Attorney Review Draft - Not Final

EduQuest Privacy Policy

Effective Date: June 4 2026 | Last Updated: June 4 2026

EduQuest, Inc. provides an AI-powered K-12 educational platform for teachers, parents, guardians, homeschool families, students, schools, and districts. This draft describes EduQuest's intended privacy practices assuming its compliance controls are completed before publication.

Do not publish this page as final until counsel verifies the verifiable parental consent process, FERPA and DPA terms, subprocessor list, retention schedule, breach-notice process, AI oversight controls, and security representations.

1. Introduction

EduQuest, Inc. ("EduQuest," "we," "us," or "our") provides an AI-powered K-12 educational platform for teachers, parents, guardians, homeschool families, students, and schools. EduQuest helps authorized adults create classes, generate curriculum and learning quests, review student work, track skill mastery, and support student learning.

This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use EduQuest's website, applications, and related services (collectively, the "Service").

Because EduQuest is used in K-12 educational settings, we treat student information with heightened care. We design our practices to support compliance with the Children's Online Privacy Protection Act ("COPPA"), the Family Educational Rights and Privacy Act ("FERPA") where applicable, state student privacy laws such as California's Student Online Personal Information Protection Act ("SOPIPA"), and related educational privacy and security obligations.

This Privacy Policy is intended for use in the United States. EduQuest does not currently describe the Service as intended for users outside the United States. If EduQuest later supports international users, this policy should be updated before launch.

2. Roles Covered by This Policy

This policy applies to:

  • Teachers and educators who create classes, upload educational materials, assign quests, review AI-generated content, and view student progress.
  • Parents and guardians who create or manage accounts, authorize student use, enroll students, monitor learning activity, or manage billing.
  • Students who use EduQuest to complete assignments, participate in tutoring or goal-setting conversations, submit work, receive feedback, and view progress.
  • Schools and districts that authorize or procure EduQuest for educational use.
  • Visitors who browse public EduQuest pages or join a waitlist.

When EduQuest is used by or on behalf of a school or district, student information may be controlled by the school or district. In those cases, EduQuest acts as a service provider or school official as described in Section 8.

3. Information We Collect

We collect only the information reasonably necessary to provide, secure, support, and improve the Service for educational purposes.

3.1 Account Information

Depending on your role, we may collect:

  • Name.
  • Email address.
  • Username.
  • Password hash and authentication information.
  • Role, such as student, teacher, or parent/guardian.
  • Grade level or age band where needed for student onboarding and COPPA compliance.
  • School, class, or period membership.
  • Parent/guardian relationship information where needed to authorize or manage a student account.
  • Trial, membership, and billing status for parent and teacher accounts.

We do not intend to collect more precise age information than is needed for age screening, consent, and educational setup.

3.2 Student Learning Information

EduQuest may collect student information needed to provide learning features, such as:

  • Class enrollment and teacher/parent associations.
  • Assigned quests, curriculum, lessons, concepts, skills, and mastery records.
  • Student submissions, answers, uploaded work, and related timestamps.
  • AI-generated and educator-reviewed feedback, rubric results, scores, grades, and mastery indicators.
  • Long-term goal conversation history and learning profile information.
  • Tutoring or profile-building conversation content.
  • Progress, completion, and engagement information needed for educational reporting.

Student learning information is used for educational purposes only. We do not use student learning information for targeted advertising or commercial profiling.

3.3 Teacher, Parent, and School Content

Teachers, parents, guardians, and school users may provide:

  • Course names, descriptions, and schedules.
  • Uploaded curriculum files, syllabi, lesson materials, slides, worksheets, and related metadata.
  • Canvas LMS course information when a teacher connects Canvas.
  • Class rosters, invite codes, enrollment records, and parent-student links.
  • Feedback, messages, support requests, and administrative notes.

Users should avoid uploading unnecessary personal information, sensitive information, medical information, special education records, or other data that is not needed to use the Service.

3.4 Billing Information

EduQuest uses Stripe to process memberships and subscriptions for parent and teacher accounts. We may receive and store limited billing-related information from Stripe, such as:

  • Stripe customer ID.
  • Stripe subscription ID.
  • Subscription plan, status, and renewal or trial dates.
  • Payment event metadata needed to keep membership status accurate.

EduQuest does not store full payment card numbers. Stripe processes payment card information under Stripe's own privacy and security terms.

3.5 Authentication, Cookies, and Device Information

We collect information needed to keep accounts secure and operate the Service, including:

  • Session cookies and authentication tokens.
  • Browser and device information.
  • IP address and request metadata.
  • Security, rate-limit, and fraud-prevention signals.
  • Logs needed to diagnose errors, prevent abuse, and investigate security events.

