Privacy Policy
1. Scope and our relationship with schools
This policy applies to InnovationAssessments.com and the educational services delivered through it. A subscribing school, district, organization, or teacher decides how the platform is used, which students participate, and which instructional features are enabled.
For student education records provided through a school-authorized use, the school controls the educational purpose and Innovation Assessments processes the information to provide, support, and secure the service. When a school relies on FERPA's school-official exception, the parties should document the school's direct control and the authorized institutional purpose in their agreement. Innovation Assessments is not a school and does not claim that software alone makes a school's use compliant with FERPA or another law.
2. Information we collect
Teacher, staff, and subscriber information
We may collect a name, email address, organization, login credentials, account preferences, courses, support communications, subscription status, and identifiers returned by our payment provider. Payment-card details are entered into Stripe and are not intended to be stored in the Innovation Assessments application database.
Student account and education information
Depending on the school's configuration and the activities assigned, we may process:
- a student's name or a course-specific privacy alias;
- an internally generated login identifier and hashed password or classroom PIN;
- an optional school-authorized email address or Google identity entered by a teacher or administrator;
- course enrollment, assignments, written responses, audio, video, chat, discussions, presentations, scores, rubrics, and feedback;
- completion and participation records, timestamps, captured timezone, and live-session activity; and
- security, audit, browser-lock, and proctoring events selected for an assessment.
Public student self-registration does not request an email address and does not permit a student to attach a Google account. It creates an internal identifier so the account can function. A real student email is optional and can be added only through an authorized teacher or administrator workflow. Schools may use classroom number and PIN access and may enable Alias-Only mode for a course.
Technical and support information
Our servers may receive IP address, browser and device information, requested pages, session and security events, diagnostic errors, and cookies needed for authentication and application operation. If a user contacts support, we process the message and information supplied to investigate the request.
3. How we use information
We use information to authenticate users; operate courses and assignments; save and return student work; calculate or record scores; provide teacher feedback, live-session, monitoring, communication, and proctoring functions; deliver service and security messages; provide support; prevent abuse; maintain backups; administer subscriptions; and comply with applicable law.
We do not sell School Data or student personal information. We do not use student activity for targeted advertising or create advertising profiles from student work.
4. Optional AI-assisted features
The platform includes optional AI-assisted tools for purposes such as drafting questions or lesson materials, generating language prompts and audio, coaching, suggesting feedback, analyzing responses, and assisting a teacher with scoring. When such a feature is used, the prompt, source material, and response needed to complete the request may be sent to our disclosed AI provider.
Users should not place unnecessary identifiers or sensitive personal information in AI prompts. Some AI workflows operate on student content and cannot accurately be described as universally de-identified. AI output may be incomplete or incorrect; teachers remain responsible for reviewing it before using it for instruction, grading, or another consequential decision. Innovation Assessments does not use student work to train its own general-purpose AI model.
5. When information is disclosed
We disclose information only as needed to provide or secure the service, at the direction of the school or authorized user, during a business transaction subject to appropriate protections, or when required by law. Relevant providers may include:
- Hostwinds for managed hosting, database and file storage, DNS, server mail transport, security controls, and backups;
- OpenAI for optional AI-assisted features;
- Google for optional authorized identity services and company communications;
- Stripe for subscriber billing;
- Mailchimp for business or marketing communications, not student education records; and
- YouTube or Vimeo when a teacher embeds content from those services.
Some pages load interface assets from services such as jsDelivr or Google Fonts. Those services may receive ordinary network information from the browser. A current service-provider inventory is available to schools upon request.
6. Third-party content and links
Teachers may add links or embed video from third-party services. Those providers have their own privacy practices and may receive IP address, browser information, cookies, account status, and playback activity. A video setting such as YouTube's related-video control does not eliminate advertising or third-party data collection. Schools should approve external content consistently with their own policies.
7. Cookies and authentication
Innovation Assessments uses cookies and related browser storage needed to keep users signed in, remember trusted-device or interface preferences, secure sessions, and operate assigned activities. Optional identity or embedded-content providers may set or read their own cookies when their features are loaded. Blocking required cookies may prevent the service from functioning.
8. Data retention
Our scheduled cleanup currently removes many student submissions, scores, recordings, chats, discussions, notifications, and related participation data after 9 months. Proctoring, browser-lock, audit, and detailed AI-usage records are generally removed after 6 months. Certain temporary live-session records are removed after 30 days. Closed helpdesk tickets are scheduled for removal after 365 days, and archived roster records may expire after 12 months.
Account, course, and instructional-content records needed to operate an active account may remain while the service is active. A verified school or account holder may request export or deletion. Deleted information may remain in backups until the ordinary backup-rotation cycle completes. We may retain information longer when required by law, a documented legal hold, a security investigation, or a school's written instruction.
9. Security
We use reasonable safeguards appropriate to the service, including HTTPS in transit, password hashing, role- and ownership-based access checks, optional email two-factor authentication for adult accounts, managed server controls, backups, and audit or security logging. Authorized staff access is limited by course assignments and is logged where implemented.
No online system can guarantee absolute security. Users should protect credentials, use unique passwords, remove access that is no longer needed, and report suspected misuse promptly.
10. School controls and individual requests
Teachers and schools can manage rosters, use internal student identifiers, enable Alias-Only courses, configure staff access, control whether student feedback is visible, export records, and request deletion. The My Students page also provides a deliberate cleanup tool that can replace eligible real student email addresses with internal identifiers while preserving work and scores.
Parents, guardians, students, and eligible students seeking access to, correction of, or deletion of a school-controlled education record should normally contact the school first. We will reasonably assist the school with a verified request and will not disclose an education record until the requester's authority has been established.
11. Children and COPPA
Innovation Assessments is offered for school-authorized educational use, not as a general-audience social service for children. Where COPPA applies and a school provides consent on behalf of a parent, that consent must be for the educational context and benefit of the school, not an unrelated commercial purpose. We use the child's information to provide, support, and secure the educational service and will assist the school with appropriate review or deletion requests.
12. International and state privacy rights
The service is hosted in the United States. Privacy rights vary by location. Where applicable law grants access, correction, deletion, restriction, objection, portability, or appeal rights, a verified requester may contact us. For school-controlled student records, we may refer the request to the school so that it can authenticate and direct the response.
13. Changes to this policy
We may update this policy as the service, providers, or law changes. We will post the revised date and provide additional notice when a change materially affects how School Data is used.
14. Contact
Privacy, data-access, and deletion requests may be submitted through the support or helpdesk channel published on InnovationAssessments.com. Please do not include unnecessary student records in an initial email. We may need to verify the requester's identity and authority before acting.
This policy explains current platform practices and is not a claim of “FERPA certification.” Schools remain responsible for determining whether their configuration and use meet their legal and institutional obligations.