Privacy Policy

This Privacy Policy explains how [Legal Entity Name] (“we,” “us,” or “LMS”) collects, uses, and shares information when an educational institution or organization (“Tenant”) and its administrators, instructors, and learners (“Users”) use our multi-tenant learning platform (the “Service”).

Each Tenant's data is logically isolated from every other Tenant's data. Where a Tenant is the data controller for its own Users' information (for example, a school enrolling its students), we act as that Tenant's data processor and this policy describes how we process data on the Tenant's behalf. Questions about a specific institution's use of your data should first go to that institution's administrator.

We collect the following categories of information:

• Account information: name, username, email address, role (superadmin, tenant admin, instructor, or member), and the Tenant you belong to.
• Content you create or upload: courses, lessons, exams, blog posts, vocabulary entries, tenant branding assets, and documents uploaded for AI-assisted knowledge-base features.
• AI feature usage: prompts and text you submit to AI-assisted drafting, rephrasing, diagram, and question-generation features, the content those features return, and aggregate usage records (token counts, timestamps, and which feature was used) shown on administrative usage dashboards.
• Authentication data: credentials are managed by our identity provider (Amazon Cognito); we do not store your password. We do store a unique identifier used to look up your account.
• Technical and log data: IP address, browser and device information, and request timestamps, collected for security, troubleshooting, and abuse prevention.

• To provide, operate, and maintain the Service, including authentication and per-tenant access control.
• To generate AI-assisted drafts, rephrasings, diagrams, and search results over content you or your Tenant uploaded.
• To detect, prevent, and investigate security incidents, fraud, and abuse.
• To communicate with you about your account or the Service.
• To improve the reliability and performance of the Service.

We do not sell your personal information, and we do not use your content to serve third-party advertising.

Some features send the relevant text (for example, a lesson draft, a selection you asked to rephrase, or chunks of an uploaded document) to third-party AI providers in order to generate a response or an embedding used for search:

• Google Gemini is used to generate text embeddings for knowledge-base search over course documents and lesson content.
• Anthropic (Claude) is used to generate AI-assisted drafts, rephrasings, and other generated content.

These providers process the data solely to return a result to the Service and are bound by their own privacy and data-handling terms, which we encourage you to review. We do not control, and this policy does not describe, how long a provider retains data beyond what is necessary to service the request. AI outputs may be inaccurate and should be reviewed before you rely on them.

We use strictly necessary cookies to keep you signed in and to protect your session. We do not currently use advertising or third-party analytics cookies. If that changes, we will update this policy and, where required, ask for your consent first.

We share information only as needed to operate the Service:

• Hosting and storage: Amazon Web Services (AWS) hosts the Service and stores uploaded files and course content.
• Authentication: Amazon Cognito manages sign-in and issues session tokens.
• AI processing: Google Gemini and Anthropic, as described in Section 4.
• When required by law, legal process, or to protect the rights, property, or safety of our Users or the public.
• In connection with a merger, acquisition, or sale of assets, subject to this policy or a materially similar one.

We retain account and content data for as long as your Tenant's account is active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. A Tenant administrator can request deletion of their organization's data as described in Section 9.

Each Tenant's data is isolated at the database level using row-level security, and access to platform data is restricted by role (superadmin, tenant admin, instructor, member). We use industry-standard safeguards, but no system is completely secure, and we cannot guarantee absolute security of information transmitted to or stored by the Service.

Depending on your location and role, you may have the right to access, correct, export, or request deletion of your personal information. If you are a learner or instructor, please start with your Tenant's administrator, who controls your account within the Service. Tenant administrators and other requests can be sent to the contact in Section 12.

The Service is intended to be used by or on behalf of educational institutions, which may enroll minors under the institution's own supervision and legal basis for doing so. We do not knowingly collect personal information directly from children outside of a Tenant's institutional enrollment. If you believe a child has provided us information outside of that context, contact us using the details in Section 12.

Our infrastructure runs on Amazon Web Services and may process or store data in a region other than where you are located. Where required, we rely on appropriate safeguards for any such transfer.

We may update this policy from time to time. We will post the updated policy here and revise the effective date above. Material changes will be communicated to Tenant administrators.

Questions about this policy can be sent to [privacy@example.com].