For student users, we limit use of persistent identifiers to support the Service, authentication, security, internal operations, and educational purposes.

3.6 Analytics and Product Usage Information

EduQuest may use privacy-filtered analytics to understand whether the Service is working, improve reliability, and prioritize product improvements. Analytics events are designed to use structural information, such as role, event type, class or period ID, feature usage, and non-content counts.

EduQuest does not intentionally send student free-text content, chat content, quest answers, file names, goal text, or direct student PII to product analytics tools. Analytics is not used to target advertising to students.

3.7 Waitlist and Public Website Information

If you join a waitlist, contact us, or use public pages, we may collect:

  • Name and email address.
  • Role or interest category.
  • Organization or school information if you provide it.
  • Referral or waitlist status.
  • Public website usage information needed to operate and secure the website.

4. How We Use Information

We use information to:

  • Create, authenticate, and manage accounts.
  • Provide student onboarding, age screening, and parent or school authorization flows.
  • Create and manage classes, enrollments, curriculum, lessons, quests, and schedules.
  • Provide tutoring, profile-building, goal-setting, grading, feedback, and skill-mastery features.
  • Allow teachers, parents, guardians, and schools to review and support student progress.
  • Generate AI-assisted educational content and recommendations, subject to human oversight where consequential.
  • Process parent and teacher billing, memberships, trials, subscriptions, and Stripe webhooks.
  • Send transactional emails, such as password reset messages, account notices, and service updates.
  • Provide customer support and respond to privacy requests.
  • Maintain security, prevent abuse, enforce access controls, and investigate incidents.
  • Audit access to student education records and support FERPA-style accountability.
  • Improve, debug, and evaluate the Service using de-identified, aggregated, or privacy-filtered information.
  • Comply with legal, regulatory, contractual, and school or district obligations.

We do not use student personal information for targeted advertising. We do not sell student personal information. We do not use identifiable student data to train third-party foundation models.

5. Student Privacy Commitments

EduQuest makes the following commitments for student information:

  • We collect student information only as needed for educational purposes, security, compliance, and internal operations.
  • We do not sell student personal information.
  • We do not use student personal information for targeted advertising.
  • We do not create student profiles for non-educational commercial purposes.
  • We do not knowingly allow advertising networks to track students in authenticated student areas.
  • We do not disclose student information except as described in this policy, authorized by a parent/guardian, school, or district, or required by law.
  • We require vendors that process student information to use it only to provide contracted services to EduQuest.
  • We maintain access controls so users can access only the information appropriate for their role.
  • We support access, correction, deletion, and export requests as described below.

6. Children's Privacy and COPPA

EduQuest may be used by children under 13 only with appropriate authorization.

6.1 School-Authorized Use

When a school or district authorizes EduQuest for students under 13, the school or district may provide consent on behalf of parents where permitted by COPPA and applicable law. EduQuest relies on the school or district to provide required notices, obtain any required consents, and authorize EduQuest to collect student information solely for educational purposes.

6.2 Direct Parent or Homeschool Use

When EduQuest is used directly by a parent or guardian for a child under 13, EduQuest requires verifiable parental consent before collecting personal information from the child, except for limited information used only to initiate the consent process or as otherwise permitted by COPPA.

EduQuest's VPC process is: [INSERT COUNSEL-APPROVED VPC PROCESS AND PROVIDER].

Where COPPA requires separate consent for disclosing a child's personal information to third parties, EduQuest will provide clear notice and obtain the required consent before making those disclosures.

6.3 Parent Rights Under COPPA

Parents and guardians may contact EduQuest to:

  • Review personal information collected from their child.
  • Request correction or deletion of their child's information.
  • Refuse further collection or use of their child's information.
  • Ask questions about EduQuest's child privacy practices.

Requests may be sent to support@eduquestai.org. EduQuest may need to verify your identity and authority before responding.

7. Family Educational Rights and Privacy Act

When EduQuest receives or processes student education records from or on behalf of a school or district subject to FERPA, EduQuest acts as a school official with a legitimate educational interest, as defined by the applicable school or district agreement.

In that context, EduQuest:

  • Uses education records only to provide the Service and as authorized by the school or district.
  • Does not re-disclose education records except as authorized by the school or district, permitted by FERPA, or required by law.
  • Uses access controls to limit education-record access to authorized users with a legitimate educational purpose.
  • Maintains audit logs for access to student education records.
  • Supports schools and districts in responding to eligible student and parent requests to inspect, review, correct, export, or delete education records, as applicable.
  • Deletes or returns education records as required by the applicable agreement and retention schedule.

