At Education Analytics, privacy isn't just a policy—it's a priority. As a non-profit whose mission is to use data to improve outcomes for students and the K-12 education system, the security and safety of those data is our primary focus, not an afterthought.

Protecting the privacy of our users and our partners is fundamental to our mission and our business. Even one minor breach of data privacy puts our reputation and our bottom line in jeopardy. More than that, it undermines the very mission we work day in and day out to fulfill: putting students and their best interests at the forefront of everything we do.

What’s in This Policy?

This privacy policy governs the use and disclosure of all data that Education Analytics obtains, meaning data that are generated from or provided to an EA platform by a user (such as teachers, school leaders, administrators, and others). These data include user activity information as users interact with our platforms (such as the Rally Analytics Platform, CORE Dashboard, South Carolina Growth Dashboard, Strategy Workshop, or Strategy Clearinghouse).

This policy does not govern how Education Analytics uses data that we receive from a partnering agency, such as students’ Personally Identifiable Information (PII). The use of those data is specified in the contract and Data Release Agreement (DRA) signed by Education Analytics and a partnering agency when work on a project or partnership begins. These contracts and DRAs are at least as stringent, and often more so, than the policies described here, and they always comply with all district and state regulations related to data privacy.

This policy also does not govern how Education Analytics uses data that we collect from users of our website at edanalytics.org. Please see EA's website privacy policy for that information.

We start by explaining what we believe about privacy and what we promise when it comes to privacy. Next, we briefly summarize what we might do with data we obtain and what we will never do with data we obtain. These four sections are just a summary of what comes later in the policy, so that you can reference the basics at the top of this page, and dig into the details as you continue reading.

After that, we list out key definitions for the terms we use throughout the policy. Although some of these terms have precise legal definitions, we try to use plain English whenever possible in order to be transparent about how we think about privacy.

Next, we’ll go through the kinds of data that EA obtains, describe how EA uses this information, and specify how EA will never use this information.

At the end, we have some Frequently Asked Questions about all things privacy and security at EA.

If you are a teacher, school leader, or educator who uses an EA platform or product, you can find an explanation of what our privacy policy means for you here.

What We Believe:

• We believe data are something we protect, not something we own. Fundamentally, we do not own any data. We are simply stewards of the data provided to us by our partners.
• We believe privacy is part of our product stack. It’s important to us that you know how your information is protected, because it’s a feature (not a side effect) of our tools and solutions.
• We believe security adds value to what we do. Our work consists of enhancing the data provided to us through things like data analysis and visualization, and then giving it back to the people who own it. If we can’t do that securely, our work loses its value.

What We Promise:

• We will never sell the data we obtain.
• We use the latest best practices from the broader security industry to protect all the data we obtain.
• We do not own any of the content that is added to a platform.
• We are transparent about our practices, and we will always notify our partners if anything changes.
• We will never advertise in a platform that we create and provide.
• We rigorously adhere to and comply with FERPA, COPPA, and all applicable state laws.

What We Might Do with Data We Obtain:

• Verify a user’s identity, so we know each user has access only to the data they should.
• Analyze trends and patterns in users’ activities, so we can make improvements to the platform they are using.
• Monitor how often users are visiting certain pages of our platforms, so we know what’s useful and what’s not.
• Make it easier for users to log-in to our platforms, by remembering their information (when they want us to)
• Personalize the content users see within one of our platforms
• Share the data back to the LEA or SEA that pays for the platform and therefore owns the data, if the LEA or SEA requests it

What We Will Never Do with Data We Obtain:

• Sell the data we obtain to any outside agency
• Use the data to advertise to users (or to anyone else)
• Share the data with anyone, except the LEA or SEA that pays for the platform, if requested
• Conduct research with the data for any purpose other than improving the products we provide—and only when this purpose is explicitly agreed upon in our contracts with our partners

