Privacy Policy

1. Third-Party Websites and Services

The Services may contain links to third-party websites, applications, or services that are not owned or controlled by us. This Privacy Policy applies only to our Services and does not apply to any third-party websites or services. We are not responsible for the privacy practices of any third party. We encourage you to review the privacy policies of any third-party websites or services that you visit. The inclusion of a link to a third-party website or service does not imply our endorsement of that website or service or its privacy practices.

2. Children and Student Privacy

The Website

The Website is not intended for and does not knowingly collect any personal data from children under the age of 16. If we learn that we have collected or received personal data through our Website from a child under 16 years old without verification of parental consent, we will take reasonable steps to delete that information.

The App/Platform

The App may be used by students aged 13 or older, including students under 18, strictly for educational purposes as an authorized user of a School. For students under 18 using the App and related Services in a School context, we rely on the School to provide any notices and obtain any consent that may be required by law for School authorized educational use. Teachers may register for free accounts and invite students with their School’s permission. Teachers must confirm that their School permits this use and that each invited student is at least 13 years old. Schools and districts may purchase subscriptions for full access to the common formative assessment system.

As used in this policy, “Student Data” means personally identifiable information from student education records as defined by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, and its implementing regulations, and any other information directly related to a student and collected or maintained by us in connection with providing the Services to a School. Student Data may include student names, school-issued email addresses, student identification numbers, class or teacher assignments, student submissions (such as essays, short answers, chat messages, and debate exchanges), and other student-generated content created through use of the Services. When we process Student Data for a School, we endeavor to collect only that information that is reasonably necessary and do so solely to provide, maintain, secure, support, and improve the Services for authorized educational purposes and as otherwise permitted by applicable law. The School retains control of Student Data and, as between us and the School, such information remains the property of the School.

If a parent, guardian, or eligible student seeks access to, correction of, export of, or deletion of Student Data, we generally ask that the request be directed to the relevant School and we will work with the School to respond as appropriate.

We do not show ads, build marketing profiles, or send marketing communications to students based on Student Data.

See How We Use Your Information for more details about how we use Student Data and other information processed by the App.

3. Information We Collect

Through the Website

When you visit the Website, we may collect the following categories of information:

• Contact and inquiry information you provide, such as your name, email address, school or organization name, and the contents of any message you submit through a contact form or email.
• Device, usage, and other technical information collected automatically, such as IP address, browser type, operating system, referring URLs, pages viewed, and timestamps.
• Cookies and similar technologies used for session management, security, and basic analytics (see Cookies).

Through the App

When teachers, administrators, or students in a School use the App, we may collect the following categories of information:

Account and profile information, such as:

• Name, display name, or username.
• School-issued email address or school-managed sign-in identifier.
• Account credentials and authentication information, including password hashes for password-based accounts.
• School affiliation and role (e.g., teacher, administrator, student).

School and classroom information, such as:

• Class rosters, class names, and teacher assignments.
• Assignment information, including teacher-provided prompts, rubrics, and instructional materials.
• Account administration data provided by schools, districts, or administrators.

Student-generated content, such as:

• Student submissions, including essays, short answers, and written responses.
• Chat messages, debate responses, and other interactive content.
• Uploaded files and other work product created through use of the Services.

Device, usage, and technical information, such as:

• IP address, device identifiers and type, browser types and settings, operating system and version, preferred language, hardware identifiers, and other device information.
• Session identifiers, timestamps, and authentication events.
• Feature usage, interactions with platform tools, and similar diagnostic or log data.
• Cookies and similar technologies used for authentication, session management, security, and basic analytics.

Integration Information. If a teacher or School enables optional integrations (such as Google Classroom), we may collect and process information made available through those integrations, including:

• Google account metadata and authentication tokens.
• Teacher course lists and classroom rosters.
• Coursework posting metadata authorized through integration permissions.

We store credentials and tokens associated with optional integrations using safeguards such as encryption at rest where appropriate.

Support and communications, such as:

• Communications with us, including support requests, attachments, and screenshots.
• Operational communications, such as service notices, security alerts, and product updates.

