Privacy Policy

OneSpot Learning, Inc., doing business as gotLearning ("gotLearning," "we," "us"), makes LearningPulse, a student work analysis platform that helps teachers and school leaders see what students are learning from the work students actually produce. This policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the choices you have.

It covers the LearningPulse application at learningpulse.app, the legacy gotFeedback application at app.gotfeedback.com, our website at gotlearning.com, and our webinars, demos and other communications (together, the "Services").

We wrote this policy for three audiences: schools and districts that use LearningPulse, the teachers and administrators who sign in to it, and anyone who visits our website or hears from us. If you are a parent or student, Section 12 explains how to make a request about student information.

1. Our commitments to schools and students

These commitments apply to all Student Data, as defined in Section 3. Nothing elsewhere in this policy creates an exception to them.

• The school owns and controls its Student Data. We process it only on the school's behalf, at its direction and for the educational purposes the school authorizes.
• We collect and use only the Student Data reasonably necessary to provide LearningPulse. We design LearningPulse to minimize the amount of Student Data we collect, use, disclose and retain.
• We never sell Student Data.
• We never use Student Data for advertising, including targeted advertising, and LearningPulse never shows advertising.
• We never build a profile of a student for any purpose other than providing LearningPulse to the school.
• We never use Student Data for any commercial purpose other than providing LearningPulse to the school. Our sales and marketing activities never use Student Data.
• We never use Student Data to train, fine-tune or improve AI models, ours or anyone else's.
• Student work stays within the systems we use to provide LearningPulse and is not sent to consumer or public AI tools.
• LearningPulse does not produce grades or scores and does not make decisions about students. Educators decide what to do with the analysis.
• We delete Student Data within 30 days after a school's agreement ends, or sooner if the school asks, subject to the backup deletion schedule in Section 9.
• If gotLearning is acquired or merges with another company, these commitments stay with the Student Data. Student Data is never sold or transferred on its own, and any successor must agree in writing to protect it under this policy and the school's agreement.
• We will not make a material change to how we handle Student Data without notifying schools in advance and obtaining their consent where the law or our agreement requires it.

2. Our role and how this policy works with school agreements

When a school or district uses LearningPulse, the school decides what Student Data enters the platform and the educational purposes for which it is used. We act as a service provider to the school.

Under the Family Educational Rights and Privacy Act (FERPA), when FERPA applies, we act as a "school official" with a legitimate educational interest. We perform services that the school would otherwise use its own employees or other service providers to perform, and we operate under the school's direct control with respect to the use and maintenance of education records.

We use personally identifiable information from education records only for the purposes authorized by the school. We do not redisclose that information except at the school's direction or as otherwise permitted by FERPA, applicable law and our agreement with the school.

Many schools sign a data privacy agreement with us, such as the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) or a state or district agreement. This policy applies alongside that agreement. If the two conflict, whichever provision gives Student Data more protection controls unless applicable law requires otherwise.

We sign the data privacy agreements schools require and provide our security documentation and current subprocessor information before a pilot or paid implementation begins.

Schools remain responsible for determining which employees and other authorized users may access Student Data through LearningPulse. We provide role-based controls that allow schools to manage that access.

3. Information we collect

3.1 Student Data

"Student Data" means any information about an identifiable student that a school, or an educator acting for a school, provides to LearningPulse, and anything LearningPulse creates from it. It includes:

• Student names or other identifiers, and class and roster information, such as which students are in which class.
• Student work, such as essays, written responses, documents, and photos or scans of handwritten work, whether an educator uploads it or imports it from a learning management system the school uses, such as Google Classroom or Canvas.
• Assignment information connected to student work, such as the prompt, the criteria an educator sets and the date.
• Analysis LearningPulse produces about student work, such as observations about skills, patterns across a class and growth over time.
• Embeddings, indexes and similar technical representations derived from student work, to the extent they can be associated with a student or school.

Students do not create accounts or sign in to LearningPulse. LearningPulse does not need, and we ask schools not to provide, sensitive information such as Social Security numbers, government identification numbers, financial account or family financial information, health or disability information, disciplinary records, biometric identifiers or precise geolocation. If information like this appears inside a piece of student work, it is treated as Student Data and protected the same way.

