Privacy

What personal information do we process? We process submitted content, account and billing information, browser identifiers, and service activity, including activity before a student submits a response.

Can student feedback identify a person? Student feedback does not require a name or sign-in. We link participation and responses internally through browser identifiers. Ordinary instructor reports omit these identifiers, but an answer may identify its author or another person.

Do we process sensitive personal information? Written answers and other materials may contain sensitive personal information, which we process and store when it is included in submissions and related assessments or safety records.

Do we receive information from third parties? We receive information from instructors, institutions, authentication and payment providers, and services that you or your institution connect, as needed for the authorized workflow.

How do we process your information? We use information to provide teaching services, report feedback, handle participation, maintain teaching portfolios, manage payments and access, send service communications, and protect and support the Services. When enabled, automated tools screen comments for feedback suitability and possible safety concerns and generate feedback summaries.

With whom do we share information? We disclose information to service providers and authorized users as described below. Restricted safety records have separate access controls. We do not sell personal information or use it for targeted advertising.

How long do we keep information? We retain course feedback for ongoing teaching portfolios. Course completion, account inactivity, and report restrictions do not by themselves delete submissions.

How do you exercise your rights? Depending on applicable law, you may have rights regarding your personal information. Send privacy requests to [email protected]; you do not need an account to make a request.

1. What information do we collect?
2. How do we process your information?
3. How do we screen student comments?
4. When and with whom do we share your personal information?
5. Do we use cookies or other tracking technologies?
6. How do we handle authentication and connected services?
7. Is your information transferred internationally?
8. How long do we keep your information?
9. How do we keep your information safe?
10. Do we collect information from minors?
11. What are your privacy rights?
12. Controls for Do-Not-Track features
13. Do we make updates to this notice?
14. How can you contact us about this notice?
15. How can you review, update, or delete the data we collect from you?

The information we process depends on the features you use and your relationship with an instructor or institution. It includes:

• Account and contact information: names, email addresses, institutional affiliation, account identifiers, authentication information, and communications with us.
• Billing and access information: billing contact information, payment processor and transaction identifiers, purchase and invoice records, payment and subscription status, refund and dispute records, license grants, and institutional sponsorship and access records.
• Teaching and course information: student responses and selections; course and question context; teaching materials, documents, and links; reviewer comments, ratings, reports, and related metadata.
• Browser and service activity: browser and course-specific participant identifiers, submission attempts and times, form activity and participation signals, device and request information, security checks, and operational logs. Activity collection begins when a form is opened and can occur before submission.
• Processing and notification records: automated assessments, generated feedback summaries, excerpts and versions with material removed, derived participation information, restricted safety records, notification preferences, optional push subscriptions, and delivery records.

Browser identifiers let us associate activity and responses from the same browser, including across courses. They do not require a student account. Ordinary instructor reports omit these identifiers; the content and context of a response may nevertheless identify a person.

Answers and uploaded materials may contain sensitive information, such as information about health, identity, or experiences of mistreatment. We process and store this information when it is included in submissions and related assessments or safety records. Please avoid including identifying or sensitive details that are unnecessary for your feedback.

We also receive information from instructors, institutions, authentication and payment providers, and services that you or your institution connect, as needed for the authorized workflow. Connected files may remain in an institutional or third-party system while we store associated content, links, identifiers, or metadata.

We use information to provide and maintain the Services, authenticate users, manage courses and permissions, collect and report feedback, maintain teaching portfolios, handle participation and submission recovery, process payments, manage subscriptions and licensed access, and send service communications or optional notifications. We also use information to provide support, prevent abuse, troubleshoot problems, evaluate and improve service operation and screening, reconcile billing records, handle payment disputes, and meet applicable legal and contractual obligations.

Our use of student feedback includes delivering course feedback, generating feedback summaries, screening for suitability and possible safety concerns, evaluating that screening, and troubleshooting and security. We do not use student feedback for advertising, unrelated research, or training general-purpose AI models.

When enabled, AI service providers process permitted written responses, associated answer selections, response counts, and question context to generate feedback summaries. Responses may be grouped by browser within the relevant survey, but summary requests omit our internal browser identifiers. Identifying or sensitive information included in permitted responses may still be processed. Summaries may appear in instructor reports and report emails and can be inaccurate or incomplete.

Where we process information on an institution's behalf, its instructions and applicable agreement also govern that processing. Any consent or other authorization required by applicable law must be in place for the relevant use.

When enabled, AI service providers process written answers and relevant survey context, such as the question, preceding selections, and submission timing, to assess feedback suitability and possible safety concerns. Screening requests do not include our browser identifiers or student account details, but identifying or sensitive information written into an answer is processed.

Depending on the configuration, assessments are recorded to evaluate screening or used to withhold answers, remove material from ordinary reports, and support restricted safety notifications and review. Original submissions and related assessments remain stored even when material is removed from reports. Existing report restrictions may continue when live screening is paused or used only for evaluation; queued answers may be screened when processing resumes.

Automated findings can be inaccurate or incomplete. The Services are not an emergency service, are not continuously monitored, and do not guarantee identification of a concern or any notification, review, contact, or intervention.

Ordinary teaching workflows. Feedback and review materials are available to users authorized for the relevant course or review, subject to applicable access and screening restrictions. These may include instructors, reviewers, and institutional administrators. These roles do not automatically grant access to restricted safety records.

Institutional billing. Authorized institutional buyers can see linked instructors' names, email addresses or account identifiers, access status and end dates, and renewal permissions. This billing access does not itself provide access to student responses or course reports.

