Aggregated data + teacher queries · FERPA school-official exception
Operate, maintain, secure the service — All technical metadata · Legitimate operational necessity
Communicate with teachers/admins — Contact info · Consent or contract
Improve the product (excluding student work) — Aggregated usage analytics · Legitimate operational necessity
We do not use student work to train AI models. We never use student data for advertising. Our website, sign-in pages and teacher app use advertising tags from Google Ads, Meta, LinkedIn and TikTok to measure our campaigns: by default for visitors in the United States, who can opt out at any time, and only with consent elsewhere. This can be "sharing" under the CCPA. See Cookies & tracking.
AI processing & de-identification
Student work is processed by enterprise language models from Microsoft Azure (Azure OpenAI, Azure Mistral) and Google Cloud (Gemini), hosted in US regions (Microsoft Azure US Central and Google Cloud US). Before any LLM call:
The pipeline detects identifying zones (names, roster identifiers, class labels).
Those zones are masked by opaque white pixels — irreversibly, before transcription.
The masked image is transcribed via OCR.
The transcription is sent to the LLM under contractual no-retention, no-training terms with the sub-processor.
Result: the LLM never sees who the work belongs to. Performance metrics and the full pipeline are detailed on the de-identification page.
Who we share data with
We share personal information only with:
The school or district that contracted Ed.ai (that's their data).
Sub-processors listed and kept up to date on the sub-processors page — each under a DPA requiring confidentiality, security, and no secondary use.
Roster integrations via Edlink (Clever, ClassLink, Canvas, Google Workspace for Education, and more) — only when the school enables them.
Legal requests: we comply with valid subpoenas, court orders, and government requests, narrowly and with notification to the school when legally permitted.
We do not share data with data brokers, and we never share student data with advertisers. Advertising partners receive browsing data from our website, sign-in pages and teacher app: by default in the United States, where visitors can opt out, and only with consent elsewhere. See Cookies & tracking.
Data residency — student data stays in the United States
All student-related data is stored in Microsoft Azure US Central. AI processing is performed by US-hosted enterprise models (Microsoft Azure US Central and Google Cloud US) under no-retention terms. We do not transfer student data outside the United States. Disaster recovery, backups, and redundancy all occur within US regions.
Non-student operational data (marketing via Mailchimp, HubSpot CRM for teacher accounts, Google Analytics, Amplitude, support tools, and the advertising partners listed in Cookies & tracking) may be processed outside the US under the vendor's standard terms. Student data is not sent to these tools.
Retention & deletion
Student work (scans, transcriptions, grades, analytics) — Duration of the school's contract. On deletion request: production within 30 days. At contract end: production within 90 days. Backups within 12 months in both cases.
Teacher account data — Duration of the account + 12 months inactivity
Audit logs — Duration of the contract + 1 year
Website analytics — 12 months
Cookie choices — 6 months after a refusal, 13 months after an acceptance or a dismissed notice, then asked again
Backups — Rolling 12 months
Support tickets — Duration of the account + 12 months
On request by the school or the teacher:
Account deletion (on request): removed from production systems within 30 days; backups and archival systems fully purged within 12 months.
Data export: available in open formats (CSV, PDF, standard image) directly from product settings; on termination, a 30-day export window applies before deletion begins.
Contract termination: all student data deleted from production within 90 days; backups and archival systems within 12 months. We never delete student work while a contract is in force.
Security
Summary (full detail on the Security page):
Encryption: TLS 1.3 in transit, AES-256 at rest.
Access control: least-privilege, MFA for administrators, role-based access.
Hosting: Microsoft Azure US Central, VPC isolation, DDoS protection.
Application security: OWASP Top 10 controls, code review, CI/CD with no direct server access.
Passwords: SHA-512 hashing.
Incident response: notification to the school within 72 hours of confirming an incident, or sooner where a contract or state law requires it.
We do not currently hold SOC 2 Type II certification. We will publish our status transparently if and when that changes.
Your rights
Under FERPA
Right to inspect, review, amend, and consent to disclosure of education records. These rights are exercised through the school per the FERPA framework.
Under COPPA
Right to review, delete, and refuse further collection. Exercised through the school under the school-authorization model, or directly via privacy@ed.ai.
Under California law
California residents have the right to:
Know what personal information we collect and why
Access and delete their information
Correct inaccurate information
Opt out of "sale" or "sharing" (Ed.ai does neither)
Limit the use of sensitive personal information (Ed.ai collects none)
Non-discrimination for exercising rights
Student information is governed by SOPIPA, which is stricter than CCPA/CPRA — see the state-by-state coverage page.
Under other state consumer laws
Residents of US states with consumer privacy laws have analogous rights (access, delete, correct, portability, and opt out of targeted advertising — which Ed.ai doesn't conduct).
How to exercise your rights
In-product: account settings (access, export, delete)
By email: privacy@ed.ai
By mail: Ed AI Technologies, Inc. · 56 Broad St STE 63766, Boston, MA 02109
Through your school or district (required for FERPA/COPPA)
We respond within 30 days (or the shorter period required by applicable state law).
Cookies & tracking
Ed.ai uses cookies and similar technologies on ed.ai, the sign-in pages (sso.ed.ai) and the teacher app (app.ed.ai). Your choice applies to all three.
Strictly necessary, always on: authentication and session management, CSRF protection, ed_consent (remembers your choice or that you dismissed the notice: 6 months after a refusal, 13 months otherwise) and ed_marketing_cookie (the page to show after sign-up for 30 days; campaign attribution only while advertising is on).
Audience measurement: Google Analytics, and Amplitude in the teacher app, which may record sessions with text, form fields and images masked.
Advertising: Google Ads, Meta, LinkedIn and TikTok, to measure our campaigns and show relevant ads on other sites.
Error tracking via Sentry (PII scrubbing enabled; no personal data in stack traces).
In the United States, audience measurement and advertising are on by default. A notice on your first visit says so, and you can turn either one off at any time. We use your device's time zone to tell where you are.
Elsewhere, they run only with your consent. A banner on your first visit lets you accept all, reject all, or choose by purpose.
You can change your choice at any time from "Cookie settings" at the bottom of ed.ai and the sign-in pages, or from the user menu in the app. We honor Global Privacy Control: when your browser sends it, advertising stays off.
In the app, these technologies only apply to teachers on a free or individual plan. Students, school-plan accounts and administrators are never tracked, and no student data is used for advertising.
Contact & complaint channels
Primary contact
Email: privacy@ed.ai
Mail: Ed AI Technologies, Inc. · 56 Broad St STE 63766 · Boston, MA 02109
Phone: +1 617 545 7366
Regulatory complaint channels
FTC (COPPA): www.ftc.gov/coppa
U.S. Department of Education (FERPA): studentprivacy.ed.gov
Your State Attorney General for state-specific issues
Your school district's data privacy officer for FERPA rights
Changes to this policy
We update this policy when laws, products, or sub-processors change. The current version is always posted on this page with its effective date, and previous versions are archived and available on request at privacy@ed.ai.