StudentNest Inc provides tutoring, educational programs, and learning technology to students, families, schools, school districts, and public agencies. This policy explains how StudentNest collects, uses, discloses, protects, retains, and deletes personal information and student data. It also describes the additional protections that apply when StudentNest provides services to a school or district, including Chicago Public Schools.

StudentNest treats student data as confidential. StudentNest uses student data only to provide authorized educational services, follows the instructions of the applicable school or district, and does not sell or rent student data or use it for targeted advertising.

1. Scope

This policy applies to StudentNest websites, applications, tutoring platforms, live and recorded educational sessions, support services, assessments, communications, and other services that link to or incorporate this policy. It covers information collected directly from individuals and information provided by or generated for a school or district.

A written agreement with a school or district may impose additional or stricter requirements. StudentNest follows those requirements for data governed by that agreement. If this policy conflicts with an executed agreement with Chicago Public Schools, the Chicago Public Schools agreement controls.

2. Definitions

Student Data means information directly related or reasonably linkable to a student that is provided by a student, parent or guardian, school, district, teacher, or authorized user; generated through use of the services; or maintained by StudentNest for an educational purpose. Student Data includes Covered Information under the Illinois Student Online Personal Protection Act and personally identifiable information from education records under the Family Educational Rights and Privacy Act when those laws apply.

School means a school, school district, educational agency, or other organization that authorizes StudentNest to provide educational services.

Services means the StudentNest and LOTUS websites, applications, tutoring programs, assessments, instructional tools, communications, reports, and related support services.

3. Information We Collect

StudentNest collects only information that is adequate, relevant, and reasonably necessary for the authorized educational services. For school-sponsored programs, StudentNest collects a category of Student Data only when the applicable agreement or Student Data Exhibit authorizes that category.

3.1 School Provided and Account Information

• Student name and, when authorized, parent or guardian name.
• Student, parent or guardian, teacher, and staff email addresses and other approved contact information.
• School, district, classroom, grade level, course, subject, roster, and program information.
• Student identifiers, usernames, authentication identifiers, and account status. StudentNest does not request a student’s CPS password when CPS-approved single sign-on is used.
• Language and other educational support information when required to deliver the authorized program.
• Other demographic or program information only when specifically authorized and necessary for the contracted educational purpose.

3.2 Educational and Platform Information

• Assessment questions, responses, scores, pre-assessment and post-assessment results, grades when supplied, progress measures, and instructional outcomes.
• Individual learning plans, content assignments, tutor notes, instructional recommendations, feedback, and reports.
• Attendance, session dates, session duration, scheduling, tutor assignment, and participation records.
• Messages, text chat, whiteboard content, documents, files, and student work created or shared through the services.
• Audio, video, and session recordings only when CPS or the applicable school expressly authorizes recording and the recording category and purpose are specifically identified in the executed Student Data Exhibit or other written agreement.
• IP address, device and browser information, login events, activity records, diagnostic information, and security or audit logs.
• Information generated by authorized adaptive or automated educational features, including content recommendations and progress information.

3.3 Website and Direct Enrollment Information

When a visitor contacts StudentNest, enrolls directly, requests support, submits an inquiry or application, or purchases services, StudentNest may collect the information the person provides, such as name, email address, mailing address, telephone number, account information, inquiry content, enrollment information, and employment application information. Payment information may be collected or processed by an authorized payment provider. StudentNest may also collect IP address, device, browser, log, and website interaction information needed to operate, secure, and improve the website.

4. How We Use Information

StudentNest uses personal information and Student Data only for the purpose for which it was collected or another compatible purpose permitted by law and the applicable agreement. Authorized uses may include:

• Creating accounts, authenticating users, rostering students, and assigning students to classes, tutors, programs, or content.
• Providing live, virtual, in-person, or hybrid tutoring and delivering grade-level, subject-specific, or personalized instruction.
• Administering assessments, creating learning plans, tracking attendance and progress, evaluating program delivery, and preparing authorized reports.
• Providing scheduling, service, security, and non-marketing account notifications.
• Maintaining, securing, troubleshooting, supporting, and auditing the services.
• Responding to inquiries and support requests and complying with legal or contractual obligations.

StudentNest does not use CPS Student Data to promote or market StudentNest or third-party products or services. General communications to website visitors or direct adult customers are kept separate from school-sponsored Student Data and are subject to applicable consent and opt-out requirements.

5. Adaptive and Automated Educational Tools

StudentNest may use adaptive or automated tools within the services to recommend instructional content, organize learning plans, assist tutors, or prepare progress information. These tools may process only the Student Data authorized for the applicable educational purpose.

For CPS programs, adaptive or automated processing may occur only when the applicable data categories, processing purpose, and any third-party provider are specifically identified in the executed CPS Student Data Exhibit or a CPS-approved written amendment.