Restricted safety access. When safety enforcement is enabled, designated service administrators may receive notifications and access flagged answers and related context through restricted pages. The course owner may also receive access only when the screening assessment explicitly indicates that the owner is not implicated in any current concern and the applicable access checks are met. Notification emails contain a restricted link rather than answer text. A forwarded link does not itself authorize access. A notification or viewing of a record does not establish that the concern has been addressed.

Service providers and operations. Providers process information to supply hosting, storage, authentication, payment processing, automated screening, feedback summaries, email, optional browser push delivery, security, and related functions. Information disclosed depends on the function; AI providers receive the inputs described above. Authorized personnel may access information as needed to operate, secure, or support the Services. Restricted safety pages remain subject to their specific access controls.

Stripe payments. We use Stripe to process payments and provide hosted checkout and billing management. We send Stripe billing contact information and account and purchase identifiers, and receive transaction, invoice, subscription, and payment status information. Card details are collected directly by Stripe; we do not store full card numbers or card security codes. Stripe also processes information under its Privacy Policy.

Other permitted disclosures. We may disclose information with your authorization, as required by law or valid legal process, or as permitted by law when reasonably necessary to protect rights, security, or safety.

We do not sell personal information or use it for targeted advertising.

We use cookies and similar browser storage for sessions, recognizing returning browsers, linking course participation, trusted instructor devices, security, and recovery of unfinished responses. Draft recovery may store answers in browser session storage. Authentication and security providers may also use cookies or related technologies to provide their functions.

Where optional course notifications are available, we store the browser's push subscription and course preferences. You can control browser notification permission and use any available course notification controls.

You can manage cookies and stored data through your browser, although doing so may affect sign-in, participation recognition, or recovery. Clearing browser storage does not delete submissions or other records already stored by the Services.

We may use Cloudflare Turnstile to protect our Services from automated abuse. For more information, see Cloudflare's Turnstile Privacy Addendum.

We use information received from authentication and connected-service providers for the purposes described in this notice or otherwise presented in the authorized workflow. Please review the relevant provider's privacy notice for its own processing practices and privacy controls.

The Services are operated from the United States. Information may be processed or stored in the United States and other locations where our service providers operate, subject to applicable law and any relevant institutional agreement.

We retain course responses and reports to support ongoing teaching portfolios and comparison over time. They are not routinely deleted solely because they are old, a course ends, or an account becomes inactive. Retention remains subject to applicable law, institutional agreements, and authorized deletion requests.

We retain original submissions and related screening or safety records for the purposes described in this notice. Retention of supporting information depends on its continuing use for service operation, screening evaluation, security, troubleshooting, and legal or contractual obligations. Cookies, sessions, and some operational records may expire independently of course records.

We retain billing, transaction, subscription, and license records as needed to administer access, maintain accounting records, reconcile payments, prevent fraud, resolve disputes, and meet legal or contractual obligations. These records may remain after a subscription ends or account access is closed.

Removing material from reports does not delete the original submission. Logging out, deleting browser data, or ending account access does not by itself delete all associated course information. To request access or deletion, contact us as described below.

Deletion from active systems may not immediately remove copies in backups. Backup copies may remain until the applicable retention period expires, subject to required preservation. Deleting our records also does not remove copies already held by recipients or in external systems they control.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls appropriate to the relevant workflow. No online service or storage system can guarantee complete security.

The Services are intended for higher education and related teaching activities. Students aged 13 through 17 may participate through a college course authorized by the institution or an instructor acting within their authority. Any additional permission required by applicable law or institutional policy must be obtained.

The Services are not intended for children under 13, and we do not knowingly collect their personal information. If you believe we have received information from a child under 13, contact [email protected] so we can investigate and take appropriate action, including deletion where required.

Depending on applicable law, you may have rights to access or obtain a copy of your personal information, correct it, request deletion, restrict or object to processing, limit certain uses of sensitive information, or withdraw consent where processing relies on it. Applicable law may also provide rights to opt out of sale, targeted advertising, or certain profiling; we do not sell personal information or use it for targeted advertising.

California residents may also request, once per year and free of charge, the categories of personal information, if any, disclosed to third parties for their direct marketing during the preceding calendar year and the recipients' names and addresses. Use the privacy request process below.

Where processing relies on consent, you may withdraw it at any time through the privacy request process below. Withdrawal does not affect earlier lawful processing or processing permitted on other grounds under applicable law.

You may contact [email protected] to appeal our response where an appeal is available under applicable law. You may also have the right to complain to the relevant privacy regulator or attorney general. We do not discriminate against you for exercising applicable privacy rights.

We do not currently respond to the browser's Do Not Track setting. Where applicable law requires recognition of other privacy preference signals, we honor those requirements. We do not use personal information for targeted advertising.

We may update this notice as our practices or legal requirements change. The date above identifies the latest revision. We will provide notice of material changes as required by applicable law, including through the Services or another appropriate method.

If you have questions or comments about this notice, you may email us at [email protected].

Send requests to [email protected]. You do not need an account to make a request. We may need information to verify your identity or authority and locate the relevant records. For feedback submitted without a name or account, our ability to associate records with you depends on the information available. We will not disclose another person's information to satisfy a request.

When information is managed on an institution's behalf, we may coordinate with or direct you to that institution. We handle requests and any authorized-agent requests according to applicable law, including its verification requirements, response periods, and exceptions. A deletion request does not necessarily require removal of records we are legally permitted or required to retain.