3.2 Educator account information

When a teacher or administrator uses LearningPulse, we collect:

• Name, school email address, school or district, and role.
• Sign-in information. Educators sign in with their Google account or a LearningPulse password. When you sign in with Google, we receive basic profile information such as your name and email address. We never receive your Google password.
• Classes, criteria and settings you create in LearningPulse.
• Information from integrations you connect, such as class lists and assignments from Google Classroom or Canvas. We request only the permissions LearningPulse needs to work.
• Usage and device information, such as log data, IP address, browser type and the features you use.
• Messages you send us for support.

3.3 Website visitors and prospective customers

• Information you give us. When you fill out a form, book a demo, register for a webinar or subscribe to updates, we collect your name, contact details, school or district, role, state and anything you choose to write.
• Professional contact information from other sources. We may collect work contact information about educators and school leaders, such as name, title, school and work contact details, from public sources like school websites and from business data providers. We use it to tell school leaders about LearningPulse. This information never includes Student Data.
• Cookies and similar technologies on our website, described in Section 8.

3.4 Billing information

When a school or district pays by credit card, the payment is processed by Stripe. We receive the billing contact's name and contact details. We never receive or store full card numbers.

4. How we use information

4.1 Student Data

We use Student Data only to provide LearningPulse to the school that provided it. That means:

• Analyzing student work as educators direct, and showing the results to authorized users at that school or district.
• Showing growth over time for the students and classes the school chooses.
• Operating, securing, maintaining and troubleshooting LearningPulse, including responding to support requests. When an educator asks for help with a specific issue, our support staff may view the relevant Student Data only to resolve it.
• Meeting our legal obligations.

We do not use Student Data for anything else. Section 1 lists what we never do with it.

4.2 Educator, website and business information

We use educator account information, website information and business contact information to:

• Provide, secure and support your account.
• Communicate with you about the Services, including service notices, training and product updates.
• Process payments.
• Understand how LearningPulse and our website are used so we can improve them. For this we use usage information, such as which features are used and how often, never the content of student work.
• Share information about LearningPulse, webinars and events with educators and school leaders. You can opt out of marketing messages at any time with the unsubscribe link or by contacting us. You will still receive messages needed to run your account.
• Protect the Services, prevent fraud and abuse, and comply with the law.

5. How LearningPulse uses AI

• LearningPulse analyzes student work using AI models accessed through Amazon Bedrock within our Amazon Web Services (AWS) environment.
• Under AWS's terms for Amazon Bedrock, customer content is not used to train the underlying foundation models and is not provided to model providers for them to train their models.
• We configure the services we use to minimize the retention and logging of student-work content.
• Text in photos or scans of handwritten work may be processed using Amazon Textract within our AWS environment. We have opted out of AWS using this content to improve its own services.
• We do not send student work to consumer or public AI services such as ChatGPT, Gemini or Claude.
• We do not use Student Data to train, fine-tune or improve any AI model, including models of our own.
• We do not allow AI providers or other subprocessors to use Student Data for their own advertising, profiling, model training or unrelated commercial purposes.
• AI analysis can be wrong. LearningPulse is designed to support an educator's professional judgment, not replace it. LearningPulse does not assign grades or scores, make admission decisions, determine placement, discipline students, make eligibility decisions, including special education eligibility, or make other automated decisions about students. Any decision with a significant effect on a student remains subject to meaningful review by the school. Educators review the analysis and decide what, if anything, to do with it.

6. How we share information

6.1 Student Data

We share Student Data only when necessary to provide LearningPulse, when the school directs us to, when the law requires it, or in a merger or acquisition as described below.

Before we allow a service provider or subprocessor to process Student Data on our behalf, we evaluate the privacy and security protections relevant to the service it will provide. We require subprocessors that process Student Data to enter into written agreements requiring them to:

• Process Student Data only to provide services to gotLearning.
• Protect Student Data using appropriate administrative, technical and organizational safeguards.
• Not sell Student Data or use it for advertising, profiling or unrelated commercial purposes.
• Not use Student Data to train or improve AI models.
• Limit access to Student Data to personnel who need it to provide the service.
• Delete or return Student Data as required by our agreement with them and our obligations to schools.

We remain responsible for managing our subprocessors consistent with our obligations to schools. No subprocessor receives Student Data for any purpose of its own.