StudentNest does not use CPS Student Data to train, fine-tune, evaluate, or improve publicly available, general-purpose, or third-party artificial intelligence models and does not permit a service provider to do so. Any other model development using CPS Student Data requires CPS’s prior express written authorization, must be permitted by law, and must be identified in the executed CPS Student Data Exhibit or a CPS-approved written amendment. StudentNest does not sell Student Data or use automated tools to target advertising to students or their families.

6. Disclosure and Subprocessors

StudentNest may disclose Student Data only as necessary to provide the authorized services and only in the following circumstances:

• To the school or district that authorized the services, and to authorized parents, guardians, students, teachers, or staff as directed by that school or district.
• To StudentNest employees and authorized personnel who need the information to provide or support the services and who are subject to confidentiality obligations.
• To hosting, storage, backup, communications, video, authentication, rostering, security, support, analytics, or other service providers that are authorized in the applicable school agreement or Student Data Exhibit.
• When required by law, court order, subpoena, or a valid request from an authorized government authority, after notice to the school or district when legally permitted.
• To a successor in a merger, acquisition, or reorganization only if the successor agrees to protect Student Data under terms at least as protective as the applicable agreement.

Each service provider that can access Student Data must be identified as required by the applicable school agreement and must sign written terms that restrict its use and require privacy, security, deletion, and incident-response protections no less protective than StudentNest’s obligations. StudentNest maintains a current written inventory of subprocessors and the data and purpose associated with each one. For CPS, the current inventory is stated in the executed CPS Student Data Exhibit and any CPS-approved written amendment. Only subprocessors identified there may access or store CPS Student Data.

7. Prohibited Uses

StudentNest does not:

• Sell, rent, lease, trade, or otherwise monetize Student Data.
• Use Student Data for targeted advertising or to advertise or market to students, parents, guardians, or schools based on Student Data.
• Use persistent identifiers or Student Data to create an unauthorized commercial profile about a student.
• Collect Student Data outside the permissions granted by the applicable school agreement.
• Disclose Student Data except as authorized by the applicable agreement or required by law.
• Attempt to re-identify properly deidentified data or allow another party to do so.
• Use Student Data to train general-purpose artificial intelligence models without express written school or district authorization and a lawful basis.

8. School Control and Student Data Ownership

The applicable school or district retains ownership and control of Student Data provided to or generated for that school or district. StudentNest receives no ownership interest in Student Data. When StudentNest receives education records under FERPA’s school official exception, StudentNest performs an institutional service for the school, remains under the school’s direct control regarding use and maintenance of the records, uses the records only for authorized purposes, and does not redisclose personally identifiable information except as authorized by the school and permitted by law.

StudentNest complies with applicable student privacy laws and contractual obligations, including FERPA, the Children’s Online Privacy Protection Act when applicable, Illinois SOPPA, and the Illinois School Student Records Act. Compliance with a law depends on the service, the student’s age, and the role in which StudentNest receives the information.

9. Security

StudentNest maintains reasonable administrative, technical, and physical safeguards designed to protect Student Data from unauthorized access, acquisition, destruction, use, modification, or disclosure. Safeguards are selected according to the sensitivity of the data and the services and include, as appropriate, access controls, authentication, encryption in transit and at rest, activity logging, audit controls, secure backups, vulnerability and patch management, workforce privacy and security training, incident-response procedures, and oversight of service providers.

Access to Student Data is limited to authorized individuals with a legitimate educational or operational need. StudentNest documents and logs access where required by the applicable agreement. Student Data exchanged with CPS must use CPS-approved single sign-on, rostering, secure file transfer, application programming interfaces, or other approved methods. Student Data may not be transmitted through ordinary email. Email may be used for a generic notification that directs an authorized user to sign in securely, provided the message does not include Student Data beyond information CPS has authorized for that communication.

StudentNest does not enable advertising, social-media tracking, or unapproved analytics or tracking technologies in the authenticated CPS service environment. Any analytics, monitoring, or support provider that can access CPS Student Data must be approved by CPS and identified in the executed CPS Student Data Exhibit or a CPS-approved written amendment.

10. Retention Deletion and Return

StudentNest retains Student Data only for as long as it is needed to provide the authorized services, satisfy the applicable school agreement, or comply with a legal obligation. StudentNest maintains procedures to securely delete, destroy, or return Student Data, including copies held in active systems and backups, according to the applicable agreement and backup-deletion cycle. A legal hold may delay deletion only for the information and period legally required.

For CPS Student Data, StudentNest will delete an individual student’s data within seven calendar days after receiving a request from the CPS SOPPA Representative, unless CPS provides written consent for continued maintenance or the executed agreement or law permits it. StudentNest will also delete or transfer CPS Student Data at CPS’s direction when the data is no longer needed, at the end of the academic year when required, and no later than ten calendar days after the later of completion of all reports required under the CPS agreement or the agreement’s expiration or termination. StudentNest will confirm deletion when CPS requests confirmation and will follow any shorter or additional deadline in the executed CPS agreement.