Schools and districts remain responsible for their own FERPA notices, annual notifications, directory information policies, and determinations about parent or eligible student rights.

8. AI and Automated Processing

EduQuest uses AI to support educational features such as:

  • Curriculum and schedule generation.
  • Quest and rubric generation.
  • Tutoring and student-support conversations.
  • Student profile and goal-setting support.
  • Feedback and grading assistance.
  • Skill mastery and progress insights.

EduQuest's AI is designed to assist teachers, parents, guardians, and students. It is not a substitute for educator or parent/guardian judgment.

Where an AI output could materially affect a student's grade, mastery record, learning path, educational opportunity, or similar consequential educational outcome, EduQuest requires educator or parent/guardian review before the output is treated as final.

EduQuest does not use identifiable student information to train third-party foundation models. Before sending student information to external AI providers, EduQuest minimizes and anonymizes student PII where reasonably feasible for the feature.

EduQuest maintains model cards or equivalent AI documentation for production AI systems, including intended use, limitations, oversight mechanisms, and risk-management practices. AI documentation location: [INSERT MODEL CARD OR AI TRANSPARENCY URL].

9. How We Disclose Information

EduQuest discloses information only as needed to provide, secure, support, and comply with obligations related to the Service.

9.1 Authorized Users

We disclose information to authorized users based on role and relationship, such as:

  • Students seeing their own quests, submissions, feedback, and progress.
  • Teachers seeing information for students in their classes.
  • Parents and guardians seeing information for children linked to their account.
  • School or district administrators seeing information authorized by their agreement and role.

9.2 Service Providers and Subprocessors

EduQuest uses service providers to host, store, secure, analyze, communicate, and operate the Service. These may include providers for:

  • Database hosting and application infrastructure.
  • File storage.
  • Transactional email.
  • Payment processing.
  • AI processing.
  • Learning management system integrations.
  • Privacy-filtered analytics.
  • Security, logging, and support.

Current subprocessor list: [INSERT SUBPROCESSOR LIST URL].

EduQuest requires subprocessors that process student information to use it only to provide services to EduQuest, protect it appropriately, and comply with applicable contractual restrictions. EduQuest documents DPA status and student-data terms for subprocessors. DPA process: [INSERT DPA PROCESS OR LINK].

9.3 AI Providers

EduQuest may disclose minimized or anonymized educational context to AI providers to generate or evaluate educational content. EduQuest does not permit AI providers to use identifiable student data to train third-party foundation models unless expressly authorized by the applicable school, parent/guardian, and law, and this policy is updated to describe that practice.

9.4 Billing Providers

EduQuest discloses parent and teacher billing information to Stripe as needed to process memberships, subscriptions, checkout, billing portal access, and subscription events.

9.5 Legal, Safety, and Compliance

We may disclose information if we believe it is reasonably necessary to:

  • Comply with law, legal process, subpoenas, court orders, or government requests.
  • Enforce our Terms of Service or agreements.
  • Protect the rights, safety, or security of EduQuest, users, students, schools, or others.
  • Investigate fraud, abuse, security incidents, or unauthorized access.
  • Complete a merger, acquisition, financing, reorganization, or sale of assets, subject to protections required by law and applicable student-data agreements.

10. Cookies, Tracking, and Analytics

EduQuest uses cookies and similar technologies for:

  • Authentication and session management.
  • Security and fraud prevention.
  • Remembering basic user or application settings.
  • Measuring product reliability and feature usage.

EduQuest does not use student information for targeted advertising. EduQuest does not knowingly place advertising trackers in authenticated student areas.

EduQuest may use PostHog or similar analytics, including privacy-masked session replay, configured to avoid collecting free-text student content and direct student PII. Analytics events are intended to be structural and privacy-filtered, and replay is not intentionally enabled in authenticated student areas, authentication flows, password reset flows, invite flows, or privacy-policy pages.

Browser "Do Not Track" settings are not standardized. Where legally required, EduQuest will honor applicable opt-out or preference signals. EduQuest does not use student data for cross-context behavioral advertising.

11. Security

EduQuest uses administrative, technical, and organizational safeguards designed to protect personal information, including student information. These safeguards include:

  • Role-based access controls.
  • Authentication and session protections.
  • Encryption in transit and at rest where supported by infrastructure providers.
  • Audit logging for access to student records.
  • Least-privilege access practices.
  • Security monitoring and incident response procedures.
  • Vendor review for subprocessors that process student information.
  • Controls designed to support SOC 2-style security practices.

