PRIVACY NOTICE

1. INTRODUCTION

Inform(Ed) (“Company,” “we,” “our,” or “us”) delivers a cloud-based software-as-a-service platform that enables educational institutions to record, transcribe, analyze, and improve classroom teaching and learning activities (the “Platform”). Protecting the privacy and security of the students, educators, administrators, and other individuals (“Users”) whose information we process is foundational to our business. This Privacy Notice describes, in plain but comprehensive terms, how we collect, use, disclose, store, and secure personal information when we act as a “School Official” under the Family Educational Rights and Privacy Act (“FERPA”) and as a “Service Provider” under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA/CPRA”)—and, where relevant, as a “Processor” under the EU/UK/Switzerland data protection regulation (in particular the “GDPR”), which is provided under our European Privacy Policy.

2. SCOPE

This Notice applies to information processed through, the Platform and any associated mobile or desktop applications; customer support interactions (email, ticketing portals, chat, or phone); and professional services (implementation, training, or consulting) that we provide to subscribing schools, school districts, colleges, or universities (each a “Client”).

When we process Student Education Records (as that term is defined in FERPA) or other personal information on behalf of a Client, we do so solely at the Client’s direction and for no purpose other than providing the contracted services. We do not determine the means or purposes of processing those records; thus, the Client remains the data controller/educational agency.

3. DEFINITIONS (KEY TERMS)

“Personal Information” means any data that identifies or relates to an identifiable individual and is subject to an applicable privacy law.

“Student Data” means Personal Information that is directly related to a present or former student and is maintained by a school or educational agency, including education records subject to FERPA.

“Employee Data” means information about educators, teaching assistants, administrators, or other staff members provided by a Client to facilitate access to or use of the Platform.

Aggregated Data” means de-identified data that is combined so that it no longer identifies or could reasonably be used to identify an individual. Aggregated Data is not Personal Information.

4. Information We Collect

We do not knowingly collect sensitive biometric identifiers, precise geolocation, or payment card data.

5. Legal Bases for Processing (GDPR)

Where the GDPR applies (as provided more fully in our EU Privacy Policy) we rely on the following legal bases:

• Performance of a Contract – Processing is necessary to deliver the Platform under our service agreement with the Client.
• Compliance with Legal Obligations – Certain disclosures are required to comply with education, child-protection, or data-protection laws.
• Legitimate Interests – Limited analytics to maintain platform integrity, detect fraud, or improve security, provided such interests are not overridden by students’ or educators’ rights.
• Consent – Where a Client instructs us to process optional footage (e.g., extracurricular recordings) that falls outside core educational purposes.

6. How We Use Personal Information

• Service Delivery & Core Functionality – To record classes, generate transcripts, index content for search, and provide analytics dashboards.
• Product Improvement – To debug, benchmark, and refine speech-to-text accuracy, natural-language processing, and engagement algorithms using Aggregated Data.
• Customer Support – To resolve technical issues, fulfil requests, and send critical service notifications.
• Security & Integrity – To monitor for suspicious activity, detect and mitigate cybersecurity threats, and enforce Platform policies.
• Compliance & Enforcement – To cooperate with a Client’s lawful instructions, court orders, or regulatory inquiries.

We never:

• display behavioral advertising to students;
• create or augment marketing profiles of students;
• sell or “share” Personal Information for cross-context behavioral advertising under CPRA; or
• re-identify Aggregated Data without specific, written Client authorization.

7. HOW WE DISCLOSE INFORMATION

• To the Client (School or District). All classroom recordings, analytics results, and user audit trails are available to authorized school personnel through the administrative console.
• For Legal or Safety Reasons. We may disclose Personal Information if (a) required by federal, state, or local law; (b) necessary to protect the physical safety of a child or other individuals; or (c) mandated by court order, subpoena, or law enforcement request, provided we give the Client reasonable prior notice unless legally prohibited.
• Business Transfers. In a merger, acquisition, reorganization, or bankruptcy, Personal Information may be transferred to the successor entity, subject to the same or higher commitments described in this Notice.
• With Consent. Any other sharing will occur only with the Client’s explicit written direction or the data subject’s consent, as applicable.

We impose contractual restrictions prohibiting third parties from selling, retaining, or using Personal Information for any purpose other than delivering the contracted services.

