Privacy Policy for Core Learning Exchange

1. Information Collection

The Core Learning Exchange platform gathers three types of data:

• Personal Information: Names, email addresses, and other details provided during account registration and management, or received from a single sign-on (SSO) or roster provider your institution has enabled
• Learning Data: Lesson progress, answers, written responses, quiz and assessment scores, and messages exchanged with the Socrat Tutor Agent. If a student chooses to use the microphone, spoken input is converted to text so the tutor can respond; see “AI Tutoring (Socrat Tutor Agent)” below.
• Technical Data: IP addresses, browser information, and usage analytics for performance optimization

2. Single Sign-On & Authentication

Core Learning Exchange supports signing in through third-party identity providers and single sign-on (SSO) services — including, but not limited to, Google, Microsoft (Entra ID), Apple, Clever, ClassLink, and learning management systems that connect via the LTI standard (Canvas, Moodle, D2L, Blackboard). Your institution decides which providers are enabled.

What we receive

When you sign in through an SSO or LTI provider, we receive only the identity attributes needed to create and manage your account and to place you in the correct course or roster — typically your name, email address, a unique account identifier, and your role (for example, student, teacher, or administrator). Where a provider supplies roster or class information (such as Clever, ClassLink, or an LMS), we use it solely to provision access.

What we do not receive

We never receive or store your password or login credentials for a third-party provider. Authentication happens on the provider's systems; we receive only a verified confirmation of your identity and the attributes described above. We do not access your files, contacts, mailbox, or other data in your third-party account.

Your provider's privacy terms

Your use of a third-party identity provider is governed by that provider's own privacy policy and terms. To review or revoke Core Learning Exchange's access, or to manage connected apps, use your identity provider's account or security settings. Revoking access does not delete data already held by Core Learning Exchange — to request that, see the “User Rights” section below.

3. Data Usage

Information we collect is used to:

• Provide and manage platform access
• Personalize learning experiences
• Communicate about account activities and updates
• Provide customer support
• Improve our services through usage analysis

What we never do

4. Data Protection

We implement industry-standard security measures including:

• SSL encryption for all data transmission
• Secure servers protected by firewalls
• Restricted access to personal information
• Regular security audits and updates

5. Data Ownership & Compliance

Core Learning Exchange acknowledges customer and institutional data ownership and commits to complying with:

• FERPA (Family Educational Rights and Privacy Act): Protecting student educational records
• COPPA (Children's Online Privacy Protection Act): Safeguarding children's personal information, with schools acting as agents for parental consent where applicable
• State student-privacy laws: Including California's SOPIPA and comparable state statutes governing student data

Upon institutional request, we will execute a Student Data Privacy Consortium (SDPC) National Data Privacy Agreement (NDPA) or a district's equivalent data privacy agreement.

We do not use student data for advertising, marketing, or behavioral targeting, and we do not build student profiles for any purpose other than delivering the educational service.

Educational institutions retain ownership of all student data. We act as a custodian of this data and use it solely for providing educational services.

6. User Rights

You have the right to:

• Access your personal data
• Modify or update your information
• Request deletion of your data
• Export your data

These rights can be exercised through your account settings or by contacting our support team at support@corelearningexchange.com. For student records, requests are generally directed through the student's educational institution, which controls the data.

7. Data Retention

After six months of inactivity without institutional directive, student data will be securely destroyed with prior notification to the school or institution. Institutions may also request deletion of their data at any time, which we will complete within a commercially reasonable period.

Teacher and administrator account data is retained while the account is active and deleted upon request or after account closure. Residual copies in routine backups are purged in the normal course of our backup rotation.

8. AI Tutoring (Socrat Tutor Agent)

How the AI works and what it receives

Socrat Tutor Agent is an AI tutor built on large language models provided by third-party AI companies. When a student interacts with it, the student's messages, the lesson content being discussed, and the student's language and reading-level settings are sent to these providers to generate text and voice responses. We send only what is needed to answer the student. Personally identifying information stays in your school's system: AI providers see only pseudonymized identifiers, never a student's name or email address. These providers process the data on our behalf under contractual data processing agreements that prohibit them from using it for their own purposes.

Our current AI providers are:

• Anthropic (Claude) — text responses, tutoring dialogue, and scoring of written work
• ElevenLabs — text-to-speech voice for tutor responses
• HeyGen — video avatars used in some practice and coaching activities
• Google — machine translation for languages without a reviewed language pack

Spoken input from the microphone is converted to text by the speech-recognition service built into the student's web browser (for example, Google in Chrome or Apple in Safari), under that browser's privacy terms. Students can always type instead of speaking.

How the models are trained

• Core Learning Exchange does not train, fine-tune, or build AI models using student data or any other user data.
• Our AI providers do not use student interaction data to train their models. Our agreements with them prohibit it.
• The providers' underlying models are trained by those providers on their own data, as described in their published documentation. We shape the tutor's behavior with written instructions and the lesson content our curriculum team authors — not with student data.

You will always know when you are using AI

Socrat Tutor Agent tutors, coaches, and practice characters are AI, not people, even when they have a name, a voice, or a video avatar. Every lesson that uses AI opens with an “About AI in this lesson” notice, which stays available from an “AI in this lesson” button. The notice lists each AI tool active in the lesson and what it is used for, the privacy framework that applies, and the lesson's provenance.

You can turn AI off

Students can turn off AI tutoring, click-to-read, and AI grading in any lesson from the same notice. The lesson stays completable without them.

