Student Privacy Commitments

These commitments govern Ilmiya’s handling of information about learners using services supplied through schools, education organizations, tutoring centers, and independent educators (Customers). They are supported by the contractual safeguards in the Data Protection Addendum and the related privacy notices.

The commitments apply to information processed through the curriculum, learning tools and infrastructure the Customer selects, including services delivered under its own branding. They continue throughout the applicable retention period.

Student Data means information about an identifiable learner handled through a Customer’s Ilmiya services. It includes education records and, where enabled, messages, voice recordings, transcripts, and AI interactions.

Ilmiya accepts the responsibility that comes with handling information entrusted to it by educational institutions and families. Our service supports instruction and the work around a learner. Student information must serve the authorized educational purpose and the learner’s interests throughout that relationship.

These are Ilmiya’s own public commitments, supported by the Master Service Agreement and DPA. They do not claim membership in a third-party pledge program, certification, or government endorsement.

Our Commitments

1. Collection and Use of Student PII

Ilmiya processes Student Data under the Customer’s documented lawful instructions, including the support and security necessary to provide the authorized service. Collection must be limited to what that purpose reasonably requires. Before enabling access, the Customer must establish lawful school authorization or obtain and document the required parental or other permission. Ilmiya provides the direct notice and retains its own operator duties. A tutoring center or independent educator cannot assume school consent authority solely because it provides education.

2. No Sale of Student PII

We will not sell Student Data or use or disclose it for advertising. We will not build learner profiles for purposes beyond the education and administration the Customer has authorized.

3. No Behavioral Advertising

Student information must not be used for behaviorally targeted advertising. This restriction applies to Ilmiya and to providers handling Student Data on its behalf. An institution’s authorization to use a learning service does not authorize an advertising business to track its students.

4. Restrictions on Student Profiling

Profiles derived from assignments, assessments, or other learning activities must remain within the education and administration the Customer has lawfully authorized. They must not be used to identify prospective customers or conduct unrelated commercial research. A student’s or parent’s general approval cannot expand the purposes permitted by the DPA.

5. Policy Changes with Notice

We will give appropriate advance notice before a material change affects Student Data and obtain new consent where required. A new webpage cannot expand an existing Customer’s processing instructions or remove its contractual protections. If Ilmiya is acquired, protections for previously collected Student Data must continue.

6. Retention and Deletion

The Customer sets a lawful retention schedule for its documented educational or operational purpose. We recommend reviewing and removing accounts inactive for more than 12 months unless continued access has a documented purpose. Closing a person’s account does not automatically erase shared records that the Customer still lawfully needs.

We complete a valid, sufficiently specific Customer deletion request within 30 calendar days after receipt, or sooner where law requires, with only the DPA’s limited exception for a binding legal preservation duty. After service ends, a restricted recovery copy may remain for a documented lawful transition or recovery need within the original purpose for up to 12 months, with earlier deletion on request, when the need ends, or when the law requires. The DPA explains these periods and their limits.

We will not keep children’s personal information indefinitely. The specific collection purpose must still reasonably require it; a general preference to retain records does not extend that purpose. Any legally required retained copy must remain protected and limited to that duty.

7. Transparency

Our notices must explain what information a feature uses, who receives it, and how long it is kept. Voice recordings and transcripts require separate consideration. An AI conversation remains subject to privacy safeguards even when it is used only to generate an answer. Learning records may reveal religious beliefs, health, or disability information. The controller must identify any additional legal condition those details require; a general account approval does not supply it.

These descriptions must be accessible to the institutions and families using the service. Information about a new feature must be supplied before the new collection begins, with any required separate permission. A white-label presentation must still identify Ilmiya where operator notice is required.

8. Access and Correction

We will help with requests to see, correct, or delete information and with any legal right to stop further collection. For records your school or educator controls, requests usually go through them. We will help and respond directly where the law requires. Identity checks must protect the student and other people’s information. Children have rights of their own, and parents’ authority to act depends on the applicable law and the child’s capacity. The Global Privacy Policy explains additional rights, response periods, and how to raise a complaint.

9. Data Security

We will use safeguards appropriate to Student Data, including encryption and permissions based on need. Our DPA specifies the minimum security duties. Providers that handle Student Data must accept the relevant protections in writing, and Ilmiya remains responsible for their duties under the DPA.