8. DATA RETENTION & DELETION

We retain Personal Information only for (i) the duration specified in the Client’s service order or data-retention schedule, or (ii) as needed to comply with our legal obligations—whichever is longer. Upon a Client’s written request, or within sixty (60) days after service termination, we will:

• delete or de-identify Student Data from active systems;
• purge encrypted backups within an additional thirty (30) days; and
• certify completion of deletion to the Client.

Exceptions apply where law requires preservation (e.g., ongoing litigation holds).

9. INFORMATION SECURITY

We maintain an information-security program aligned with NIST SP 800-171 and ISO/IEC 27001 frameworks, featuring:

• AES-256 encryption for data at rest and TLS 1.2+ in transit;
• strict role-based access control (“RBAC”) with least-privilege principles;
• multi-factor authentication for privileged accounts;
• continuous vulnerability scanning by an independent firm;
• SOC 2 Type II audit of key controls and, where required, FERPA and HIPAA physical- security safeguards;
• documented incident-response plan with 24-hour breach notification to affected Clients.

10. CHILDREN’S AND STUDENTS’ PRIVACY

• FERPA Compliance. We act as a “School Official” with a “legitimate educational interest,” and Student Data remains under the control of the originating educational agency.
• COPPA Compliance. For children under 13, consent is obtained from the school (acting as the parent’s agent) prior to collection, in accordance with 16 C.F.R. § 312.5(c).
• tate Student Privacy Laws. We adhere to statutes such as the New York Education Law § 2-d, Colorado Student Data Transparency and Security Act, and similar state laws restricting data commercialization and mandated security procedures.

11. INDIVIDUAL RIGHTS & CHOICES

We do not discriminate against individuals who exercise their privacy rights.

12. INTERNATIONAL DATA TRANSFERS

In the event Personal Information is transferred outside the country of origin (for example, from the EEA/UK to the United States) we rely on:

• Standard Contractual Clauses (2021/914/EU) plus UK Addendum, supplemented by transfer-impact assessments and technical safeguards; or
• Adequacy Decisions by the European Commission or UK Government (e.g., for Canada).

We continuously monitor legal developments and will implement any additional safeguards required by regulators, including the EU-U.S. Data Privacy Framework if applicable.

13. COOKIES & SIMILAR TECHNOLOGIES

We deploy strictly-necessary cookies for authentication and session management. Optional analytics cookies, when enabled by the Client, are restricted to first-party usage statistics and do not track users across unaffiliated services. Browser “Do-Not-Track” signals are honored where required by law. You may disable non-essential cookies in the in-app privacy settings panel.

14. THIRD-PARTY LINKS AND INTEGRATIONS

The Platform may integrate with third-party learning-management systems (LMS), video- conferencing tools, or single-sign-on providers at the Client’s election. We are not responsible for the privacy practices of those third parties, and any data exchanged is governed by the third party’s terms and policies. We recommend Clients review the privacy notices of integrated services before activation.

15. CHANGES TO THIS PRIVACY NOTICE

We may revise this Notice to reflect changes in legal requirements, technology, or our business operations. Material changes will be communicated to Clients at least thirty (30) days in advance via email or in-product banner, and the “Effective Date” above will be updated. Continued use of the Platform after the effective date constitutes acceptance of the revised Notice.

16. CONTACT US

Privacy Officer

Thomas Flynn Mulvoy

Gotthardstrasse 102

6490 Andermatt,

Switzerland

Email: tommy@edinformed.com

If you believe we have not resolved a privacy concern, you may lodge a complaint with your local data-protection authority or the U.S. Federal Trade Commission.

17. SUPPLEMENTAL DISCLOSURES FOR CALIFORNIA RESIDENTS

We do not sell or share Personal Information in the meaning of CPRA, nor do we process sensitive Personal Information except to perform our contractual obligations.

18. RECORD OF PROCESSING ACTIVITIES (GDPR ARTICLE 30)

A detailed ROPA covering purposes, categories, recipients, storage periods, and security measures is maintained internally and is available to supervisory authorities and Clients upon legitimate request.

19. NOTICE TO END USERS

If your educational institution provides you with access to the Platform, that institution is responsible for your account administration. Please direct any privacy questions to the institution’s designated administrator first; we will cooperate fully to address your inquiry.

Inform(Ed) is proud to serve the educational community and is committed to continuous improvement of our privacy and security posture. Should you have any questions about this Privacy Notice or our data governance practices, please contact us at the details provided above.