Privacy Policy

SECTION 2: PRIVACY POLICY

2.1 Information We Collect

Gamify Education collects information to provide, improve, and personalize our educational services. The types of information we collect include:

Account Information: Name, email address, username, password (encrypted), institutional affiliation, role (student, instructor, administrator), and profile information you choose to provide.
Educational Data: Course enrollments, quiz responses, assessment scores, game performance metrics, progress tracking data, mastery indicators, time spent on activities, learning path history, and achievement records.
Usage Information: Pages visited, features used, actions taken, session duration, navigation patterns, game mode preferences, and interaction logs.
Device and Technical Information: IP address, device type, operating system, browser type and version, screen resolution, device identifiers, and mobile network information.
LMS-Linked Information: When accessing through learning management system integration, we may receive student identifiers, course roster information, assignment data, and grade book synchronization data as permitted by your institution.
AI Interaction Data: Queries submitted to AI features, AI-generated responses provided, feedback on AI explanations, and patterns of AI feature usage for quality improvement.
Communications: Support requests, feedback submissions, survey responses, and any other communications you send to us.

2.2 How Student Data is Used

We use student data for the following educational purposes:

Service Provision: To deliver, maintain, and improve the educational platform and its features.
Personalization: To customize learning experiences, recommend content, and adapt difficulty levels based on demonstrated mastery.
Progress Tracking: To monitor academic progress, generate performance analytics, and provide feedback to students and authorized instructors.
Assessment: To evaluate learning outcomes, calculate scores, and generate reports for students and institutions.
Research and Improvement: To analyze aggregate, de-identified usage patterns to improve our educational content and platform effectiveness.
Communication: To send educational notifications, progress updates, and important platform announcements.
Safety and Security: To detect, prevent, and respond to fraud, unauthorized access, and other security issues.

We do not sell, rent, or trade student personal information to third parties for marketing purposes.

2.3 AI Interaction Logging Policies

The Platform's AI features generate logs of interactions for quality assurance and service improvement. Our AI interaction logging practices include:

Data Collected: Questions asked, explanations provided, hints requested, feedback given, and timestamps of interactions.
Purpose: To improve AI response quality, detect errors, train and refine AI models, and analyze educational effectiveness.
Retention: AI interaction logs are retained for twenty-four (24) months and may be anonymized for longer-term research purposes.
Human Review: A sample of AI interactions may be reviewed by authorized personnel to ensure quality and appropriateness of responses.
Third-Party AI Services: If we use third-party AI providers, interaction data shared with those providers is governed by appropriate data processing agreements that protect student privacy.

2.4 FERPA Compliance

Gamify Education is committed to compliance with the Family Educational Rights and Privacy Act (FERPA) for educational records of students at institutions receiving federal funding. Our FERPA practices include:

School Official Status: When providing services to educational institutions, Gamify Education acts as a "school official" with a "legitimate educational interest" under FERPA, as specified in our institutional agreements.
Direct Control: Educational institutions maintain direct control over student education records, and we use student data only for purposes authorized by the institution.
Data Use Limitations: Student education records are used solely for the educational purposes specified in our agreements with institutions and are not used for commercial purposes unrelated to the educational services.
Disclosure Restrictions: We do not disclose personally identifiable information from education records except as permitted by FERPA, including to authorized school officials and with proper consent.
Parental and Student Rights: We support institutions in fulfilling parental and eligible student rights to access and request amendment of education records as required by FERPA.

2.5 COPPA Compliance

For users under thirteen (13) years of age, Gamify Education complies with the Children's Online Privacy Protection Act (COPPA):

Parental Consent: We do not knowingly collect personal information from children under 13 without verifiable parental consent. Institutional accounts for minors require the school to obtain appropriate consent.
School Consent Exception: Schools may consent to the collection of student information on behalf of parents for educational purposes, in accordance with the COPPA school consent exception.
Limited Data Collection: For child users, we collect only information necessary to provide the educational service.
No Behavioral Advertising: We do not use data collected from children under 13 for targeted advertising purposes.
Parental Rights: Parents may review their child's information, request deletion, and refuse further collection by contacting us at the address provided in this policy.

