Privacy Policy

This Privacy Policy explains how Provenance Learning Inc. ("Provenance," "we," "us," or "our") collects, uses, discloses, and safeguards personal information when you use our oral-assessment platform and related websites and services (collectively, the "Services"). Provenance helps students explain submitted work, faculty verify understanding, and institutions receive reviewable evidence of learning.

We serve colleges, universities, and other educational institutions (each, an "Institution"). When an Institution uses the Services, that Institution generally controls the student and course data processed through the platform. In those cases we act as a service provider / processor on the Institution's behalf, and the Institution's own privacy notices also apply.

1. Information we collect

We collect the following categories of information:

• Account and profile information. Name, email address, institutional affiliation, role (e.g., student, faculty, administrator), and authentication identifiers provided by you or your Institution.
• Student submissions and assessment content. Work submitted for review, guided oral review recordings (audio), transcripts, responses, and the evidence and scores generated during an assessment.
• Usage and device information. Log data, IP address, browser and device type, pages viewed, and interactions with the Services, collected to operate and secure the platform.
• Communications. Information you provide when you contact us, request a demo, or provide support inquiries.

2. How we use information

We use personal information to:

• Provide, maintain, and improve the Services;
• Conduct and record oral assessments and generate reviewable evidence of learning;
• Authenticate users and secure accounts;
• Provide customer support and respond to inquiries;
• Monitor, detect, and prevent fraud, abuse, and security incidents;
• Comply with legal obligations and enforce our agreements.

We do not sell personal information, and we do not use student data to train third-party advertising models or for behavioral advertising.

3. Student data and FERPA

Much of the data processed through the Services constitutes "education records" under the U.S. Family Educational Rights and Privacy Act ("FERPA"). When we process education records on behalf of an Institution, we do so as a "school official" with a legitimate educational interest, under the direct control of the Institution with respect to the use and maintenance of those records. We use education records only to provide the Services and do not re-disclose them except as directed by the Institution or as permitted by law.

4. How we share information

We share personal information only in the following circumstances:

• With your Institution. Faculty and authorized administrators can access the assessment evidence generated for their students and courses.
• With service providers (subprocessors). We use trusted vendors to host and operate the Services, including cloud infrastructure provided by Amazon Web Services (AWS). These providers process data only on our instructions and under contractual confidentiality and security obligations.
• For legal reasons. When required to comply with applicable law, legal process, or to protect the rights, safety, and security of users and the public.
• In a business transfer. In connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Data retention

We retain personal information for as long as needed to provide the Services and as directed by the applicable Institution, and thereafter as required to comply with our legal obligations, resolve disputes, and enforce our agreements. Institutions may request deletion of their data in accordance with their agreement with us.

6. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, and continuous monitoring. Learn more on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights and choices

Depending on your location and role, you may have rights to access, correct, delete, or restrict the processing of your personal information, or to receive a copy of it. If your data is managed by an Institution, please direct your request to that Institution, which controls the relevant records; we will support the Institution in responding. You may also contact us using the details below and we will route your request appropriately.

8. International data transfers

We operate in the United States, and the information we process may be stored and processed there. If you access the Services from outside the United States, you understand that your information may be transferred to and processed in the United States, where data-protection laws may differ from those in your jurisdiction.

9. Children's privacy

The Services are designed for use by educational institutions and their faculty and students, generally in higher-education settings. We do not knowingly collect personal information from children under 13 except as part of, and as directed by, an Institution operating under applicable law. If you believe a child has provided us information outside of an Institution's direction, please contact us so we can address it.

10. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice. We encourage you to review this Policy periodically.

11. Contact us

If you have questions about this Policy or our privacy practices, contact us atprivacy@provenancelearning.ai.