Privacy Policy

Effective Date: March 22, 2026

Scope and Key Definitions

  • Personal Information ("PI" or "PII") means information that identifies or is reasonably capable of identifying an individual, including "Education Records" as defined by FERPA.
  • Student Data means PI collected about a student in the context of school use of our Services.
  • School Customer means a school, district, or institution that contracts with Deskpad.
  • Authorized School Official means an employee or agent designated by the School Customer with legitimate educational interest under FERPA.

Information We Collect

We only collect information necessary to provide, maintain, and improve the Services.

  • Account Information: Your name, email address, school affiliation, and role (student, teacher, or admin). This information is provided either by you directly or by your school.
  • Classroom Content: Content generated through your use of the Services, including writing drafts, AI chat interactions with Sage (our AI writing assistant), teacher feedback, grades, and assignment metadata.
  • Support Interactions: If you contact us for help, we may collect messages or email correspondence as part of providing support.
  • Device and Usage Data: We automatically collect technical data such as IP address, browser type, device type, pages visited, and time spent on tasks through our analytics tools.
  • We do not request or knowingly collect Social Security numbers, precise geolocation, or biometric identifiers.

How We Use Information

  • Deliver core features of Deskpad, including the AI writing assistant (Sage), writing workspace, assignment management, and teacher dashboards.
  • Authenticate and manage user accounts.
  • Provide customer support and respond to inquiries.
  • Monitor, debug, and improve platform performance and security.
  • Produce aggregated, de-identified analytics that help schools evaluate classroom trends.
  • Send administrative notices or product updates to account holders who opt in.

We never sell or rent Personal Information or Student Data, and we do not serve targeted advertising inside the product.

AI Features and Data Processing

Deskpad includes an AI writing assistant called Sage, powered by Google's Gemini language model. When students interact with Sage:

  • Student writing and chat messages are sent to Google's Gemini API to generate responses. These interactions are processed in real time and are not used by Google to train its models when accessed through the API.
  • All Sage conversations are stored by Deskpad and are visible to the student's teacher for transparency and academic integrity purposes.
  • Sage is designed to guide student thinking through Socratic questioning, not to write essays or complete assignments on behalf of students.
  • Teachers can review the full transcript of every AI interaction tied to a student's submission.

Legal Bases for Processing

For users in the European Economic Area or United Kingdom, we rely on one or more of the following legal bases under GDPR/UK GDPR: (a) performance of a contract with the School Customer, (b) legitimate interests (platform security and improvement), and (c) consent where required.

Compliance With Federal Law

6.1 Children's Online Privacy Protection Act (COPPA): Deskpad is used under school direction. The School Customer acts as the parental agent and provides any necessary parental consent before students under 13 create accounts. Parents may review, correct, or delete their child's information by contacting the school or emailing us at support@deskpad.ai.

6.2 Family Educational Rights and Privacy Act (FERPA): Deskpad acts as a "School Official" under FERPA, processing Student Data only for legitimate educational interests defined by the School Customer. Student Data remains under the direct control of the School Customer. We disclose Student Data only to authorized personnel or as directed in writing by the School Customer.

6.3 Children's Internet Protection Act (CIPA): Deskpad does not provide unrestricted web browsing. The Sage AI assistant is constrained to educational interactions related to the student's assignments. If a School Customer receives E-Rate funding, Deskpad supports integration with the school's existing content-filtering solution.

State-Specific Student Privacy Laws

We comply, as a service provider, with all applicable state student privacy statutes, including but not limited to:

  • California CCPA/CPRA and SOPIPA
  • Illinois SOPPA
  • New York Education Law 2-d
  • Texas Student Privacy Act
  • Virginia Student Data Protection Act
  • Colorado HB 16-1423

A full table of state-specific commitments is available on request.

Transparency and Notice

  • A plain-language version of this policy is available for parents and students on request.
  • Data elements collected, purpose of collection, and third-party disclosures are published in this Privacy Policy.
  • Any material change to data practices will be announced at least 30 days before taking effect.

Cookies and Tracking Technologies

Deskpad uses essential session cookies to maintain secure login. We use internal analytics and error monitoring tools to collect aggregate usage data and improve the platform. We do not place marketing or behavioral tracking cookies.

Data Sharing and Third Parties

  • Infrastructure and hosting providers
  • Google Cloud (Gemini API)
  • Service providers under written agreements
  • Authorized School Officials
  • Law enforcement when required by law

We do not share, sell, or disclose Student Data to any third party for advertising, marketing, or any non-educational purpose.

Data Security

Encryption in transit via TLS 1.2 or higher. Encryption at rest. Row-level security policies. Role-based access controls. Secure authentication with hashed passwords.

Schools may request a description of our current security practices at any time by emailing support@deskpad.ai.

Data Retention and Deletion

  • Student Data deleted or exported within 60 days upon written request, or within 120 days following contract termination.
  • Teacher/Admin PI retained while account is active, plus up to two additional years for audit logs.
  • System Logs retained for 12 months, then deleted or anonymized.

User Rights and Choices

  • Students and Parents (U.S.): Access, review, or correct through the School Customer or support@deskpad.ai.
  • California Residents: Rights to know, delete, correct, and opt out. Deskpad does not sell personal data.
  • EU/UK Residents: Rights of access, rectification, erasure, restriction, data portability, and objection.

Contracts and Data Processing Agreements

Each School Customer receives a DPA. A National Data Privacy Agreement (NDPA) version is available on request.

Children's Privacy Statement

Deskpad collects a child's Personal Information only with school consent acting in place of parents. Parents can exercise their COPPA rights by contacting their child's school or support@deskpad.ai.

Changes to This Privacy Policy

Material changes will be posted on our website and emailed to account holders or School Customers at least 30 days before becoming effective.

Contact Us

Email: support@deskpad.ai