The following subprocessors process Student Data for LearningPulse:

We will notify schools at least 30 days before adding a new subprocessor that will process Student Data, unless a school agreement requires a different notice period. Schools may contact us for additional information about a new subprocessor. A school may object on reasonable grounds during the notice period. If we cannot resolve the objection, the school may end its subscription with a pro rata refund of prepaid fees, and we delete its Student Data as described in Section 9.

We may also share Student Data:

• With authorized users at the school. Teachers see the classes they teach. School and district administrators see what the school's settings allow for their role, which may include student work across a district's schools.
• With services the school or educator connects, such as Google Classroom or Canvas, only as necessary for the integration to work and only as the school or educator directs.
• When the school directs us, for example by asking us to return its data, export it or transfer it to another provider.
• When the law requires it, such as in response to a valid subpoena, court order or other legally binding request. Unless prohibited by law, we notify the school before disclosing Student Data so the school has an opportunity to respond.
• In connection with a merger, acquisition, reorganization or sale of the business that provides LearningPulse, but only as part of that business and only to a successor that agrees in writing, on or before the transfer, to honor this policy and the school's agreement with respect to Student Data. Student Data is never sold or transferred on its own. Because these transactions are usually confidential until they close, we notify affected schools as soon as we are legally permitted to, and no later than the date the transfer takes effect. Within 30 days after that notice, a school may end its subscription without penalty, with a pro rata refund of prepaid fees, and have its Student Data deleted as described in Section 9. In an insolvency, receivership or dissolution, we will not voluntarily transfer Student Data except subject to these commitments, and we will notify schools promptly so they can export or delete it.

We do not otherwise disclose Student Data to third parties.

6.2 Information from Google

LearningPulse's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use information received from Google APIs only to provide the features authorized by the user and the school. We do not use information received from Google APIs for advertising or to develop, improve or train generalized AI models.

6.3 Other information

We share educator, website and business information with service providers that help us run our business, such as:

• Webflow, for website hosting.
• Zoho, for customer relationship management and marketing messages.
• Google, for website analytics, form spam protection through reCAPTCHA and business productivity tools.
• Zoom, for demo scheduling and webinars.
• Sales engagement tools, for sending outreach to educators and school leaders.
• Stripe, for credit card payments.

These providers may use the information only as permitted by their agreements with us and applicable law. They do not receive Student Data unless they are separately identified as a Student Data subprocessor under Section 6.1.

We may also share this information when the law requires it, to protect the rights and safety of our users and others, or in connection with a merger or acquisition.

We do not sell personal information, and we do not share personal information for targeted advertising.

7. De-identified and aggregate information

• We do not use Student Data, including de-identified Student Data, for product development, research, marketing or any purpose beyond providing LearningPulse to the school.
• We may create aggregate statistics about how LearningPulse is used, such as the number of analyses run or which features are used most. These statistics never include the content of student work and cannot reasonably be used to identify a student, educator or school. We use them to run and improve the Services and may describe them publicly.
• We do not name a school in any case study, research publication, benchmarking report or marketing material without the school's written permission.
• We will not attempt to re-identify de-identified data, and we will not share de-identified Student Data with anyone else.
• We do not use Student Data in research, including federally funded research.

8. Cookies and website analytics

Our website at gotlearning.com uses cookies and similar technologies to:

• Run the site and remember your choices.
• Understand how visitors use the site, through Google Analytics, with Google's advertising features turned off.
• Protect our forms from spam, through Google reCAPTCHA. reCAPTCHA is subject to the Google Privacy Policy and Terms of Service.

LearningPulse itself uses only the cookies needed to sign you in, keep your session secure and remember your settings. It does not use third-party analytics, advertising or tracking cookies.

You can block or delete cookies in your browser settings, though some website features may not work without them. Our website does not currently respond to "Do Not Track" browser signals.

9. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, and we do not keep any information about children indefinitely. This section is our data retention policy.

Schools can access, export, correct or direct the deletion of their Student Data at any time. On request, we provide Student Data, including analysis, in a commonly used, machine-readable format at no additional charge. Deletion covers student work, analysis and any embeddings or indexes derived from them. Backup copies remain protected under this policy until they are deleted. A school that wants student work kept after its agreement ends, for example for student portfolios, can tell us in writing before the deletion window closes. When a school asks us to delete Student Data, we confirm in writing once it is done.