We will maintain a comprehensive security program with administrative, technical, and physical safeguards appropriate to the information’s sensitivity. It must address unauthorized access, use, disclosure, loss, or destruction, and remain subject to the DPA’s information and audit provisions.

10. Support for Institutions and Families

We will provide resources to help schools, educators, and families protect Student Data when using the Services. These include our direct notice, privacy information, and the institutional notice and consent resources. We will explain the privacy choices and request routes relevant to the enabled service. The Customer continues to administer its own notices, consent process, access permissions, and records.

11. Vendor Accountability

We will require providers processing Student Data for Ilmiya to accept written protections appropriate to their work, including confidentiality, security, purpose limits, and return or deletion. The DPA governs provider changes, objections, and Ilmiya’s responsibility for its Subprocessors. A provider’s further use cannot override the restrictions on advertising or model training.

12. Successor Entities

If a merger, acquisition, or other permitted corporate transaction transfers Student Data, Ilmiya must ensure that the successor is legally bound to protect previously collected information under the applicable commitments and DPA. The transaction does not authorize a new purpose. Required notices, authorizations, and transfer safeguards continue to apply.

13. Privacy by Design

We will incorporate privacy and security into the development and improvement of the curriculum, software, and infrastructure used to provide our Services. Feature design must consider the information needed, access limits, retention, and the consequences for children and other learners. Proposed changes remain subject to the Customer’s authorized scope and any notice, consent, or assessment required before processing begins.

14. Control over AI and Voice

Our providers must not train their models using Customer Data. Ilmiya does not currently train models using Customer Data. A proposal for future customer-specific model customization requires a separate written scope and any additional lawful authorization before it begins. A general agreement to use Ilmiya does not authorize that future activity. Voice and AI services are optional. Learners may decline them and retain the core learning service.

Additional Considerations

These commitments permit adaptive learning and personalized education within the Customer’s lawful instructions and the safeguards described here. A learning feature may use progress or assessment information to provide an authorized educational response. That permission does not extend to general-purpose model training, unrelated profiling, or a future customer-specific customization that has not been separately authorized.

Applicable law and agreed contractual terms can impose additional protections. They cannot be avoided by classifying a service as educational or obtaining general permission from a parent. These commitments cover information handled in existing Services as well as new uses, and continue while the information remains in Ilmiya’s custody under the applicable retention rules.

COPPA and Other Legal Requirements

Where COPPA applies, covered collection must follow a legally permitted school-authorization or parental-consent route, with the required direct notice. The Customer administers the authorization and evidence for its learners; Ilmiya retains its own statutory duties as the operator. School authorization is limited to its permitted educational purpose. A tutoring center or independent educator cannot assume the authority of a qualifying school.

The School and Institution Consent framework explains these responsibilities, and the FTC’s COPPA guidance provides further information. Other applicable data protection and education-record laws continue to protect learners within their scope.

Definitions

School service provider means an organization that provides an online application, service, or website for educational institutions and processes identifiable student information through it. These commitments also cover Ilmiya’s Services supplied through the other Customers identified above.

Educational purposes means the instruction, assessment, administration, and associated support and security that the Customer has lawfully authorized under the Agreement. Product development or improvement involving identifiable Student Data must remain within that agreed purpose and its applicable restrictions.

Student PII means personally identifiable information about a learner, including covered information under applicable student-privacy law. It falls within the broader Student Data definition above. Information can remain identifiable through its content or links to other records even after direct names are removed.

Parent means a parent or legal guardian entitled to act for the learner under applicable law. An eligible student’s independent rights and any lawful restriction on a parent’s authority remain protected.

These commitments supplement the detailed privacy notices. Customers may enforce the obligations incorporated into their agreements, and nothing here limits enforcement powers or individual rights under applicable law.

Read the detail or contact us

The Children’s and Students’ Privacy Notice explains data categories and family rights. School and Institution Consent explains authorization. The DPA governs the contractual processing duties; the Global Privacy Policy also covers website and business information.

Customer Data is hosted, stored, and processed in the United States. The DPA and provider register describe that standard arrangement and the requirements for changes or restricted transfers.

Ilmiya serves learners in the US, the UK, and countries in Europe and Africa. Applicable privacy duties cover current services as well as new uses. We and the Customer must verify the lawful basis, processing locations, and required safeguards for the service. These commitments do not establish an international transfer mechanism or certify compliance in every country. A missing legal requirement must be addressed for the affected processing. If anything is unclear, email legal@ilmiya.com or use our legal inquiry form.