1. Information Collection
The Core Learning Exchange platform gathers two types of data:
- Personal Information: Names, email addresses, and other details provided during account registration and management, or received from a single sign-on (SSO) or roster provider your institution has enabled
- Non-Personal Data: IP addresses, browser information, and usage analytics for performance optimization
2. Single Sign-On & Authentication
Core Learning Exchange supports signing in through third-party identity providers and single sign-on (SSO) services — including, but not limited to, Google, Microsoft (Entra ID), Apple, Clever, ClassLink, and learning management systems that connect via the LTI standard (Canvas, Moodle, D2L, Blackboard). Your institution decides which providers are enabled.
What we receive
When you sign in through an SSO or LTI provider, we receive only the identity attributes needed to create and manage your account and to place you in the correct course or roster — typically your name, email address, a unique account identifier, and your role (for example, student, teacher, or administrator). Where a provider supplies roster or class information (such as Clever, ClassLink, or an LMS), we use it solely to provision access.
What we do not receive
We never receive or store your password or login credentials for a third-party provider. Authentication happens on the provider's systems; we receive only a verified confirmation of your identity and the attributes described above. We do not access your files, contacts, mailbox, or other data in your third-party account.
Your provider's privacy terms
Your use of a third-party identity provider is governed by that provider's own privacy policy and terms. To review or revoke Core Learning Exchange's access, or to manage connected apps, use your identity provider's account or security settings. Revoking access does not delete data already held by Core Learning Exchange — to request that, see the “User Rights” section below.
3. Data Usage
Information we collect is used to:
- Provide and manage platform access
- Personalize learning experiences
- Communicate about account activities and updates
- Provide customer support
- Improve our services through usage analysis
4. Data Protection
All personally identifiable information (PII) that you provide to us is encrypted during transmission and when stored to prevent unauthorized access.
We implement industry-standard security measures including:
- SSL encryption for all data transmission
- Secure servers protected by firewalls
- Restricted access to personal information
- Regular security audits and updates
5. Data Ownership & Compliance
Core Learning Exchange acknowledges customer and institutional data ownership and commits to complying with:
- FERPA (Family Educational Rights and Privacy Act): Protecting student educational records
- COPPA (Children's Online Privacy Protection Act): Safeguarding children's personal information, with schools acting as agents for parental consent where applicable
- State student-privacy laws: Including California's SOPIPA and comparable state statutes governing student data
Upon institutional request, we will execute a Student Data Privacy Consortium (SDPC) National Data Privacy Agreement (NDPA) or a district's equivalent data privacy agreement.
We do not use student data for advertising, marketing, or behavioral targeting, and we do not build student profiles for any purpose other than delivering the educational service.
Educational institutions retain ownership of all student data. We act as a custodian of this data and use it solely for providing educational services.
6. User Rights
You have the right to:
- Access your personal data
- Modify or update your information
- Request deletion of your data
- Export your data
These rights can be exercised through your account settings or by contacting our support team at support@corelearningexchange.com. For student records, requests are generally directed through the student's educational institution, which controls the data.
7. Data Retention
After six months of inactivity without institutional directive, student data will be securely destroyed with prior notification to the school or institution. Institutions may also request deletion of their data at any time, which we will complete within a commercially reasonable period.
Teacher and administrator account data is retained while the account is active and deleted upon request or after account closure. Residual copies in routine backups are purged in the normal course of our backup rotation.
8. AI Tutoring (Lexi+Socrat) Data
When a student interacts with our Lexi+Socrat AI tutoring features, the messages and interactions involved are transmitted to third-party AI service providers to generate text and voice responses. These providers process the data on our behalf under contractual data processing agreements.
- We do not sell AI interaction data.
- Student interaction data is not used to train the AI providers' foundation models.
- AI conversation transcripts are retained to support learning continuity and mastery tracking, and institutions may request their deletion.
9. Third-Party Services
We may share data with trusted third-party service providers who assist in operating our platform, conducting business, or serving our users. These parties are obligated to keep your information confidential and secure.
We do not sell or rent your personal information to third parties. A current list of our sub-processors is available to institutional customers on request.
Identity & SSO providers
When enabled by your institution, we rely on identity and roster providers to authenticate users and provision access. See the “Single Sign-On & Authentication” section above for details on what we receive and do not receive.
AI service providers
Our Lexi+Socrat AI tutoring features rely on third-party AI providers to generate text and voice responses. See the “AI Tutoring (Lexi+Socrat) Data” section above for details.
YouTube API Services
Our authoring platform (Studio X) uses YouTube API Services to help our curriculum team discover relevant, embeddable educational videos to include in lessons. Because we use YouTube API Services, the following terms apply:
- By using our services and any embedded YouTube content, you agree to be bound by the YouTube Terms of Service.
- Google's handling of data is described in the Google Privacy Policy.
What we access and store
We access YouTube only through our own developer API credentials to retrieve public video information — video IDs, titles, channel/attribution details, thumbnails, and a video's embeddable status. We use this to present candidate videos to a curriculum author, who reviews and selects which (if any) to embed. We do not access, request, collect, or store any information from your personal Google or YouTube account, and we do not download, re-host, or store YouTube video content. The only YouTube data we retain is the public ID and attribution of a video a reviewer has chosen to embed in a lesson.
Embedded video playback
Lessons may display YouTube videos using YouTube's official embedded player. When you play an embedded video, YouTube and Google may set cookies and collect usage data on your device in accordance with the Google Privacy Policy. This activity is controlled by Google, not by Core Learning Exchange.
Your choices and data deletion
Because we do not access your Google account, there is no Core Learning Exchange authorization to revoke on the Google side. To review or remove data Google has collected, or to manage app access to your Google account, visit your Google account security settings. To request deletion of any data we hold about you, see the “User Rights” section above or contact support@corelearningexchange.com.
10. Cookies and Tracking
Our website uses cookies to enhance user experience, analyze usage patterns, and maintain session information. You can control cookie settings through your browser preferences.
11. Security Incident Notification
We maintain an incident response process. In the event of a security incident that affects the confidentiality, integrity, or availability of your data, we will notify the affected institution without undue delay and cooperate with the institution as required by contract and applicable law.
12. Policy Updates
Modifications to this privacy policy will be published on this website. Continued use of the platform after changes are posted indicates acceptance of the updated policy. We will notify users of significant changes via email or platform notifications.
13. Contact Information
For questions about this privacy policy or our data practices, please contact:
Email: support@corelearningexchange.com
Phone: (303) 732-8155