EduQuest does not claim SOC 2 certification in this policy unless and until certification is complete and verified.

No system can be guaranteed to be 100% secure. If you believe your account or student information may have been compromised, contact support@eduquestai.org.

12. Data Retention

EduQuest retains personal information only for as long as reasonably necessary to provide the Service, meet the educational purpose for which it was collected, comply with legal or contractual obligations, resolve disputes, enforce agreements, and maintain security.

Student information is retained according to the applicable school agreement, parent authorization, retention schedule, or legal requirement. EduQuest does not retain children's personal information indefinitely.

Retention schedule: [INSERT COUNSEL-APPROVED RETENTION TABLE].

At a minimum, the retention table should address:

  • Account records.
  • Authentication and session logs.
  • Age-screening and consent records.
  • Student profiles and learning records.
  • Quest submissions, grades, feedback, and skill mastery records.
  • AI conversation and tutoring records.
  • Uploaded curriculum and class files.
  • Analytics events.
  • Audit logs.
  • Billing records.
  • Support requests.
  • Deleted account backups or legal holds.

When information is no longer needed, EduQuest deletes, de-identifies, or aggregates it according to the applicable retention schedule and legal requirements.

13. Access, Correction, Export, and Deletion

Parents, guardians, eligible students, teachers, schools, and account holders may request access, correction, export, or deletion of personal information, subject to identity verification, role authorization, school control, legal requirements, and technical limitations.

Requests may be sent to support@eduquestai.org.

13.1 Parent and Guardian Requests

Parents and guardians may request to:

  • Access information associated with their linked child.
  • Correct inaccurate child information.
  • Export child information where available.
  • Delete a child account or child information, subject to school requirements and legal retention obligations.
  • Withdraw consent for future collection or use where applicable.

13.2 School and District Requests

Schools and districts may request return, deletion, correction, or export of student education records according to their agreement with EduQuest.

If a parent or eligible student contacts EduQuest about information controlled by a school or district, EduQuest may direct the request to the school or district or work with the school or district to respond.

13.3 Account Deletion

Account deletion may remove or de-identify account information and associated data, subject to:

  • School or district record-retention instructions.
  • Legal holds.
  • Security and audit log retention.
  • Billing and tax record requirements.
  • Backup deletion cycles.
  • Information needed to prevent fraud or enforce agreements.

EduQuest may retain de-identified, aggregated, or anonymized information that cannot reasonably identify an individual or student.

14. State Student Privacy Commitments

EduQuest applies student privacy protections designed to satisfy strict U.S. student privacy expectations, including SOPIPA-style protections. For K-12 student information, EduQuest does not:

  • Use student information for targeted advertising.
  • Sell student information.
  • Use student information to create commercial profiles unrelated to the educational purpose.
  • Disclose student information except as needed to provide the Service, as authorized, or as required by law.

EduQuest maintains reasonable security procedures and retention practices appropriate to the nature of student information.

15. De-Identified and Aggregated Information

EduQuest may use de-identified, aggregated, or anonymized information to:

  • Improve Service reliability and usability.
  • Understand educational feature performance.
  • Develop new educational features.
  • Conduct internal research and analytics.
  • Report aggregate usage or learning trends.

EduQuest will not attempt to re-identify de-identified student information except as permitted by law, such as to test de-identification controls or investigate security issues.

16. Third-Party Links and Integrations

The Service may include links to third-party websites or integrations, such as Canvas, Stripe, or other learning or payment services. Third-party services have their own privacy practices. Users should review those policies before connecting or using a third-party service.

When a teacher connects Canvas or another LMS, EduQuest receives information authorized by the teacher, school, or integration settings. Teachers and schools are responsible for ensuring that they have authority to connect those services and share relevant educational information with EduQuest.

17. Changes to This Privacy Policy

EduQuest may update this Privacy Policy from time to time. The updated policy will be posted at eduquestai.org/privacy with a revised "Last Updated" date.

If changes materially affect how EduQuest collects, uses, or discloses student personal information, EduQuest will provide notice and obtain consent where required by law, school agreement, or parent authorization.

18. Contact Us

For privacy questions, requests, or concerns, contact:

  • EduQuest, Inc.
  • Email: support@eduquestai.org
  • Website: eduquestai.org
  • Mailing Address: [INSERT COMPANY MAILING ADDRESS]

For security issues, contact: [INSERT SECURITY CONTACT OR ALIAS].