Information We Collect
Depending on how your institution configures ScholarStack, we may collect: account information such as your name, institutional email address, organization, role, authentication information, and account preferences; educational information such as course enrollments, course materials, syllabi, assignments, rubrics, instructor-created AI agents, student submissions, student interactions, learning progress, and assessment results; user content you intentionally provide, including prompts, chat conversations, voice interactions, uploaded documents, images, audio, files, notes, and feedback; and technical information collected automatically to operate and secure the platform, including IP address, browser type, device information, operating system, session identifiers, audit logs, usage metrics, and error logs.
How We Use Information
We use information to provide AI-powered educational services; support teaching, learning, and research; authenticate users; deliver course-specific AI experiences; generate educational feedback; improve platform performance and reliability; detect fraud and abuse; maintain platform security; respond to customer support requests; and comply with legal and contractual obligations. ScholarStack does not sell personal information.
AI Processing
ScholarStack uses artificial intelligence to provide educational functionality including tutoring, research assistance, summarization, assessment support, writing assistance, content generation, and conversational learning experiences. To provide these services, we may process course materials, instructor-authored content, student prompts, student responses, uploaded documents, and limited contextual information necessary to fulfill a user's request. We follow data minimization principles by transmitting only the information necessary to perform the requested function, and we do not intentionally transmit unnecessary personally identifiable information to AI services.
Enterprise AI Services
ScholarStack utilizes enterprise AI services provided by trusted vendors under commercial agreements that include data protection and confidentiality obligations. Customer data submitted through these services is not used to train foundation models. We continually evaluate our AI providers to ensure they meet appropriate privacy, security, and educational requirements.
Data Sharing
We share customer information only when necessary to provide the Services, including with cloud infrastructure providers, AI service providers, identity providers, Learning Management System integrations, library integrations, customer-authorized third-party integrations, and service providers performing functions on our behalf. We require subprocessors to maintain appropriate security and confidentiality protections, and we do not disclose customer information for advertising purposes.
Student Records and FERPA
ScholarStack is designed to support educational institutions in complying with applicable privacy laws, including the Family Educational Rights and Privacy Act (FERPA). Educational records remain under the control of the institution. ScholarStack acts as a service provider processing educational information on behalf of its institutional customers, which determine what information is uploaded into the platform and control user access to educational records.
Data Security
We maintain administrative, technical, and organizational safeguards designed to protect customer information, including encryption in transit and at rest, role-based access controls, authentication, audit logging, least-privilege access, secure software development practices, vendor management, security monitoring, and incident response procedures. We continuously evaluate and improve our security program.
Data Retention
We retain customer information only for as long as necessary to provide the Services or satisfy legal and contractual obligations. Retention periods are determined by customer agreements, institutional requirements, applicable law, and operational requirements. Upon termination of services, customer data is returned or deleted in accordance with applicable agreements.
Customer Rights
Institutional customers maintain control over their data. Subject to applicable law and customer agreements, users may request access to, correction of, or deletion of personal information, export of personal information, and information regarding our processing activities. Requests relating to educational records should generally be directed to the user's educational institution.
Cookies and Analytics
We use cookies and similar technologies necessary for authentication, security, session management, performance monitoring, and platform analytics. We do not use customer educational data for behavioral advertising.
Children's Privacy
ScholarStack is intended for educational institutions and is not directed toward children under the age permitted by applicable law without appropriate institutional or parental authorization. We do not knowingly collect personal information from children except as authorized by educational institutions using the Services.
Accessibility
ScholarStack is committed to providing accessible educational technology. Accessibility considerations are incorporated into product development, and accessibility issues may be reported through ScholarStack Support.
Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in legal requirements, technology, or our Services. Material changes will be communicated through appropriate customer notification mechanisms. The effective date at the top of this policy indicates the latest revision.
Contact Information
Questions regarding this Privacy Policy or ScholarStack's privacy practices may be directed to our Privacy Team at privacy@scholarstackai.com.