Statistical, Aggregated, and Technical Information

We also collect:

• Statistics or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal data and Student Data. For example, we may aggregate personal data or Student Data to calculate the percentage of users accessing a specific Services feature.
• Technical information. Technical information includes information about your internet connection and usage details about your interactions with the Services, such as clickstream information to, through, and from our Services (including date and time), items that you view or search for; page response times, download errors, length of your visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from a page.

If we combine or connect non-personal statistical or technical data with personal data or Student Data so that it directly or indirectly identifies an individual, we treat the combined information as personal data or Student Data.

Information We Do Not Collect

We seek to collect only the information reasonably necessary to provide, support, secure, and improve the Services. We do not intentionally request or require users to submit:

• Social Security numbers or government identification numbers.
• Payment card data from students.
• Biometric identifiers, such as fingerprints, faceprints, voiceprints, or other physical patterns or data.
• Precise geolocation information.

Users should not submit highly sensitive personal information or protected health information through free-form fields unless their School has expressly directed that use and the applicable agreement permits it.

4. How We Collect Your Information

Directly

We collect information directly from Schools and their users when they interact or communicate with the Services.

Automatically

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include personal data or Student Data. We use cookies and similar technologies on the Website and within the Services for authentication, session management, security, load balancing, CSRF protection, preference retention, and basic analytics. We do not use cookies or similar technologies for targeted advertising. Information collected automatically may include usage details, IP addresses, operating system, and browser type, and other information collected through cookies, web beacons, and other tracking technologies, including details such as traffic data, location data, logs, and other communication data, and which resources and features of the Services that you access and use.

Using automatic collection technologies helps us to improve our Services and to deliver a better and more personalized experience. The technologies we use for this automatic data collection may include:

• Cookies. A cookie is a small file placed on your device when you interact with the Services. You may refuse to accept or disable cookies by activating the appropriate setting on your browser or device. However, if you select this setting, you may be unable to access certain features of the Services.
• Web Beacons. Some parts of the Services and our emails to teachers, administrators, and other adults may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those parts or opened an email and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity). We do not use email-open or link-click tracking in emails sent to students.

To the extent any of these automated technologies are considered a personal data sale, targeted advertising, or profiling, under applicable laws, depending on where you live, you may opt out from use of these automated technologies for such uses by contacting us at admin@whitai.app. Please note that some Services features may be unavailable as a result.

Third Parties

We may receive personal data or Student Data from other sources and combine that with information we collect directly. For example, we may receive information from third party identity, hosting, storage, analytics, infrastructure, and classroom integration providers when those tools are used in connection with the Services. We may also obtain information from service providers that we may engage to perform services on our behalf, such as email platform providers, payment processors, and security and anti-fraud services.

5. How We Use Your Information

We use the information we collect for the following purposes:

To Provide and Operate the Services, such as:

• Providing, operating, administering, and maintaining the Services.
• Fulfilling and managing purchases of the Services.
• Provisioning accounts and authenticating users.
• Managing class and school configurations.
• Enabling optional integrations (such as Google Classroom).
• Making the Services available for educational, administrative, instructional, and school operational purposes.

To Support and Communicate with Users, such as:

• Providing customer support and troubleshooting issues.
• Communicating about Service-related matters and any changes, updates, or additions to the Services.
• Sending operational or security notices.

To Secure and Protect the Services, such as:

• Monitoring performance and maintaining the reliability of the Services.
• Detecting abuse, investigating incidents, and responding to security threats.
• Enforcing our agreements and policies.
• Complying with applicable law and protecting the integrity and security of the Services.

To Improve the Services, such as:

• Estimating our audience sizes and usage patterns.
• Storing information about your preferences, allowing us to customize the Services according to your individual needs and interests.
• Developing, maintaining, analyzing, improving, optimizing, measuring, and reporting on our Services and their features and how users interact with them.
• Speeding up your searches.
• Recognizing you when you return to the Services.

Other reasons, such as:

• Fulfilling any other purpose for which you provide it.
• Carrying out our obligations and enforcing our rights arising from any contracts entered into between you and us, including for billing and collection.
• Any other way that we may describe when you provide the information.
• For any other purpose with your consent.

We may use aggregated, anonymized, or de-identified information for analytics, product improvement, benchmarking, reporting, research, reliability, and similar lawful business purposes, provided that such information does not identify, and is not reasonably linkable to, an identified or identifiable individual student or other person. We do not attempt to re-identify de-identified information.