2.6 Data Retention

We retain personal information for the following periods:

Active Accounts: Account information and educational data are retained for as long as the account remains active or as needed to provide services.
Inactive Accounts: Accounts inactive for more than twenty-four (24) months may be archived or deleted after notification.
Institutional Data: Student data for institutional accounts is retained in accordance with the terms of our institutional agreements and applicable education records laws.
Legal Requirements: We may retain information as necessary to comply with legal obligations, resolve disputes, and enforce agreements.
Anonymized Data: Aggregated, de-identified data that cannot reasonably be used to identify individuals may be retained indefinitely for research and analytics purposes.
Post-Deletion: Upon account deletion, personal information is removed from active systems within thirty (30) days and from backups within ninety (90) days.

2.7 Data Security Measures

Gamify Education implements comprehensive security measures to protect user data:

Encryption: Data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 encryption.
Access Controls: Role-based access controls limit data access to authorized personnel with legitimate business needs.
Authentication: Multi-factor authentication is available and encouraged for all accounts.
Monitoring: Systems are continuously monitored for security threats and unauthorized access attempts.
Incident Response: We maintain incident response procedures to address security breaches promptly and notify affected parties as required by law.
Employee Training: All employees receive regular training on data security and privacy best practices.
Third-Party Security: We require vendors and service providers to maintain appropriate security measures through contractual obligations.
Regular Assessments: We conduct periodic security assessments and penetration testing to identify and address vulnerabilities.

2.8 Third-Party Analytics and API Partners

We may share data with the following categories of third parties:

Analytics Providers: Services that help us understand Platform usage patterns and improve user experience. Data shared is typically aggregated or anonymized.
Cloud Infrastructure: Cloud service providers that host and process data on our behalf under strict data processing agreements.
AI Service Providers: Third-party AI platforms used to generate educational content, subject to appropriate data protection terms.
LMS Partners: Learning management systems with which we integrate, sharing data as necessary for integration functionality.
Payment Processors: Services that process payments, receiving only necessary transaction information.

2.9 User Rights

Subject to applicable law and institutional policies, users have the following rights regarding their personal information:

Access: You may request a copy of the personal information we hold about you.
Correction: You may request correction of inaccurate or incomplete personal information.
Deletion: You may request deletion of your personal information, subject to legal retention requirements and institutional policies.
Data Portability: Where technically feasible, you may request your data in a portable format.
Opt-Out: You may opt out of non-essential communications and certain data processing activities.
Restriction: You may request restriction of processing in certain circumstances.

To exercise these rights, contact us at privacy@gamifyedu.com. For institutional accounts, requests may need to be submitted through your institution. We will respond to requests within thirty (30) days as required by applicable law.

2.10 Parent and Institution Administrator Controls

Parental Controls: Parents and guardians of minor users have the right to review, correct, or request deletion of their child's personal information, subject to verification of identity and applicable legal requirements.

Institutional Administrator Controls: Authorized administrators at educational institutions have access to configuration options, usage analytics, and aggregated performance data for their institution's deployment of the Platform, in accordance with institutional agreements.

For users accessing the Platform through educational institutions, we share information with authorized school officials and instructors as follows:

Progress and Performance Data: Quiz scores, game performance, mastery levels, time-on-task, and completion status are shared with instructors for enrolled courses.
Aggregate Analytics: Institutional administrators receive aggregate performance data and usage statistics for their student population.
Grade Synchronization: When LMS integration is enabled, grades and completion status may be synchronized with the institution's grade book.
Academic Integrity Reports: Suspected academic integrity violations may be reported to institutional authorities.
Intervention Alerts: Early warning indicators for at-risk students may be shared with designated advisors or support staff.

Information sharing is limited to individuals with legitimate educational interests as defined by FERPA and institutional policy.

2.12 Cookies and Tracking Technologies

The Platform uses cookies and similar tracking technologies for the following purposes:

Essential Cookies: Required for Platform functionality, authentication, and security. These cannot be disabled.
Functional Cookies: Remember user preferences, settings, and login status for improved experience.
Analytics Cookies: Help us understand how users interact with the Platform to improve our services.
Performance Cookies: Monitor Platform performance and identify technical issues.

We do not use cookies for behavioral advertising to students. You may manage cookie preferences through your browser settings, though disabling certain cookies may affect Platform functionality.

How Gamify Education protects your data.