Privacy Policy

Brightfold builds software that empowers schools. This Privacy Policy explains how Brightfold ("we," "us," or "our") collects, uses, shares, and protects information when schools, districts, and their authorized users visit our websites or use our products, including Teacher Certification [PQ ESSA], School Climate Dashboard, Brightfold Gateway, and Brightfold Scholar (together, the "Services").

We make sure your student, employee, financial, and all other district data is used in an ethical, secure, and responsible way. We support the principles of the Student Privacy Pledge, and we designed the Services to comply with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and applicable state student privacy laws.

If your school or district has signed a separate agreement with us, such as a data privacy agreement, that agreement controls over this policy wherever the two conflict.

1. Information we collect

School and account information

When a school registers for the Services, we collect information such as the names and email addresses of administrators and staff, the name and address of the school or district, account credentials, and phone numbers. We also keep records of your correspondence with us and of account activity so we can operate, maintain, and provide the features and functionality of the Services.

Student Data

In the course of providing the Services we may receive personally identifiable information about students ("Student Data"), such as enrollment records, course assignments, or survey responses. We access Student Data only as requested by the school and only to perform the Services on the school's behalf. We consider Student Data to be confidential and we do not use it for any purpose other than providing the Services. Student Data is collected, used, and shared in accordance with FERPA, COPPA, applicable state laws, and the instructions of the school.

Usage and device information

Like most online services, we and our service providers automatically collect certain technical information when you use the Services, such as your IP address, browser type, operating system, device identifiers, the pages you view, and the actions you take. We collect this information using cookies and similar technologies to keep the Services secure, understand how they are used, and improve them.

2. How we use information

We use the information we collect to:

• Operate, maintain, and provide the features and functionality of the Services
• Create and administer accounts, respond to questions, and provide support
• Send service announcements, such as updates about features, maintenance, or security
• Monitor and secure the Services, and prevent fraud and abuse
• Understand usage and improve the Services, including through aggregated and de-identified analytics
• Comply with legal obligations

We use Student Data only to provide the Services on the school's behalf. We do not use Student Data for targeted advertising, we do not build advertising or behavioral profiles of students, and we do not sell Student Data.

3. AI features

Some of our products use artificial intelligence. Brightfold Scholar uses AI models to generate content such as lesson plans and worksheets, and Brightfold Gateway routes, inspects, and logs traffic between your district and the AI tools your district chooses to allow. When you use these features, the prompts and content you submit are processed to deliver the response or capability you requested.

• We do not use Student Data to train artificial intelligence or machine learning models
• The AI model providers that power our own features process data under terms that prohibit them from using it to train their models
• Content processed by our AI features is retained only as long as needed to deliver the feature and keep the Services secure

Third-party AI tools that your district connects through Brightfold Gateway remain governed by those vendors' own privacy policies and by your district's agreements with them. Gateway gives your district visibility and control over that traffic, and we encourage schools to review each vendor's terms.

AI-generated content can contain mistakes. Educators should review outputs before relying on them or sharing them with students.

4. How we share information

We share information only in the limited circumstances described below:

• Within your school or district, among users the school has authorized
• With service providers who help us operate the Services, such as hosting, analytics, and email providers, who are bound by confidentiality obligations and may use the information only to provide services to us
• When required by law, such as in response to a subpoena or court order, or when necessary to protect the safety and rights of users, the public, or Brightfold
• In aggregated or de-identified form that cannot reasonably be used to identify an individual
• In connection with a merger, acquisition, or sale of assets, in which case we will require the successor to honor the commitments in this policy and will notify affected schools

We do not rent or sell your information. We will never share or sell Student Data, employee data, or school data with third parties for marketing purposes.

5. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences, and measure how the Services are used, including through analytics tools such as Google Analytics. You can set your browser to refuse cookies or to alert you when cookies are being sent, though some parts of the Services may not function properly without them. We do not use advertising cookies, we do not serve targeted advertising, and we do not permit analytics providers to use Student Data for advertising purposes.

6. Data storage and security

Your information is stored and processed in the United States. We use administrative, technical, and physical safeguards designed to protect it, including:

• Encryption of data in transit and at rest
• Role-based access controls that limit what each authorized user can see and do
• Network protections and monitoring, with physical security managed by the data centers of our cloud hosting providers

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security breach that results in the unauthorized disclosure of Student Data, we will promptly notify the affected school(s) and provide the information the school needs to respond, consistent with applicable law and our agreements.

7. Data retention and deletion

We retain personal information only as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. When a school's account is terminated, we delete or de-identify the Student Data associated with the account at the school's direction, consistent with our agreements and applicable law. We may retain aggregated or de-identified information that does not identify any individual.

8. Your choices and rights

• School administrators can review and update account information in the Services or by contacting us
• Anyone can opt out of promotional email by using the unsubscribe link in the message; we will still send transactional and service messages
• Parents, guardians, and eligible students who want to review, correct, or delete Student Data should contact their school, and we support schools in responding to these requests

Depending on where you live, you may have additional rights under applicable law, such as the right to access or delete personal information we hold about you. To exercise these rights, contact us using the details below.

9. Children's privacy

The Services are designed for use by schools and their staff. We do not knowingly collect personal information from children under 13 unless and until a school has obtained appropriate consent, and schools may provide consent on a parent's behalf for the use of the Services in an educational context, as permitted by COPPA. If you believe we have collected information from a child without appropriate consent, contact us through our support page and we will promptly investigate and delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will give schools at least 30 days advance notice by email or through the Services, so schools can review the changes and, if they choose, stop using the Services before the new policy takes effect. We will update the effective date at the top of this page whenever the policy changes.

11. Contact us

If you have questions about this Privacy Policy or how we handle your information, reach out any time.

• Online: Contact our support team
• Mail: Brightfold, ATTN: Privacy, 8000 Avalon Blvd, Suite 100, Alpharetta, GA 30009