11. Access Review Correction and Transfer

Parents, guardians, and eligible students may have rights to inspect, review, obtain a copy of, and request correction of Student Data. When StudentNest maintains Student Data for a school or district, requests should be submitted to that school or district so it can verify identity and determine the appropriate response. StudentNest will assist the school or district and provide, correct, delete, clarify, or transfer data within the period required by the applicable agreement.

StudentNest has designated an internal Student Data Request Manager to coordinate school and district requests. Requests involving CPS Student Data must be routed through the CPS SOPPA Representative at privacyoffice@cps.edu. After receiving a verified request from CPS, StudentNest will provide the requested Student Data to privacyoffice@cps.edu in PDF format within seven calendar days, correct a factual inaccuracy within seven calendar days, and confirm the correction to CPS within seven calendar days after making it, unless the executed CPS agreement requires a shorter period.

StudentNest does not independently disclose CPS Student Data in response to a parent or student request unless CPS authorizes the disclosure or the law requires it. StudentNest will also support CPS-directed procedures that allow a student, parent, or guardian to transfer student-generated content to a personal account when required by law or the executed CPS agreement.

12. Data Security Incidents

StudentNest maintains procedures to investigate, contain, document, and remediate a suspected or confirmed unauthorized acquisition, access, use, or disclosure of Student Data. StudentNest will notify the affected school or district without unreasonable delay and within the shorter period required by law or contract. For CPS, StudentNest will notify the CPS SOPPA Representative within 24 hours after confirming a breach, unless the executed agreement requires earlier notice, and will provide the information and cooperation required by that agreement.

StudentNest will coordinate public communications and notices with the affected school or district and will not notify students or families directly unless the school or district authorizes the notice or the law requires StudentNest to provide it.

13. Cookies Website Technology and External Services

StudentNest websites and services may use cookies, local storage, log files, or similar technologies that are necessary for authentication, security, preferences, functionality, performance, or legally permitted analytics. StudentNest does not use CPS Student Data collected through the services for targeted advertising and does not permit an advertising provider to collect data in the authenticated CPS environment. Where consent is required for nonessential technologies, StudentNest will request consent or provide an appropriate choice.

StudentNest websites may link to or integrate with external services, such as support, maps, social media, payment, video, or authentication services. Their independent activities are governed by their own privacy terms unless they process Student Data for StudentNest, in which case the restrictions in this policy and the applicable school agreement apply.

14. Children and Direct Consumer Services

For school-sponsored services, StudentNest relies on the school’s authorization and direction to collect and use Student Data for the educational purpose permitted by law and the applicable agreement. Where COPPA permits a school to consent on behalf of a parent, StudentNest uses the child’s information only for the school-authorized educational service and not for an unrelated commercial purpose.

For a direct-to-family service involving a child under 13, StudentNest obtains verifiable parental consent when COPPA requires it. A verified parent or guardian may request access to, correction of, or deletion of the child’s personal information and may withdraw consent, subject to legal and service limitations.

15. Deidentified and Aggregated Information

StudentNest may create deidentified or aggregated information only when permitted by the applicable school agreement. StudentNest removes direct and indirect identifiers using reasonable methods designed to prevent identification, treats deidentified CPS data as confidential when the CPS agreement requires it, and does not attempt to re-identify the information. StudentNest does not disclose deidentified data to another party unless the agreement permits the disclosure and the recipient is contractually prohibited from re-identification.

16. Changes to This Policy

StudentNest may update this policy to reflect changes in its services, legal requirements, or privacy practices. The current version is intended to remain publicly available at https://www.studentnest.com/student/privacy-policy/. StudentNest will post the revised policy with a new effective date and provide advance notice to affected schools and districts of a material change involving Student Data when required by law or contract. StudentNest will not apply a material change retroactively to permit an incompatible use of Student Data without the authorization required by law and the applicable agreement.

17. Contact Information

Questions about this policy or StudentNest’s privacy practices may be directed to:

Student Data Request Manager inquiries may be directed to support@studentnest.com. Requests involving CPS Student Data should first be submitted to the CPS SOPPA Representative at privacyoffice@cps.edu. StudentNest will work through CPS to verify and fulfill those requests.

18. CPS Specific Commitments

For services provided to Chicago Public Schools, StudentNest further commits that:

• StudentNest will collect, use, generate, maintain, and disclose only the Student Data categories and purposes identified in the executed CPS Student Data Exhibit.
• Any data category not identified in the CPS Student Data Exhibit will not be collected, and any third party not identified in the exhibit or a CPS-approved amendment will not access or store CPS Student Data.
• Recordings, adaptive or artificial-intelligence processing, analytics, monitoring, and related subprocessors will be used for CPS only when expressly authorized and identified in the executed CPS Student Data Exhibit or a CPS-approved written amendment.
• StudentNest will maintain the required subprocessor inventory, designate a Student Data Request Manager, and meet the CPS access, correction, transfer, deletion, and incident-notification deadlines stated in this policy and the executed agreement.
• CPS Student Data will remain under CPS control and will be used only to perform the services authorized by CPS.
• StudentNest will comply with all requirements in the executed CPS agreement. If this policy provides less protection, the CPS agreement controls.