Privacy Policy

Last updated: June 8, 2026

  • Effective date: June 8, 2026

  • Last updated: June 8, 2026

  • Previous versions: available on request at privacy@ed.ai

  • Operator: Ed AI Technologies, Inc. · 56 Broad St STE 63766, Boston, MA 02109 · Delaware corporation · EIN 38-4380655

  • Privacy contact: privacy@ed.ai

Which privacy policy applies to you. This policy applies to Ed.ai in the United States: to schools and districts in the United States and their teachers, administrators and students, whose data is hosted in the United States, and to visitors of our websites who are in the United States. It is issued by Ed AI Technologies, Inc. under US federal and state law.

In France and the European Union, Ed.ai SAS operates our services under the GDPR and French law, and its privacy policy (in French) applies instead. For cookies, our websites treat a device set to a US time zone as being in the United States.

Introduction & scope

This Privacy Policy describes how Ed AI Technologies, Inc. ("Ed.ai," "we," "us," "our") collects, uses, shares, retains, and protects personal information in connection with our educational services for K-12 and higher-education institutions in the United States.

It applies to teachers, administrators, students, parents, and other users of Ed.ai products:

  • Math Grading & Feedback

  • Standards-Aligned Analytics

  • Targeted Practice Generation

  • AI Teaching Assistant

This policy reflects our obligations under FERPA (20 U.S.C. §1232g), COPPA (15 U.S.C. §§6501–6506), applicable state student privacy laws (SOPIPA, SOPPA, Ed Law §2-d, and others), and consumer privacy laws where they apply (CCPA/CPRA, VCDPA, and others).

Where Ed.ai services are used in France or the European Union, they are operated by Ed.ai SAS under its own privacy notice. This policy applies to US usage.

Our role

We act in two capacities, depending on who you are:

School Official

When a school or district contracts with Ed.ai, Ed.ai operates as a "school official with legitimate educational interest" under FERPA §99.31(a)(1)(i)(B). The school or district remains the controller of student education records; Ed.ai processes those records on the school's behalf and under its direction.

Operator

Under SOPIPA (California), SOPPA (Illinois), Ed Law §2-d (New York), and equivalent state laws, Ed.ai is an "operator" (sometimes "school service provider" or "third-party contractor"). Our obligations are detailed on the state-by-state coverage page and in the NDPA on the DPA page.

business

For non-student personal information (teachers, district administrators, website visitors), Ed.ai operates as a business or service provider under state consumer privacy laws (CCPA/CPRA, VCDPA, etc.), depending on the relationship.

Information we collect

From teachers and administrators

  • Name, professional email, school/district affiliation, role, grade level(s) taught

  • Authentication credentials (hashed)

  • Product usage metadata (logins, feature usage, session length)

  • Voluntary inputs (support messages, feedback, uploaded class lists)

From students

  • Identifying data: name, student ID (if provided by the school), grade level, class assignment

  • Educational records content:

  • Scanned images of handwritten math work

  • OCR transcriptions of that work

  • Teacher-assigned grades

  • AI-proposed grades (before teacher validation)

  • Mastery analytics derived from responses

  • Remediation exercises generated and submitted

Automatically collected

  • IP address, browser/device type, OS, referral URL

  • Pages visited, timestamps, error reports (via Sentry)

  • Website and product analytics via Google Analytics and Amplitude: on by default in the United States, where visitors can opt out at any time, and only with consent elsewhere. In the teacher app, Amplitude may record sessions, with text, form fields and images masked.

From integrations

  • Rosters via Edlink, which connects Clever, ClassLink, Canvas, Google Workspace for Education, and more

  • SSO attributes (name, email, school affiliation)

What we do NOT collect

  • Biometric identifiers

  • Government-issued IDs

  • Health information (beyond any incidental data in student work)

  • Social Security numbers

  • Precise geolocation

  • Behavioral profiles for advertising

How we use data

  • Grade and give feedback on student math work — Student work, teacher inputs · FERPA school-official exception; school authorization under COPPA

  • Standards-aligned analytics for teachers and departments — Student performance data, standards metadata · FERPA school-official exception

  • Generate personalized practice (Remediation) — Student response patterns · FERPA school-official exception

  • Power the AI Teaching Assistant — Aggregated data + teacher queries · FERPA school-official exception

  • Operate, maintain, secure the service — All technical metadata · Legitimate operational necessity

  • Communicate with teachers/admins — Contact info · Consent or contract

  • Improve the product (excluding student work) — Aggregated usage analytics · Legitimate operational necessity

We do not use student work to train AI models. We never use student data for advertising. Our website, sign-in pages and teacher app use advertising tags from Google Ads, Meta, LinkedIn and TikTok to measure our campaigns: by default for visitors in the United States, who can opt out at any time, and only with consent elsewhere. This can be "sharing" under the CCPA. See Cookies & tracking.

AI processing & de-identification

Student work is processed by enterprise language models from Microsoft Azure (Azure OpenAI, Azure Mistral) and Google Cloud (Gemini), hosted in US regions (Microsoft Azure US Central and Google Cloud US). Before any LLM call:

  1. The pipeline detects identifying zones (names, roster identifiers, class labels).

  2. Those zones are masked by opaque white pixels — irreversibly, before transcription.

  3. The masked image is transcribed via OCR.

  4. The transcription is sent to the LLM under contractual no-retention, no-training terms with the sub-processor.

Result: the LLM never sees who the work belongs to. Performance metrics and the full pipeline are detailed on the de-identification page.

Who we share data with

We share personal information only with:

  • The school or district that contracted Ed.ai (that's their data).

  • Sub-processors listed and kept up to date on the sub-processors page — each under a DPA requiring confidentiality, security, and no secondary use.