AI-assisted scoring and your right to review

Some written responses and practice activities are scored with the help of AI, and those scores may be reported to your institution's learning management system. When AI contributes to a score:

• Notice: the activity tells the student that AI is helping to score it.
• Explanation: the student receives feedback explaining the reasons for the score, tied to the activity's rubric.
• Human review and appeal: a student (or parent or guardian) may ask their teacher to review any AI-assisted score. Educators can change any score in their institution's learning management system (LMS) gradebook, and the educator's decision is final. Students may also contact support@corelearningexchange.com, and we will route the request to the institution.
• AI is never the sole basis for course grades, placement, credit, credential decisions, or discipline. Those decisions belong to educators and the institution.

Protections for young learners

• Safety guardrails: AI tutoring used by learners under 18 is limited to educational topics and declines inappropriate requests, including attempts to bypass its rules.
• Crisis support: if a student's message suggests they may be in crisis or at risk of harm, the tutor immediately shares crisis resources — in the United States, the 988 Suicide & Crisis Lifeline — in the student's language and appropriate to their region.
• A tutor, not a companion: Socrat Tutor Agent is designed for learning, not friendship or emotional companionship. It does not encourage personal relationships, and it steers conversations back to the lesson. AI companion chatbots are not appropriate for every young person, and Socrat Tutor Agent is not one.

Retention

• We do not sell AI interaction data.
• AI conversation transcripts are retained to support learning continuity and mastery tracking, are subject to the “Data Retention” section above, and institutions may request their deletion at any time.

9. Research Use of De-identified Data

Some institutions choose to take part in our Socrat Tutor Agent research pilot, which studies whether AI tutoring improves learning outcomes. Research data is used only when the participating institution has agreed to it in writing. Before any data is used for research, it is de-identified: names, email addresses, account identifiers, and other information that could reasonably identify a student are removed, and results are reported only in aggregate. We do not attempt to re-identify de-identified data, and we contractually prohibit research partners from doing so. Data from institutions that have not joined the pilot is never used for research.

10. Third-Party Services

We share data only with service providers who help us operate the platform, and only the data each one needs. They are bound by written agreements to use it solely on our behalf and to keep it confidential and secure.

We do not sell or rent your personal information to third parties. Our principal service providers are Amazon Web Services (hosting and storage), the identity and roster providers your institution enables, and the AI providers listed under “AI Tutoring (Socrat Tutor Agent).” Platform data is stored in the United States. A complete, current list of sub-processors is available on request from support@corelearningexchange.com.

Identity & SSO providers

When enabled by your institution, we rely on identity and roster providers to authenticate users and provision access. See the “Single Sign-On & Authentication” section above for details on what we receive and do not receive.

AI service providers

Our Socrat Tutor Agent AI tutoring features rely on third-party AI providers to generate text and voice responses. See the “AI Tutoring (Socrat Tutor Agent) Data” section above for details.

YouTube API Services

Our authoring platform (Studio X) uses YouTube API Services to help our curriculum team discover relevant, embeddable educational videos to include in lessons. Because we use YouTube API Services, the following terms apply:

• By using our services and any embedded YouTube content, you agree to be bound by the YouTube Terms of Service.
• Google's handling of data is described in the Google Privacy Policy.

What we access and store

We access YouTube only through our own developer API credentials to retrieve public video information — video IDs, titles, channel/attribution details, thumbnails, and a video's embeddable status. We use this to present candidate videos to a curriculum author, who reviews and selects which (if any) to embed. We do not access, request, collect, or store any information from your personal Google or YouTube account, and we do not download, re-host, or store YouTube video content. The only YouTube data we retain is the public ID and attribution of a video a reviewer has chosen to embed in a lesson.

Embedded video playback

Lessons may display YouTube videos using YouTube's official embedded player. When you play an embedded video, YouTube and Google may set cookies and collect usage data on your device in accordance with the Google Privacy Policy. This activity is controlled by Google, not by Core Learning Exchange.

Your choices and data deletion

Because we do not access your Google account, there is no Core Learning Exchange authorization to revoke on the Google side. To review or remove data Google has collected, or to manage app access to your Google account, visit your Google account security settings. To request deletion of any data we hold about you, see the “User Rights” section above or contact support@corelearningexchange.com.

11. Cookies and Tracking

Learning platform

The learning platform uses only the cookies and local storage needed to sign you in, keep your session, and save your progress and preferences. It uses no advertising cookies and no third-party analytics. The one exception is the embedded YouTube player, which may set Google cookies when a video is played, as described under “Third-Party Services.”

Marketing website

Our public marketing website (corelearningexchange.com) uses HubSpot analytics cookies to understand how visitors use the site and to manage inquiries submitted through our forms. This website is intended for educators and institutions, not students. Data from the marketing website is never combined with student data from the learning platform. You can block or delete these cookies through your browser settings.

12. Security Incident Notification

We maintain an incident response process. If a security incident results in unauthorized access to student data or other personal information, we will notify the affected institution without undue delay and no later than 72 hours after confirming the incident, unless a shorter period is required by contract or applicable law. The notice will describe what happened, what data was involved, the steps we have taken, and a contact for questions. We will cooperate with the institution in notifying affected students, families, and authorities as the law requires.

13. Policy Updates

Changes to this privacy policy will be posted on this page with a new “Last Updated” date. For material changes, we will notify institutions and account holders by email or in-platform notice at least 30 days before the change takes effect.

We will not make a material change to how we collect, use, or share student data without first obtaining the consent of the institution that controls that data. Until consent is given, existing student data remains governed by the policy under which it was collected.

14. Contact Information

For questions about this privacy policy or our data practices, please contact:

Email: support@corelearningexchange.com
Phone: (303) 732-8155