Legal
Last updated: May 18, 2026 · v2.1
EdPilot, Inc. ("we," "our," or "us") operates an AI-powered educational platform that gives students a course-specific AI Teaching Assistant and gives professors the tools to manage, distribute, and track their curriculum.
This Privacy Policy explains what personal information we collect when you use EdPilot, how we use and protect that information, and what choices you have. It applies to all users — students, professors, and demo visitors.
By accessing or using EdPilot you agree to this policy. If you do not agree, please stop using the platform.
When you register we collect your name, email address, encrypted password, role (student or professor), and institutional affiliation. Professors may provide additional verification during the approval process.
Professors upload course materials — syllabi, lecture slides, assignments, and practice exams — which form the knowledge base for each course's AI Teaching Assistant. Students generate content through their interactions with the assistant: questions asked, responses received, and study sessions created.
When you access EdPilot through an LMS integration (Canvas, Blackboard, Moodle, etc.), we receive a signed LTI launch payload from your institution. This payload includes your institution-assigned user ID, course context ID, role (student or instructor), LMS platform identifier, and — where enabled — NRPS roster data and AGS grade passback configuration. This data is processed exclusively to authenticate you, provision your account, and scope the correct course context. LTI launch data is treated as student education records under FERPA.
We log how you interact with EdPilot: features accessed, time on platform, chat session history, practice quiz attempts, course enrollments, and message frequency. This data drives the engagement analytics professors see in their dashboard.
EdPilot uses server-side session tokens (stored in HTTP-only, Secure cookies) solely to authenticate your logged-in session. We do not use third-party advertising cookies, behavioral tracking pixels, or cross-site tracking technologies. We do not use Google Analytics or any advertising network.
We collect IP addresses, browser type, device identifiers, operating system, and access timestamps to maintain platform security and optimize performance.
Your course enrollment and the materials your professor uploaded let us scope the AI to your specific curriculum — no generic web results.
Usage patterns power the learning profile dashboard: study streak, accuracy trends, topic strengths, and Socratic-mode recommendations.
Aggregated, course-level engagement data (messages sent, session length, practice performance) gives professors visibility into class-wide learning trends.
We send account verification, course invitation, and important security emails. Non-essential communications can be opted out of in your account settings.
We flag unusual usage patterns (e.g., high-volume prompting around exam windows) in the professor analytics dashboard. This supports — not replaces — human academic integrity review.
Aggregated, anonymized data helps us improve AI response quality and develop new features. Individual conversations are never used to train AI models.
EdPilot is subject to the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, with respect to student education records maintained on behalf of educational institutions.
Student chat history within a course, help request submissions, engagement analytics associated with a named student, LTI launch data, and any documents a student uploads to a course.
Your FERPA rights:Students have the right to inspect their education records, request amendments to inaccurate records, and consent to disclosures not permitted by FERPA. Exercise these rights through your institution's registrar — EdPilot will respond to all valid institutional FERPA requests within five (5) business days.
When you interact with EdPilot's AI chat or ask for help, your message and relevant course context (syllabus excerpts, course documents, course description) are sent to AI model providers (Google Vertex AI and Anthropic) to generate a response.
No training on your data. Ever.
Neither Google Vertex AI nor Anthropic use EdPilot API inputs or outputs to train their models. EdPilot does not use student conversation data to fine-tune any model. Conversation history is stored in EdPilot's database and is accessible to you and your course instructors.
In transit
TLS 1.2+
At rest
AES-256
Infrastructure
GCP (US)
Students can only access courses they're enrolled in. Professors can only manage their own courses and see data from enrolled students. Administrative access is limited to essential personnel.
| Data type | Retention period |
|---|---|
| Active course chat history | Duration of enrollment + 1 year |
| LTI launch records | 90 days after last launch |
| Usage analytics (aggregated) | 3 years |
| Help request records | 2 years |
| Account data after deletion | Deleted within 30 days |
| Backup snapshots | Overwritten within 90 days |
| Security / audit logs | 1 year |
Retention may be extended where required by applicable law or institutional policy.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:
To submit a California privacy request, email legal@edpilot.ai with subject line "California Privacy Request." We will respond within 45 days as required by law.
Residents of Virginia (VCDPA) and Colorado (CPA) have substantially similar privacy rights regarding personal data we control:
Submit Virginia or Colorado privacy requests to legal@edpilot.ai. We will respond within 45 days (extendable by an additional 45 days with notice).
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and its local implementations give you additional rights regarding your personal data.
EdPilot's infrastructure is hosted in the United States (Google Cloud Platform, us-central1). Transfers of personal data from the EEA to the US are conducted under Standard Contractual Clauses (SCCs) incorporated into our data processing agreements with sub-processors.
Submit GDPR requests to legal@edpilot.ai. We will respond within 30 days as required by GDPR Article 12.
In the event of a security incident involving unauthorized access to or disclosure of personal data, EdPilot will:
To report a security vulnerability or suspected breach, contact security@edpilot.ai immediately.
EdPilot is built for higher education — college and university students, typically 18 years or older. We do not knowingly collect personal information from anyone under 13.
If we discover that we have inadvertently collected data from a child under 13 without verifiable parental consent, we will delete it from our systems immediately.
We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we do, we'll update the "Last Updated" date at the top of this page.
For material changes that affect your rights we'll also send an email notification to all registered users. We encourage you to review this page periodically.
Privacy & legal inquiries: legal@edpilot.ai
Security concerns: security@edpilot.ai
General support: support@edpilot.ai