Deskpad

Deskpad Privacy Policy

Effective date: April 4, 2025
Last updated: June 25, 2026

This Privacy Policy explains how Deskpad AI LLC ("Deskpad," "we," "us," or "our") collects, uses, shares, and protects information when you use our websites at deskpad.ai and app.deskpad.ai, our Google Docs add-on, and related services (together, the "Services").

Deskpad is an educational platform built for K-12 schools. Because we serve schools and their students, much of the information we handle is student data that belongs to the school, and we handle it on the school's behalf and under the school's direction. This policy describes the practices that apply across all of our users: schools and their staff, students, parents, and visitors to our public website.

If you have questions about this policy, contact us at support@deskpad.ai.

1. Our role and how schools fit in

Deskpad operates on a school-first model. A school or district (the "School") signs up for the Services and invites its teachers, administrators, and students to use them. In this relationship:

  • The School is the owner and controller of student data. We process that data on the School's behalf, under its direction, and for the educational purposes the School has authorized.
  • We act as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), performing a service the School would otherwise perform itself.
  • We sign a Data Processing Agreement (DPA) with Schools, typically based on the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement, which governs how we may use, protect, and return or delete student data. Where a DPA and this policy differ for a given School, the DPA controls for that School.

This means parents generally exercise their privacy rights (such as reviewing or correcting their child's data) through the School, which we support. See Section 9.

2. Information we collect

a. Account and profile information

When a School, teacher, administrator, or student creates an account, we collect:

  • Name or display name
  • Email address
  • Role (student, teacher, or administrator)
  • Optional profile details such as an honorific (for example, "Ms." or "Mr.")
  • Authentication information. We support email and password sign-in and sign-in with Google. When you sign in with Google, we receive basic profile information to create and identify your account, but not your Google password.
  • Class and roster information, including the classes a teacher creates, the join codes for those classes, and which students are enrolled in them.

b. Student work and AI interactions

This is the core educational data the Services exist to handle:

  • The written work students produce in the Deskpad workspace, including drafts and the revision history (periodic snapshots of a document as it develops).
  • Assignment information created by teachers, including titles, prompts, and due dates.
  • Conversations between students and Sage, our built-in AI tutor, that take place within an assignment.
  • Submissions, grades, and teacher feedback.

c. Usage and technical information

When you use the Services, we automatically collect limited technical information needed to operate, secure, and improve them, such as device and browser type, general usage and performance data, and similar diagnostic information. We use this information only in aggregate to measure and improve performance.

d. Public website visitors

When you visit our marketing site at deskpad.ai without an account (for example, to read about Deskpad or try a public demo), we collect only limited technical and usage information as described above, plus any information you choose to give us, such as an email address submitted through a contact or demo request. If you apply to take part in a Deskpad Labs interview or documentary project, we collect the additional information described in Section 11.

We do not knowingly collect biometric identifiers, government-issued identifiers, or precise geolocation, and we do not ask students to provide them.

3. How we use information

We use information to:

  • Provide, operate, and maintain the Services, including creating classes and assignments, saving student work, and running Sage.
  • Enable the core educational features: writing, AI-assisted tutoring, submission, grading, and feedback.
  • Make AI use transparent to teachers by recording the writing process and the student's interactions with Sage within an assignment.
  • Secure the Services, prevent and investigate abuse or unauthorized access, and enforce our terms.
  • Communicate with Schools and account holders about the Services, including support, security, and administrative messages.
  • Improve and develop the Services in ways consistent with our obligations to Schools and applicable law.

We use student personal information only to provide the educational service to the School. We do not use student personal information for advertising, we do not sell it, and we do not build advertising or marketing profiles of students.

Research and de-identified data

We may create de-identified and aggregated data from student and teacher activity on the platform, including writing, drafts, Sage conversations, and submissions, and use it to support Deskpad Labs research into how AI affects learning and writing. De-identified data has had information that could reasonably be used to identify a student removed, and we do not attempt to re-identify it. We may publish findings from this research in aggregate or de-identified form. We never publish or share data that identifies an individual student.