10. How we protect information

We use administrative, technical and organizational safeguards designed to protect the confidentiality, integrity and availability of Student Data and other personal information.

• Data is encrypted in transit and at rest.
• LearningPulse is hosted on AWS in the United States.
• Role-based access means each user sees only what their role allows.
• Multi-factor authentication is required for administrative and production access.
• Each school's data is logically separated from other schools' data.
• Staff access to Student Data is limited to people who need that access to operate, secure or support LearningPulse.
• Personnel with access to Student Data are subject to confidentiality obligations and receive training concerning student privacy and data security.
• We maintain a written information security program and regularly review our safeguards.
• We require subprocessors that process Student Data to maintain appropriate security protections.
• We use data minimization and retention controls intended to limit the Student Data we keep and how long we keep it.
• Schools can request our security documentation at any time.

No system can guarantee absolute security. If we confirm that Student Data has been accessed, acquired or disclosed without authorization, we will notify the affected school without unreasonable delay and no later than 72 hours after confirmation, unless applicable law or our agreement with the school requires earlier notice.

Our notice will include the information reasonably available to us about what happened, the information involved, the steps we have taken to contain and investigate the incident, and actions the school may need to consider.

We will cooperate with the school regarding notifications to parents, students, regulators or others where required by law or the school's agreement. We will also notify other affected individuals when applicable law requires us to do so.

11. Children's privacy (COPPA)

LearningPulse is a service for schools. Students do not create LearningPulse accounts or sign directly into LearningPulse.

We do not knowingly collect personal information directly from children under 13 through LearningPulse. Student Data about children under 13 is provided to us by schools or educators acting on behalf of schools for educational purposes.

Consistent with the Children's Online Privacy Protection Act (COPPA) and Federal Trade Commission guidance, a school may authorize the collection and use of personal information from students under 13 on behalf of parents when LearningPulse is used for the school's educational purposes and the information is not used for another commercial purpose.

When a school authorizes LearningPulse to process information about students under 13:

• We use the information only to provide LearningPulse to the school and for the educational purposes the school authorizes.
• We do not use children's information for advertising, profiling for commercial purposes or other unrelated commercial purposes.
• We do not sell children's personal information.
• We disclose children's information only to authorized school users, subprocessors identified in Section 6, services the school directs us to interact with, or where disclosure is otherwise permitted or required by law.
• We retain the information only as described in Section 9.
• The school may ask us to provide access to, correct or delete personal information associated with a child, and we will assist the school in responding.
• The school may direct us to stop further collection or use of a child's personal information and delete information we already hold, subject to applicable legal requirements and the school's agreement.
• We make available to schools the information they reasonably need to provide parents with notice about how LearningPulse collects, uses and discloses children's information.

Parents who want to review their child's information, correct it or have it deleted should normally contact their child's school. If a parent contacts us directly, we will work with the school to respond.

If we learn that we collected personal information directly from a child under 13 without appropriate school or parental authorization, we will stop the collection and delete the information as required by law.

12. FERPA, PPRA, state student privacy laws and requests from parents and students

FERPA

Under FERPA, parents and eligible students have the right to inspect and review education records and to request correction of records they believe are inaccurate or misleading.

Those requests ordinarily go to the school. When a school asks us to help it respond, we provide the relevant Student Data promptly and within any timeframe required by our agreement with the school.

We do not claim ownership of education records or use personally identifiable information from those records for purposes unrelated to the educational services the school has authorized.

Protection of Pupil Rights Amendment

LearningPulse does not independently administer surveys to students and does not use Student Data for advertising or marketing to students.

If a school uses LearningPulse to process student work or other materials that are subject to the Protection of Pupil Rights Amendment (PPRA), we process those materials only at the school's direction and assist the school with its applicable obligations.

The school remains responsible for determining whether a particular assignment, survey, analysis or activity requires parental notice, consent or an opportunity to opt out under PPRA.

State student privacy laws

We comply with state student privacy laws that apply to LearningPulse, including requirements that may apply under laws such as:

• California's Student Online Personal Information Protection Act and Education Code Section 49073.1.
• New York Education Law Section 2-d.
• Illinois' Student Online Personal Protection Act.
• Other state student privacy and education-record laws applicable to the schools we serve.