We do not collect, use, or sell personal data, user-submitted content, or Student Data for the purpose of training artificial intelligence models, including large language models. This restriction also applies to aggregated, anonymized, or de-identified information derived from such data. We do not use personal data or Student Data to track students or Website users across other websites or services for advertising purposes.

6. How We Disclose Information

We do not sell personal data or Student Data. We do not rent Student Data, use Student Data for targeted advertising, or build profiles of students except as necessary to provide the Services or as otherwise permitted by applicable law and any agreements we may have with a School.

We may disclose aggregated information about our users and information that does not identify any individual, without restriction.

We may also disclose personal data or Student data that we collect as described in this privacy policy, including:

• To our subsidiaries and affiliates.
• To Schools, including authorized teachers, administrators, and other personnel, as necessary to provide the Services and make student work, feedback, scores, analytics, and other service outputs available in the educational context.
• To contractors, subcontractors, subprocessors, and other service providers that help us support and deliver the Services, such as for infrastructure, hosting, storage, caching, integrations, and AI agents, which service providers are contractually required to protect personal data and Student Data and may process it only for authorized purposes. A list of such service providers can be provided upon request.
• When reasonably necessary to protect users, Schools, the public, or the Services, including to investigate suspected abuse, fraud, threats, or security incidents.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or part of a bankruptcy, liquidation, or similar proceeding, in which personal data and Student Data held by us is among the assets transferred.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose personal data or Student Data:

• To comply with any court order, law, subpoena, or legal process, public records request, or similar process.
• To enforce and apply our Terms of Service, Terms of Use, and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our organization, our customers, our users, or others. 

The categories of personal data or Student Data we may disclose include:

• Contact and inquiry information, such as name, email address, and school or organization name.
• Account and profile information, such as name, display name, username, school-issued email address, account credentials, and school affiliation and role.
• School and classroom information, such as class rosters, class names, teacher assignments, assignment information, and account administration data.
• Student-generated content, such as student submissions, essays, short answers, chat messages, debate responses, uploaded files, and other work product created through use of the Services.
• Device, usage, and technical information, such as IP address, device identifiers, browser type, operating system, session identifiers, timestamps, feature usage, and diagnostic or log data.
• Integration information, such as Google account metadata, authentication tokens, teacher course lists, classroom rosters, and coursework posting metadata.
• Support and communications information, such as support requests, attachments, screenshots, and operational communications.

7. Your Rights and Choices About Your Information

You may be able to control certain uses and disclosures of your information and otherwise exercise any rights you may have under state law, depending on where you live. For example:

• Cookies and Other Tracking Technologies. Users can manage certain cookies through browser settings. You can set your browser to refuse all or some browser cookies or other tracking technology files, or to alert you when these files are being sent. If you disable or refuse cookies or similar tracking files, some features of the Services may be inaccessible or not function properly. Some browsers include a "Do Not Track" (DNT) setting that can send a signal to the online services you visit indicating you do not wish to be tracked. Because there is not a common understanding of how to interpret the DNT signal, our Services do not respond to browser DNT signals. Instead, you can use the range of other tools to control data collection and use, including the cookie controls and advertising controls described in this policy.

8. Artificial Intelligence and Automated Decision Making

The App uses artificial intelligence and related technologies, for example, to generate educational feedback, writing coaching, debate responses, formative assessment analysis, tutoring-style support, and instructional insights. In providing these features, we may send student-submitted text, teacher-provided prompts, rubrics, exemplar materials, and limited contextual metadata such as grade band, assignment type, or subject area to third-party AI agents that process such inputs to create outputs.

We do not send student names, school-issued email addresses, school IDs, school names, class identifiers, or other directly identifying student information to those AI providers in connection with these requests. Where a request must reference a student we use a non-identifying alias before the request leaves our systems. We do not authorize AI providers to use personal data, user-submitted content, or Student Data to train their models, and we do not use personal data, user-submitted content, or Student Data to train our own proprietary AI models. These restrictions also apply to aggregated, anonymized, or de-identified information derived from such data. AI-generated outputs are intended to support, and not replace, educator or administrator judgment. Teachers and other authorized school personnel should review and evaluate AI-generated content before relying on it in educational, disciplinary, placement, grading, eligibility, safety, or similarly significant contexts.