4. Artificial intelligence and Sage

Sage is an AI tutor designed to guide student thinking rather than do the work for the student. To generate responses, the student's prompts and relevant context from the assignment (such as the assignment prompt and the student's current draft) are sent to our AI provider, Google (Gemini), which returns a response.

  • We do not use student work or student-Sage conversations to train AI models, and our AI provider does not use the data we submit to train its models.
  • Sage conversations are stored as part of the student's assignment record so that teachers can review how AI was used. They are visible to the student's teacher.
  • AI outputs can be imperfect. Grades and academic decisions are made by teachers, not by Sage.

5. How we share information

We do not sell personal information, and we do not share student personal information with third parties for their own purposes. We share information only as described here:

a. Within the School

A student's work, Sage conversations, submissions, and grades are visible to the student's teacher and, where appropriate, school administrators, consistent with the School's normal access to student records.

b. Service providers (sub-processors)

We use a small number of trusted service providers to run the Services. They may process information only to provide services to us, under contractual confidentiality and data-protection obligations, and not for their own purposes. These include:

  • Cloud hosting and infrastructure providers that run the Services and store data securely on our behalf, including aggregate performance and usage measurement.
  • Google, whose Gemini service provides the AI processing that powers Sage.
  • Form and survey providers (such as Typeform) that collect contact, demo, and Deskpad Labs application submissions on our behalf.

The current, named list of these providers is maintained in, and available through, our Data Processing Agreement with Schools.

c. Legal and safety

We may disclose information if required by law, to comply with valid legal process, to protect the rights, safety, or property of students, Schools, the public, or Deskpad, or to investigate fraud or security issues.

d. Business transfers

If Deskpad is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. We will continue to protect it in line with this policy and our DPAs, and we will notify affected Schools as required.

6. Children's privacy (COPPA)

Deskpad is intended for use by students at the direction of their School, including students under the age of 13. The Children's Online Privacy Protection Act (COPPA) generally requires verifiable parental consent before collecting personal information from children under 13.

Consistent with FTC guidance for educational technology, Deskpad relies on the School to provide consent on behalf of parents for the collection and use of student personal information within the educational context. We collect and use student information only to provide the educational service the School has authorized, and not for any commercial purpose unrelated to that service.

In keeping with the amended COPPA Rule, we:

  • Collect only the student information reasonably needed to provide the Services.
  • Do not condition a student's participation on disclosing more information than is reasonably necessary.
  • Maintain reasonable security safeguards appropriate to the sensitivity of the information (see Section 8).
  • Retain student information only as long as needed for the educational purpose and then delete or return it (see Section 7).
  • Do not disclose student personal information to outside parties except the service providers described in Section 5, who process it only on our behalf.

Schools and parents may review the student information we hold, ask us to correct it, and ask us to delete it, and may refuse to permit further collection. Because we operate under the School's direction, these requests are generally made through the School. See Section 9.

7. Data retention and deletion

We keep student personal information only for as long as it is needed to provide the Services to the School, or for as long as the School's agreement with us requires.

  • A School may request export, return, or deletion of its data at any time, and we will comply within the timeframe set in our DPA.
  • When a School's relationship with Deskpad ends, we delete or return student personal information in accordance with the DPA.
  • When we delete an account or a School's data, related records are removed in a way that maintains data integrity (for example, a student's submissions, AI conversations, and writing snapshots are removed together with the account).

We do not retain student personal information indefinitely. When it is no longer needed for the educational purpose, or when our agreement with a School ends, we delete or return it within a reasonable period, consistent with our DPA and applicable law.

8. Data security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, or destruction. These measures include:

  • Encryption of data in transit and at rest.
  • Access controls so that each user can reach only the data they are permitted to see.
  • Limiting employee and contractor access to personal information to those who need it.
  • Ongoing protections and monitoring on our applications.

