Learno.Ai Privacy Policy

Revised: 12 May 2025

This privacy notice for Learno.Ai ("we," "us," or "our") describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:

• Visit our website at , or any website of ours that links to this privacy notice
• Engage with us in other related ways, including sales, marketing, or events

Questions or concerns? Reading this notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have questions or concerns, contact us at .

Summary of key points

• Personal information we process ▶︎ We process different personal data depending on how you interact with our Services.
• Sensitive data ▶︎ We process sensitive "student data" only with consent or as the law otherwise permits.
• Thirdparty sources ▶︎ We receive roster data from SIS/LMS integrations only when a school chooses that option.
• Processing purposes ▶︎ We process data to operate, secure, improve, and market our Services, and to comply with law.
• Sharing ▶︎ We share data only in specific situations and with vetted service providers.
• Security ▶︎ We use technical and organisational measures to protect your data, but no system is 100 % secure.
• Your rights ▶︎ Depending on where you live, you have rights such as access, correction, deletion, and objection.
• Student data ▶︎ We use Student Personal Data and StudentCreated Content solely for educational purposes and never for targeted advertising.

What information do we collect?

Personal information you disclose to us

We collect personal information you provide, such as:

• names, email addresses, usernames, passwords, Google profile pictures
• chat history with our AI chatbots
• any other information you choose to give us (e.g. feedback or support queries)

We also process student data (see ).

Information automatically collected

We automatically collect device and usage data (IP address, browser, device type, OS, referring URLs, timestamps, pages viewed, etc.) and use cookies or similar tech for analytics and security. See our .

Do we receive any information from third parties?

Only when a school enables SIS/LMS roster sync. We receive first name, last name, email, and class enrolments for the purpose of provisioning accounts.

How do we process your information?

We use personal information to:

• create and manage accounts; authenticate users
• deliver educational content and features
• provide support and respond to inquiries
• send administrative or legal notices
• process payments (if applicable)
• request feedback and conduct research
• send marketing (with your consent or as allowed by law)
• maintain security, detect fraud, and enforce terms
• analyse usage and improve our Services
• comply with legal obligations

Data location. All data are stored on servers located in India. Subprocessors outside India must provide adequate safeguards (e.g. Standard Contractual Clauses).

We retain data only as long as necessary; then we delete or anonymise it.

What legal bases do we rely on to process your personal information?

Where the GDPR or similar laws apply, we rely on the following legal bases:

If you are in Canada, we rely on express or implied consent, or other exemptions under PIPEDA. You may withdraw consent at any time.

When and with whom do we share your personal information?

We only share data:

• Service providers that help us run the Service under strict dataprocessing agreements (e.g. hosting, analytics, email delivery, customer support). Our key providers are:
• Google Workspace & Cloud Platform (identity, email, hosting)
• Microsoft Entra ID (SSO)
• Intercom (inapp support chat)
• Google Analytics (usage analytics)
• Business transfers if we merge, sell, or restructure. The successor must honour this notice.
• Legal compliance to meet applicable law, court orders, or defend legal claims.
• Other users when you post in public or shared areas (e.g. class discussions).

We do not sell personal information or use it for thirdparty advertising.

Do we use cookies and other tracking technologies?

Yes. Cookies, pixels, and localstorage help us remember preferences, secure sessions, and measure usage. You can control cookies in your browser settings. See our .

How do we handle your social logins?

If you choose to sign in with a Google or Microsoft account, we receive basic profile data (name, email, profile picture) from that provider as permitted by their terms. We use these data only to create or authenticate your Learno.Ai account. Your socialmedia provider's privacy policy governs their use of your data.

How long do we keep your information?

We keep data only for as long as your account is active plus 90 days (for backup integrity), unless a longer retention period is required by law. Backups are automatically purged on a 90day rolling basis.

How do we keep your information safe?

We employ:

• encryption in transit (TLS 1.2+) and at rest (AES256)
• leastprivilege, rolebased access controls
• continuous vulnerability scanning and annual penetration tests
• 24×7 infrastructure monitoring and logging
• signed dataprocessing agreements with all subprocessors
• staff security training and background checks

No system is perfect; if we discover a breach we will notify affected users and authorities as required by law (see ).

What are your privacy rights?

Depending on your location, you may have the right to:

• access the personal data we hold about you
• correct inaccurate or incomplete data
• delete your data (the "right to be forgotten")
• restrict or object to processing
• data portability
• withdraw consent at any time
• lodge a complaint with your local dataprotection authority

To exercise any right, email [email protected] or use the inapp "Privacy request" link. We will respond within one month (or the timeframe required by local law).

Optout of marketing

Click "unsubscribe" in any marketing email or adjust your notification settings in your profile.

Controls for donottrack features

Your browser may send a "DNT" signal. Because there is no common standard, we do not currently respond to DNT signals. If standards emerge, we will update this notice.

Do United States residents have specific privacy rights?

Certain U.S. states provide additional rights. If you are a California, Connecticut, or Virginia resident, you may have rights to know, delete, correct, and limit use of your personal information, and to optout of the sale or sharing of personal information. We do not sell personal information. To exercise any U.S. state right, email with the subject "US Privacy Request".

Shine the Light (CA Civ. Code §1798.83). We do not share personal data with third parties for their direct marketing.

How do we respond to security incidents?

We operate an incidentresponse plan aligned with ISO 27001. In the event of a breach that affects your data, we will inform you via email, our status page, and/or inproduct notices without undue delay, describing what happened, what data were involved, and steps you can take.

How do we define and use student data?

"Student Personal Data" means information that is both personally identifiable and directly related to a student's educational record. "StudentCreated Content" includes any work a student produces using our platform (essays, code, chat messages, recordings, etc.). We:

• use Student Data solely to provide and improve educational services
• never use Student Data for targeted ads or behavioural marketing
• do not sell or disclose Student Data to third parties (except vetted processors required to deliver the Service)
• allow schools to control, access, correct, and delete Student Data at any time

We comply with COPPA, FERPA, and applicable studentdataprivacy statutes.

How is Student Personal Data collected from students?

Student Personal Data may be provided by the school (roster sync) or directly by the student (account creation). We collect only the minimum data necessary—typically name, school email, class enrolments, and usage logs.

What Student Personal Data is collected and how is it used and shared?

We deidentify and aggregate usage data for analytics; aggregated data are not linked back to any student.

How is StudentCreated Content collected, used, and shared?

StudentCreated Content is stored securely, visible to the student, their teachers, and authorised school staff, and used only for educational purposes (grading, feedback, portfolio). Students (or their parents, if the student is under 18) may export or delete their content on request.

Do we make updates to this notice?

Yes. We will update this notice when necessary. We will post the revised version with a new "Revised" date and, if the changes are material, notify you via email or inapp alert.

How can you contact us about this notice?

How can you review, update, or delete your data?

Submit a request via the inapp "Privacy request" link or email [email protected]. We will verify your identity and respond within the timeframe required by law.

Generated with Termly's PrivacyPolicy Generator and adapted for Learno.Ai.