Key Definitions

1. When we talk about we or us, we mean Education Analytics (EA).
2. When we talk about you or your data, we mean an agency that EA partners with (i.e., a partnering agency), such as local education agencies (LEAs), state education agencies (SEAs), non-profit organizations, and any other organization that purchases an EA platform.
3. When we talk about users, we mean individuals who use and engage with an EA platform. This could include, for example, users employed by the partnering agency (e.g., a teacher employed by a district) or users under the jurisdiction of the partnering agency (e.g., a teacher under the jurisdiction of a state education agency).
4. When we talk about an EA platform, we mean a product, dashboard, platform, or interactive tool that EA creates, administers, and maintains, and that is purchased by a partnering agency for use by users in that agency.
5. When we talk about data, we mean any data that can be obtained through an EA platform. This includes data that are generated from a user's activity on an EA platform, and data that a user provides to an EA platform. In the next section, we describe each type of data that we obtain in more detail: user identity information, user-provided information, cookies information, log file information, and web usage analytics.

What data does EA obtain via our platforms?

1. User Identity Information: When you pay to provide users with access to one of our platforms, we obtain each user’s name and email address. You might provide this information to us directly, or we may obtain this information from an “Identity Provider service,” which is a third-party sign-in service (like a user’s Google account). The user’s name and email address allows us to verify their identity and provide services to the user via the platform.
2. User Provided Information: EA collects any information that users provide or submit to us directly, such as email communications and help desk communication via our platforms.
   
3. Cookies Information: When a user visits one of our platforms, we may send one or more cookies to the user’s computer that uniquely identifies their browser. Our platforms may use both session cookies and persistent cookies. A session cookie is temporary and disappears after a user closes their browser. A persistent cookie remains after a user closes their browser, and may be used by the browser on later visits to the site.
   
   Users can remove cookies by following the instructions provided by the web browser they are using. Users can set their web browser to refuse all cookies, or to indicate when a cookie is being sent, but note that some features of our platforms may not function properly if users disable the ability to accept cookies.
4. Log File Information: When users access one of our platforms, our servers automatically record certain information that their web browser sends whenever they visit any website. These server logs can include information such as their:
   • web request
   • Internet Protocol (“IP”) address
   • browser type
   • browser language
   • referring pages (meaning the URL that directs a user to our platform)
   • exit pages (meaning the last page in our platform a user visits before leaving our site)
   • the user’s platform type (meaning the operating system on a user’s computer or device)
   • number of clicks
   • domain names
   • landing pages
   • pages viewed and the order of those pages
   • the amount of time spent on particular pages
   • the date and time of a request
   • one or more cookies that may uniquely identify the user’s browser
5. Web Usage Analytics: EA uses Matomo Analytics to help our internal team analyze how users interact with our platform. Matomo collects user information like IP addresses, browser types, unique user webpage visits, and referring/exit pages and websites. EA has selected Matomo as the provider of these web usage analytics because they are an open-source platform that is committed to exceptional privacy protection and to never sharing any of the analytics they collect on EA’s behalf with any other party. This ensures that the information we obtain is solely used for the purposes we’ve outlined here—all in service of improving users’ experiences with our platforms.

We also use a small number of third-party services as part of our platforms, including Amazon Web Services, that may collect usage data for their own purposes. However, these third-party services are prohibited from sharing these usage data with other parties and from using them for advertising or marketing purposes.

EA does not own any data; instead, you (the partnering agency) own the data we obtain about users’ activities. This means that if you request for EA to share the data we obtain about users’ activities on an EA platform, EA will provide those data back to you, but only for the users that are part of the relevant partnering agency (for example, if requested, we will send usage analytics about the teachers and principals within a local education agency to that local education agency—but never to any other agencies that may use a version of the same platform).

How does EA use these data?

For all of the types of information described above, we only use that information for the sole and explicit purpose of providing our services to users, and improving how we do that.