No method of transmission or storage is completely secure, but we work to protect personal information and to review and improve our safeguards over time. If we learn of a data breach affecting personal information, we will notify affected Schools and comply with applicable breach-notification laws.

9. Rights and choices

Schools control student data and may access, correct, export, or delete it, and may direct how it is used, subject to our DPA.

Parents and guardians have the right to review their child's personal information, request corrections, request deletion, and refuse further collection. Because Deskpad operates under the School's direction, parents should make these requests through their child's School, which we will support. Parents may also contact us at support@deskpad.ai and we will work with the School to respond.

Teachers, administrators, and other account holders may update their profile information in their account settings or by contacting us.

Depending on where you live, you may have additional rights under state privacy laws. We honor applicable rights and do not discriminate against anyone for exercising them.

10. State student privacy laws

In addition to FERPA and COPPA, student privacy is protected by various state laws, such as California's Student Online Personal Information Protection Act (SOPIPA) and similar laws in other states. Consistent with these laws, we do not sell student information, do not use it for targeted advertising, do not build non-educational profiles of students, and protect it with reasonable security. Our obligations to specific Schools are set out in our DPAs, which incorporate state-specific requirements where applicable.

11. Deskpad Labs interviews and documentary participation

From time to time, Deskpad Labs invites students to take part in interviews, research, or documentary projects, such as the AI Student Report. Taking part is entirely voluntary, and this section describes how we handle the information collected for that purpose. This collection is separate from the educational Services described elsewhere in this policy. It does not happen through a School, it is not governed by a School's Data Processing Agreement or by our role as a "school official" under FERPA, and the information is not added to any student's educational record.

Who can take part. Participation is open only to people who are at least 13 years old and in eighth grade or above. We do not collect information for these projects from children under 13.

What we collect. When you apply, we collect the information you provide through our application form, which is hosted by Typeform on our behalf. This typically includes your name, email address, the name of your school, your general location (such as your city or region), and your responses about your experience with AI. If you are selected and choose to take part, we also collect the audio and video recording of your interview, along with the signed release described below.

Consent and releases. Because these projects result in material that may be published publicly, we do not record or publish anything without a signed release from you, and from a parent or guardian if you are under 18. We explain this before you submit an application, and we follow up with the formal release documents before any recording takes place. You may take part anonymously, in which case we take reasonable steps to keep you unidentifiable in published material.

How we use it. We use the information to evaluate applications, coordinate with participants, produce the interview or documentary, and publish the resulting work through Deskpad Labs. We do not use it to advertise or sell Deskpad's products, and we do not sell it.

Withdrawing and deletion. You may withdraw at any time before your interview is conducted, and you may ask us to delete the information you submitted in your application. If you are not selected, we delete or retire that application information within a reasonable period. Once your interview has been recorded, how your contribution may be used is governed by the signed release you provided (and, if you are under 18, the release provided by your parent or guardian). To withdraw or request deletion, contact us at the address in the "Contact us" section below.

Sharing. We share this information only with the service providers who help us run the application form and produce and host the finished work, and as otherwise described in the "Legal and safety" and "Business transfers" parts of Section 5. We do not share it with third parties for their own purposes.

12. Cookies and similar technologies

We use a limited set of cookies and similar technologies that are necessary to operate the Services (for example, to keep you signed in) and to measure aggregate performance and usage. We do not use advertising cookies and we do not use cookies to track students across other websites.

13. Data location and transfers

Deskpad is based in the United States and operates the Services from the United States. Information may be processed and stored in the United States and in other locations where our service providers operate. We require our service providers to protect personal information consistent with this policy and our DPAs.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the "Last updated" date above and, where appropriate, notify Schools or account holders. For changes that affect how we handle student data, we will provide notice consistent with our DPAs and applicable law before the changes take effect.

15. Contact us

If you have questions or requests regarding this Privacy Policy or your information, contact:

Deskpad AI LLC
447 Sutter Street
San Francisco, CA 94108
Phone: 415-855-3358
Email: support@deskpad.ai

Back home