  • Roster integrations via Edlink (Clever, ClassLink, Canvas, Google Workspace for Education, and more) — only when the school enables them.

  • Legal requests: we comply with valid subpoenas, court orders, and government requests, narrowly and with notification to the school when legally permitted.

We do not share data with data brokers, and we never share student data with advertisers. Advertising partners receive browsing data from our website, sign-in pages and teacher app: by default in the United States, where visitors can opt out, and only with consent elsewhere. See Cookies & tracking.

Data residency — student data stays in the United States

All student-related data is stored in Microsoft Azure US Central. AI processing is performed by US-hosted enterprise models (Microsoft Azure US Central and Google Cloud US) under no-retention terms. We do not transfer student data outside the United States. Disaster recovery, backups, and redundancy all occur within US regions.

Non-student operational data (marketing via Mailchimp, HubSpot CRM for teacher accounts, Google Analytics, Amplitude, support tools, and the advertising partners listed in Cookies & tracking) may be processed outside the US under the vendor's standard terms. Student data is not sent to these tools.

Retention & deletion

  • Student work (scans, transcriptions, grades, analytics) — Duration of the school's contract. On deletion request: production within 30 days. At contract end: production within 90 days. Backups within 12 months in both cases.

  • Teacher account data — Duration of the account + 12 months inactivity

  • Audit logs — Duration of the contract + 1 year

  • Website analytics — 12 months

  • Cookie choices — 6 months after a refusal, 13 months after an acceptance or a dismissed notice, then asked again

  • Backups — Rolling 12 months

  • Support tickets — Duration of the account + 12 months

On request by the school or the teacher:

  • Account deletion (on request): removed from production systems within 30 days; backups and archival systems fully purged within 12 months.

  • Data export: available in open formats (CSV, PDF, standard image) directly from product settings; on termination, a 30-day export window applies before deletion begins.

  • Contract termination: all student data deleted from production within 90 days; backups and archival systems within 12 months. We never delete student work while a contract is in force.

Security

Summary (full detail on the Security page):

  • Encryption: TLS 1.3 in transit, AES-256 at rest.

  • Access control: least-privilege, MFA for administrators, role-based access.

  • Hosting: Microsoft Azure US Central, VPC isolation, DDoS protection.

  • Application security: OWASP Top 10 controls, code review, CI/CD with no direct server access.

  • Passwords: SHA-512 hashing.

  • Incident response: notification to the school within 72 hours of confirming an incident, or sooner where a contract or state law requires it.

We do not currently hold SOC 2 Type II certification. We will publish our status transparently if and when that changes.

Your rights

Under FERPA

Right to inspect, review, amend, and consent to disclosure of education records. These rights are exercised through the school per the FERPA framework.

Under COPPA

Right to review, delete, and refuse further collection. Exercised through the school under the school-authorization model, or directly via privacy@ed.ai.

Under California law

California residents have the right to:

  • Know what personal information we collect and why

  • Access and delete their information

  • Correct inaccurate information

  • Opt out of "sale" or "sharing" (Ed.ai does neither)

  • Limit the use of sensitive personal information (Ed.ai collects none)

  • Non-discrimination for exercising rights

Student information is governed by SOPIPA, which is stricter than CCPA/CPRA — see the state-by-state coverage page.

Under other state consumer laws

Residents of US states with consumer privacy laws have analogous rights (access, delete, correct, portability, and opt out of targeted advertising — which Ed.ai doesn't conduct).

How to exercise your rights

  • In-product: account settings (access, export, delete)

  • By email: privacy@ed.ai

  • By mail: Ed AI Technologies, Inc. · 56 Broad St STE 63766, Boston, MA 02109

  • Through your school or district (required for FERPA/COPPA)

We respond within 30 days (or the shorter period required by applicable state law).

Cookies & tracking

Ed.ai uses cookies and similar technologies on ed.ai, the sign-in pages (sso.ed.ai) and the teacher app (app.ed.ai). Your choice applies to all three.

  • Strictly necessary, always on: authentication and session management, CSRF protection, ed_consent (remembers your choice or that you dismissed the notice: 6 months after a refusal, 13 months otherwise) and ed_marketing_cookie (the page to show after sign-up for 30 days; campaign attribution only while advertising is on).

  • Audience measurement: Google Analytics, and Amplitude in the teacher app, which may record sessions with text, form fields and images masked.

  • Advertising: Google Ads, Meta, LinkedIn and TikTok, to measure our campaigns and show relevant ads on other sites.

  • Error tracking via Sentry (PII scrubbing enabled; no personal data in stack traces).

In the United States, audience measurement and advertising are on by default. A notice on your first visit says so, and you can turn either one off at any time. We use your device's time zone to tell where you are.

Elsewhere, they run only with your consent. A banner on your first visit lets you accept all, reject all, or choose by purpose.

You can change your choice at any time from "Cookie settings" at the bottom of ed.ai and the sign-in pages, or from the user menu in the app. We honor Global Privacy Control: when your browser sends it, advertising stays off.

In the app, these technologies only apply to teachers on a free or individual plan. Students, school-plan accounts and administrators are never tracked, and no student data is used for advertising.

Contact & complaint channels

Primary contact

  • Mail: Ed AI Technologies, Inc. · 56 Broad St STE 63766 · Boston, MA 02109

  • Phone: +1 617 545 7366

Regulatory complaint channels

  • FTC (COPPA): www.ftc.gov/coppa

  • U.S. Department of Education (FERPA): studentprivacy.ed.gov

  • Your State Attorney General for state-specific issues

  • Your school district's data privacy officer for FERPA rights

Changes to this policy

We update this policy when laws, products, or sub-processors change. The current version is always posted on this page with its effective date, and previous versions are archived and available on request at privacy@ed.ai.