Privacy Policy

Who we are

CourseWise LLC (registered in Frostburg, MD, United States) operates the CourseWise platform, a software service that helps teachers author and assign reading material, run AI-graded discussion, and report on student understanding. CourseWise is offered both to educational institutions — schools, school districts, colleges, and universities — and to individual educators (typically college professors and instructors) who sign up directly without an institutional contract. For personal information processed under an institutional contract, the institution is the data controller and CourseWise LLC is its service provider (a "school official" under FERPA, and a processor for purposes of state privacy law). For information from individual educators who sign up directly, CourseWise LLC is the controller of the educator's own account information and acts as the educator's service provider with respect to the class rosters and student work they bring into the product. This policy describes the information we handle in each of those roles, together with our role as the operator of the CourseWise website and marketing pages.

What we collect

We collect three broad categories of information, and we try to be specific about each because they are governed by different rules.

Information educators and institutions provide to us

When an institution contracts with us, the institution provisions teacher accounts and may upload or sync student rosters, course enrollments, and class section data. When an individual educator signs up directly, the educator provides their own name, work email address, and (optionally) institutional affiliation, and may add the rosters for the classes they teach. In either case, rosters typically include student names, a student or course-section identifier, grade level or course section, and the email address used to log in. We do not require home addresses, phone numbers, dates of birth, government identifiers, or biometric data, and we ask educators and schools not to send them.

Information generated through use of the product

As students and teachers use CourseWise we record what is necessary to operate the service: the reading materials assigned to a class, student responses to AI-graded prompts and discussion questions, the AI-generated feedback returned to those responses, scores and progress indicators, and timestamps for activity. Teachers can also upload source documents (for example a PDF excerpt) that we process to generate questions and reading material.

Information collected automatically

Like most web applications, CourseWise records technical information needed to deliver and secure the service: IP address, browser and device type, pages requested, error traces, and request timing. On the public marketing pages we use a minimal set of cookies described in our Cookies notice. We do not use third-party advertising trackers anywhere in the product or on the marketing site.

Why we collect it

We use information only for purposes that are necessary to provide the service the institution has asked us to provide, to keep that service secure and available, and to improve it within the limits described below. Specifically, we use information to:

• Authenticate users, route them to the correct class, and display the right material to the right student.
• Generate AI feedback, grades, and analytics that the teacher and institution have configured the product to produce.
• Detect, investigate, and respond to abuse, fraud, and security incidents.
• Diagnose bugs, measure performance, and plan capacity. Diagnostic telemetry uses the minimum data needed and is access-controlled.
• Communicate with administrators and teachers about their account, billing, scheduled maintenance, and material security events.

We do not sell personal information. We do not use student data to train third-party AI models, and our contracts with AI subprocessors prohibit them from doing so on data we send through them on behalf of schools.

Who we share it with

We share information with a small set of vetted subprocessors that provide the infrastructure CourseWise runs on. The current list is published at /legal/subprocessors and includes our cloud hosting and storage provider, our managed Postgres database provider, and the provider of the large language model we use for AI-generated feedback. Each subprocessor is bound by a written data processing agreement that restricts use of the data to the services they perform for us.

We may also share information with the institution that owns the account (for example, returning a teacher's roster or a student's work to their school), with auditors and counsel under confidentiality, and with law enforcement when we are required to do so by valid legal process. Before we disclose information in response to legal process we attempt, where lawful, to notify the institution so it can object.

Retention

For information processed on behalf of an institution, the institution sets the retention schedule in its agreement with us. By default we retain active-account data for the duration of the contract and for a short period afterward to permit export. On contract termination we delete or return institutional data within the period set in the agreement (typically thirty to ninety days), excluding backups that age out on their own schedule and information we are required by law to retain. Operational logs are retained for a shorter window (typically thirty to ninety days) and are not used to build long-term profiles of individual users.

Children's data

CourseWise is designed for use in classroom settings. When CourseWise is assigned to a class that includes children under thirteen, the institution or individual educator using the product is responsible for the consent or authorization required under COPPA. Where a school assigns CourseWise, the school typically acts in loco parentis and provides consent on the parent's behalf consistent with the operator exception under COPPA. Where an individual educator uses CourseWise without an institutional contract, the educator must confirm they have the necessary authority or parental consent before enrolling under-thirteen students. In either case, we limit our use of that information to the educational purpose authorized by the school or educator. Our specific commitments around younger students are described in our COPPA notice and our FERPA statement.

Your rights

If you are a student, parent, teacher, or other individual whose information we process on behalf of a school, your rights to access, correct, or delete that information are administered by the school as the controller of the data. We will support the school in responding to your request. If you are unsure who to contact, start with the school's privacy officer or registrar.

If you are a student in a class run by an individual educator who has signed up to CourseWise directly, requests to access, correct, or delete your work are first directed to that educator, who controls the class roster and decides what to retain. We will support the educator in responding and, where the educator is unreachable or your request concerns information we hold about you outside their class, you may contact us directly.

If you are a visitor to our marketing site, an educator who has signed up directly, or otherwise interacting with us outside a school relationship, you may contact us directly to access, correct, or delete the limited information we hold about you. Where state privacy law (for example in California, Colorado, Connecticut, or Virginia) gives you specific rights, we honor them at the level the law requires.

Contact

For questions about this policy, to exercise your rights, or to file a request on behalf of a student, please use our Data Requests page. Requests are routed to CourseWise LLC's privacy team and acknowledged within the timeframe required by applicable law.