Where state law requires additional contractual terms, disclosures, notices or parent rights, we address those requirements through our agreement with the school, including applicable state versions of the National Data Privacy Agreement or other district-required data privacy agreements.

Nothing in this policy limits a right provided by an applicable state student privacy law or by a school's agreement with us.

Parents and students may also contact us at privacy@gotlearning.com. When a request concerns Student Data controlled by a school, we will route the request to the school and assist the school in responding.

13. Educators who use LearningPulse on their own

An educator should not upload identifiable Student Data to LearningPulse unless the educator is authorized by the school or district to use LearningPulse for that purpose.

If you use LearningPulse as an educator without a separate agreement between gotLearning and your school or district, you represent that:

• You are acting within the scope of your role for the school.
• You are authorized by the school to use LearningPulse with the Student Data you provide.
• Your use complies with your school's policies and applicable law.
• You will provide only the Student Data reasonably necessary for the educational purpose for which you are using LearningPulse.

When an authorized educator provides Student Data, we treat that information under every Student Data commitment in this policy. We process the information on behalf of the educator's school and not for our own independent purposes.

Where no data privacy agreement between us and the school governs that Student Data, every Student Data commitment in this policy still applies in full, and we will sign the school's data privacy agreement on request.

If we learn that an educator did not have authority to provide identifiable Student Data, we may suspend the educator's ability to process Student Data and will work with the school to determine the appropriate disposition of that information, including deletion where appropriate.

A school may contact us at any time regarding Student Data provided by one of its educators. We will cooperate with the school concerning access, correction, export or deletion of that Student Data.

We encourage educators to bring LearningPulse through their school's technology and privacy approval process. We are glad to provide security documentation and enter into the school's required data privacy agreement.

14. Your choices and privacy rights

• Educators can view and update account information in LearningPulse settings and can ask for a copy of their information or its deletion by contacting privacy@gotlearning.com. If your account is part of a school agreement, some requests go through your school.
• Marketing. You can opt out of marketing messages at any time.
• State privacy rights. Depending on where you live, including California, New Jersey and other states with consumer privacy laws, you may have the right to know what personal information we have about you, get a copy of it, correct it, delete it, and appeal if we decline your request. Contact us at privacy@gotlearning.com. We verify your identity before acting, respond within 45 days (with an extension where the law allows), and never treat you differently for making a request. You may use an authorized agent. Because we do not sell personal information or share it for targeted advertising, there is nothing to opt out of. Requests about Student Data go to the school that provided it.

15. Users outside the United States

LearningPulse is primarily designed for schools in the United States. Unless we agree otherwise in writing, Student Data processed through LearningPulse is hosted and processed in the United States.

Privacy and data protection requirements differ by country. This Privacy Policy is primarily written to describe our practices and commitments for U.S. schools and should not by itself be interpreted as representing that LearningPulse satisfies every requirement applicable to schools outside the United States.

Schools outside the United States, including international schools, should contact us before providing Student Data so that we can determine what additional contractual and data protection requirements apply.

Where required and agreed with the school, those terms may include a data processing agreement addressing matters such as:

• The school's and gotLearning's respective roles under applicable privacy law.
• The purposes and instructions for processing personal information.
• Data subject rights.
• Security and confidentiality requirements.
• Subprocessors.
• Data retention and deletion.
• International transfers of personal information.
• Appropriate transfer mechanisms, such as Standard Contractual Clauses, where applicable.

We do not rely on this Privacy Policy alone to establish compliance with the European Union General Data Protection Regulation, the United Kingdom GDPR or other non-U.S. privacy laws.

16. Changes to this policy

We post every update here with a new "Last updated" date. If we make a material change to how we handle Student Data, we notify schools at least 30 days before it takes effect, and we do not apply it to Student Data we already hold without the school's consent where our agreement or the law requires it. For other material changes, we notify account holders before the change takes effect. Previous versions are available on request.

17. Contact us

Questions, requests or concerns about privacy:

Privacy:privacy@gotlearning.com

Mail: OneSpot Learning, Inc. d/b/a gotLearning, Attn: Privacy, 741 Conestoga Road, Bryn Mawr, PA 19010