Here are examples of the ways that EA uses the information that users provide to us:

• We rely on users’ information to ensure that they have access to the data they should, and only the data they should, and to prevent access by anyone who shouldn’t.
• We provide teachers, schools, and educators with customer support.
• We research, analyze, and interpret trends of users’ activities to improve and develop new features for the platform the user is engaged with—but we never share or disclose those with any third parties or other agencies.
• We design and develop enhancements to our platforms that are relevant for our users, including educators, school leaders, district administrators, and state education leaders.
• For some platforms, users can enter data themselves that they want to access later. In those cases, we need to associate a user’s activities on the platform with their identity, so that we can give them access to those data at a later time. For example, in the Rally Analytics Platform, users can write notes about a student that get saved for them to view later.
• We investigate, prevent, and detect activities on our service that we believe may violate the law or applicable regulations.
• We use both users’ personally identifiable information and certain non-personally-identifiable information (such as anonymous user usage data, cookies, IP addresses, browser type, clickstream data, etc.) to improve the quality and design of our platforms. This allows us to create new features, functionality, and services by storing, tracking, and analyzing user preferences and trends. But we never release these data and our analyses to anyone else, and we never use those data for advertising.
• We may use cookies, clear GIFS (meaning a tracking pixel that is clear/invisible to the user but tells us that the user visited our pages), and log file information to:
  • remember information so that users will not have to re-enter it during their visit or the next time they visit our website or platforms
  • provide custom, personalized content and information
  • monitor aggregate metrics, such as the total number of visitors, pages viewed, etc.

But we never extend this outside of the platforms that we provide—meaning we don’t use activity on any other websites or platforms, and we don’t let others see users’ activity in our platforms.

What won’t EA do with these data?

We will never:

• Sell the data we obtain to any outside agency
• Use the data to advertise to users (or to anyone else)
• Share the data with anyone, except the LEA or SEA that pays for the platform, if requested
• Conduct research with the data for any purpose other than improving the products we provide—and only when this purpose is explicitly agreed upon in our contracts with our partners

Frequently Asked Questions (FAQs) for Partnering Agencies

Below is a list of FAQs for our partnering agencies.

Who owns the data that EA obtains?

We believe data are something we protect, not something we own. Fundamentally, EA does not own any data; we are simply stewards of the data provided to us by our partners. As the partnering agency that pays for an EA platform, you own the data that we collect through that platform.

How do users opt out of web usage analytics?

It is required for us to collect and use certain kinds of data, such as user identity information and user provided information, which allow users to securely log in to our platforms and have access to the correct data. However, EA offers flexibility when it comes to opting out of web usage analytics. Because you own the data EA obtains, you can opt out of EA collecting web usage analytics. Individual users are not able to opt in or opt out of web usage data collection, as the agreement exists between you and EA; however, if you decide to permit opt in or opt out of web usage analytics at the user level, EA will enable this feature. When this feature is enabled, users should log in and out repeatedly until a pop-up appears with a checkbox users can select to opt out of web usage analytics.

Can users request to see the data that EA obtains about them?

Because you own the data we obtain about your users’ activities on an EA platform, you can request for EA to share those data back to you, but only for your users, who are part of the relevant partnering agency (for example, if requested, we will send usage analytics about the teachers and principals within your local education agency to you—but never to any other agencies that may use a version of the same platform).

How does EA keep your data safe?

EA views protecting your security and privacy, as well as those of your users, as central to our mission and our business. We’ve put a number of measures in place to protect the integrity of users’ information, including use of access-controlled data centers, routine third-party security audits, restricted employee access to user information, data encryption in transit, and encryption of data at rest.

In the event of a security breach, we will notify affected account holders within the amount of time required by law, so that users can take steps to keep their data safe.

Does EA allow advertising, or does EA share data for advertising?

Absolutely not. EA is a non-profit organization, so we are prohibited from commercial activity like advertising. More importantly, we have no interest in advertising within our platforms, as they are designed for use only by educators and our partners. We never display ads, allow third-party ads, share data for advertising or marketing purposes, or allow data collection by third-party advertisers or data brokers.

Does EA use these data for research purposes?

As specified in our contract with you, EA obtains permission from you to use the data we obtain for research purposes to improve the quality of our products and services, as well as to improve users’ experiences with our platforms.