9. State Privacy Rights

We currently offer and provide the Services only in the United States. Depending on your state of residency, you may have certain rights related to your personal data, including:

• Access and portability. You may confirm whether we process your personal data and access a copy of the personal data we process. To the extent feasible and required by state law, depending on your state, data will be provided in a portable format. Depending on your state, you may have the right to receive additional information, and it will be included in the response to your access request.
• Correction. You may request that we correct inaccuracies in your personal data that we maintain, taking into account the information's nature and processing purpose.
• Deletion. You may request that we delete personal data about you that we maintain, subject to certain exceptions under applicable law.
• Opt out. You may request that we do not use your personal data for sales, targeted advertising, and profiling for certain legal or similarly significant decisions. Some states may also grant you the ability to learn more about or challenge those automated decisions.

To exercise any of these rights, please email admin@whitai.app. Be aware that the exact scope of these rights may vary by state, and certain exceptions may apply so that we may not have an obligation to fulfill your request.

10. Protecting Personal Data

We host/process all personal data and Student Data in the continental United States. We maintain reasonable administrative, technical, and physical safeguards designed to protect personal data and Student Data from unauthorized access, use, and disclosure and accidental loss, alteration, and destruction.

However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of personal data or Student Data transmitted to, through, using, or in connection with the Services. If Student Data in our care is accessed by or disclosed to an unauthorized party, we will promptly notify affected Schools and cooperate with investigation and mitigation efforts.

The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal data and Student Data against unauthorized use, disclosure, and access.

11. Retaining and Deleting Data

Personal data

We retain personal data collected through the Website only for as long as reasonably necessary to fulfill the purposes for which it was collected, or as otherwise legally permitted or required. When determining retention periods, we consider our legal and business obligations, potential risks of harm, and the nature of the information. At the end of the applicable retention period, personal data will be deleted, destroyed, or deidentified.

Student Data

We retain Student Data collected through the App only for as long as reasonably necessary to provide the Services for authorized educational purposes, or as otherwise legally permitted or required. For Schools with active subscriptions, we retain Student Data during the subscription term. Upon expiration or termination of the subscription, we will not knowingly retain Student Data beyond the period required for authorized educational or School purposes. Following termination, we will return or destroy Student Data as directed by the School, as agreed upon in a contract, or in accordance with applicable laws. Unless otherwise directed by the School, we will generally destroy or deidentify Student Data within 60 days following termination, subject to routine backup retention cycles.

12. International Users and Data Transfers

The Services are intended for users located in the United States. We are based in the United States and process and store personal data and Student Data in the continental United States.

If you are located outside the United States and choose to use the Services, you do so at your own initiative and are responsible for compliance with local laws to the extent they apply. We do not represent or warrant that the Services or any part thereof are appropriate or available for use in any particular jurisdiction outside the United States. If you access the Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the continental United States, where data protection laws may differ from those of your country of residence. By using the Services or providing us with your information, you acknowledge and consent to the transfer, storage, and processing of your information in the continental United States.

We take steps designed to ensure that personal data and Student Data receive an adequate level of protection in the continental United States. If you are a resident of the European Economic Area, United Kingdom, or Switzerland, please note that we do not knowingly offer the Services to individuals in those regions, and we do not monitor for or respond to requests under the General Data Protection Regulation or similar international privacy frameworks at this time. If you believe you have rights under applicable data protection laws, please contact us and we will consider your request in accordance with applicable law.

13. Changes to This Policy

We may update this policy from time to time, and we will provide notice of any such changes to the policy as required by law. The date the policy was last updated is identified at the top of the page. We will notify you of changes to this policy by updating the “last updated” date and posting the updated policy on the Services. We may email or otherwise communicate reminders about this policy, but you should check our Services periodically to see the current policy and any changes we have made to it.

14. Contact Us

To exercise your rights or if you have questions about this policy or our privacy practices, contact us at:

School Synergy Corporation

Email: admin@whitai.app

If you wish to report a security concern or suspected incident, you may also contact us by emailing admin@whitai.app with the word “Security” in the subject line.