Coursekit

Privacy Policy

Part of the Data Privacy and AI Governance trust center.

Draft for counsel review. Engineering draft for education-privacy attorney review — not final legal advice until counsel signs off.

Privacy Policy

DRAFT — PENDING EDUCATION-PRIVACY COUNSEL REVIEW
Effective date (proposed): August 14, 2026
Controller / Service provider: The AI Systems Architect LLC
Products: Coursekit and Studian

Plain-language companion (not a substitute for this policy): https://mycoursekit.com/data-privacy

1. Scope

This Privacy Policy describes how we collect, use, disclose, and protect personal information when Institutions and End Users use Coursekit and Studian. For education records subject to FERPA, the Institution’s DPA with us governs and controls if there is a conflict.

2. Roles

  • Institution decides purposes for student education records and directs our processing.
  • Company processes education records as a school official / service provider under the Institution’s instructions and the DPA.
  • For website visitors and prospective customers (not education records), we act as a business collecting limited business-contact data.

3. Information we collect

3.1 Account and profile

Name, email, password hash, MFA secrets (encrypted), role/affiliation, institution association, authentication events (including IP address and user agent on login and security events).

3.2 Educational and product use data

Course enrollments, assignments, materials metadata, Studian chat messages and session metadata, study plans, flashcards, learning preferences/memories, competency progress, credentials, AI usage metadata, audit-log entries.

3.3 Uploads

Files uploaded by faculty or students (assignments, materials). Files are stored on the application servers with access controls; malware scanning may be applied where enabled.

3.4 Technical data

Cookies/session tokens necessary for authentication and security; server logs; security telemetry (WAF/bot events at the edge).

3.5 Communications

Emails we send via Microsoft Graph (invitations, password reset, product updates) and related delivery metadata.

We do not knowingly collect information from children under 13.

4. How we use information

  • Provide, secure, and improve the Services
  • Authenticate users; prevent abuse; enforce rate limits and MFA
  • Deliver Institution-directed educational features (including AI tutoring under Institution settings)
  • Comply with law and respond to lawful Institution instructions
  • Communicate service and security notices

We do not sell personal information. We do not use education records for targeted advertising or for training foundation models on customer content except where a written Institution agreement expressly allows a different arrangement (default: no training on customer content; see subprocessors’ ZDR/API terms).

5. AI processing

When AI features are enabled, prompts and necessary context may be sent to LLM subprocessors listed at /legal/subprocessors. Institutions can configure model availability and related controls in-product. We apply outbound PII pattern detection to reduce accidental leakage; no filter is perfect.

6. Sharing

We share information with:

  • Subprocessors needed to run the Services (hosting, email, AI) — see /legal/subprocessors
  • The Institution that provisions the account (faculty/admin visibility into Studian activity as designed)
  • Professional advisors and insurers under confidentiality
  • Authorities when required by law, or to protect rights and safety

7. Retention

We retain account and education data while the account/subscription is active and as directed by the Institution. After deletion requests or contract end, we delete or return education records per the DPA (typically within the contractual window) and retain de-identified audit evidence where required for security/compliance. Specific TTL jobs may apply to logs and export artifacts.

8. Security

Safeguards include TLS in transit, encryption of sensitive secrets at rest, access controls and MFA, login throttling, security headers, Cloudflare WAF/bot protections, append-only compliance audit logging, and account self-service deletion. See also /governance.

9. Your choices and rights

  • End Users: access/export and deletion features in-product (e.g., Studian data export, account deletion); also contact your Institution.
  • Institutions: administrative controls, export, and deletion instructions under the DPA.
  • California / state privacy laws: where applicable to non-education-record business data, contact [email protected]. Education records are primarily governed by FERPA and the Institution’s policies.

10. Cookies

We use first-party authentication and security cookies. See /legal/cookies. We do not use third-party advertising cookies.

11. International transfers

Services are hosted in the United States. Institutions outside the US should not use the Services until appropriate transfer mechanisms are agreed in writing.

12. Changes

We will post updates at /legal/privacy and update the effective date. Material changes affecting Institutions will follow DPA notice terms.

13. Contact

Privacy / legal: [email protected]
Security: [email protected]
The AI Systems Architect LLC

Draft only — not legal advice. Counsel must finalize before institutional reliance.