EA does not use these data for any other research purposes, unless you request and approve such use.

When might EA need to share my information?

The short answer: In very limited circumstances, and only as needed, such as in one of the scenarios listed below.

1. We may be asked to provide personally identifiable information and non-personally-identifiable information to other businesses or persons for the purpose of protecting such information on our behalf. Examples of this include performing an IT security audit and/or a data security audit, in order to support the use of our platforms. We require that these parties agree to process all such information in compliance with our privacy policy. We also use reasonable efforts to limit their use of such information, and to use other appropriate confidentiality and security measures.
2. We may release personally identifiable information and/or non-personally-identifiable information if required to do so by law, or in the good-faith belief that such action is necessary to comply with state and federal laws (such as U.S. Copyright Law) or respond to a court order, subpoena, or search warrant.

We never share users’ personally identifiable information (such as their name or email address) with other, third-party companies for commercial or marketing use. We may, however, share users’ personally identifiable information for the two other purposes described above—in other words, only if required by law or as part of a data security audit.

We never sell users’ personally identifiable information to third parties. We may, however, use their email address without further consent for non-marketing or administrative purposes (such as notifying users of major changes to our platform, or for customer service purposes).

Does EA obtain data about [blank]?

We’ve listed the data we obtain via our platforms in the section above, “What data does EA obtain via our platforms?” We intentionally limit the data we obtain to only what we need to provide our services to users on the platforms those users engage with.

Does EA work with third-party analytics services?

EA is an organization committed to continuous improvement. Towards this end, we use aggregate data about how our platforms are used—for example, what buttons users click on or what pages users visit—to inform our decisions about how to improve the platforms we create or what new features to build into our platforms.

To help us analyze these kinds of data, we use a small number of third-party services (such as Matomo Analytics) to analyze usage data on our platforms. Under no circumstances are any data that users have shared with EA (such as account information or any notes users input into a platform) shared with these services. These services are also prohibited from sharing these usage data.

How does EA use cookies?

Cookies are small text files that we transfer to users’ web browsers in order to identify their web browsers and store information about their accounts. We only use these cookies to keep users logged in to the platform they are using, to customize their experience, and to understand how they use the platform for our internal team to improve upon it.

Users can choose to remove or disable cookies via their browser settings. Please be aware that some of our platforms, or some features of a platform we provide, will not work properly if users disable or decline cookies.

How can users view, correct, edit, port, or update their personal information?

Any personal information that we have about users comes from data records that you provide to us. If users want to correct, edit, download, or update this information, they need to work directly with their school site or with you. Users can also contact us at support@edanalytics.org.

What about international users?

Our website and platforms are hosted in the United States, and are intended for and directed to users in the United States. If users are accessing our platforms from the European Union, Asia, or any other region with laws or regulations governing personal data collection, use, and disclosure that differ from United States laws, users’ continued use of the platform (which is governed by U.S. law and this Privacy Policy) amounts to transferring and consenting to the transfer of their personal information to the United States.

What happens if EA experiences a merger, sale, or bankruptcy?

EA does not own any data—we are simply stewards of the data provided to us by our partners. The contracts that we sign with you, the partnering agency, govern that stewardship. As a result of this, in the event that EA is acquired by or merged with a third-party entity, those contracts would need to be renegotiated with the third-party entity, or the third-party entity would have to delete the relevant data.

In the unlikely event of our bankruptcy, insolvency, reorganization, receivership, or assignment for the benefit of creditors, the same principle applies. This means that the stewardship of the data would be renegotiated with you, or the relevant data would be deleted.

What changes will be made to this privacy policy in the future?

EA’s Privacy Policy may be revised periodically. In the event of a material change in the management of user data, EA will document those changes in this page, and will update the “Last Updated” date at the bottom of this page.

Please revisit this page to remain aware of any changes. Continued use of our platforms constitutes your agreement to EA’s Privacy Policy and any future revisions, and your agreement to regularly check this page for updates.

Who do I contact if I have questions?

support@edanalytics.org

Last Updated: August 9, 2023