Privacy Policy

1. Introduction

[Penciil, Inc.] (“Penciil”, “we”, “us”, or “our”) respects your privacy. This Privacy Policy describes how we handle personal information in connection with the Penciil Service. It applies to instructors, coordinators, graders, students, administrators, and website visitors.

2. Information we collect

We collect information you provide, information from your Institution, and information collected automatically:

• Account information — name, email address, role, and institution.
• Roster and enrollment data — provided by your Institution or synced from a learning management system.
• User Content — assessments, submissions, responses, grades, and feedback.
• Usage and device data — log data, IP address, browser type, and interactions with the Service.
• Cookies and similar technologies — as described in our Cookie Policy.

3. How we use information

• To provide, operate, and maintain the Service;
• To authenticate users and secure accounts;
• To enable grading, results, and integrations with your LMS;
• To communicate with you about the Service, including support and updates;
• To improve and develop the Service;
• To comply with legal obligations and enforce our agreements.

4. Legal bases for processing (EEA/UK)

Where the GDPR or UK GDPR applies, we process personal information on the following legal bases: performance of a contract; our legitimate interests in operating and improving the Service; compliance with legal obligations; and, where required, your consent. Much processing is carried out on behalf of Institutions acting as data controllers, with us acting as a data processor.

5. How we share information

We do not sell personal information. We share it only as needed to provide the Service:

• With your Institution and authorized users, consistent with their roles;
• With service providers who process data on our behalf under appropriate safeguards;
• With integrated services you or your Institution enable, such as an LMS;
• When required by law, legal process, or to protect rights, safety, and security;
• In connection with a merger, acquisition, or sale of assets, subject to this Policy.

6. Student data and educational records

We understand that student information is sensitive. Where applicable, we handle student records consistent with laws such as the U.S. Family Educational Rights and Privacy Act (FERPA), acting as a “school official” with a legitimate educational interest under the direction of the Institution. We use student data only to provide the Service and do not use it for advertising.

7. Data retention

We retain personal information for as long as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Institutions may request deletion or export of their data subject to applicable law and our agreements.

8. Data security

We implement technical and organizational measures designed to protect personal information, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. International data transfers

We may process and store information in countries other than your own. Where we transfer personal information across borders, we use appropriate safeguards, such as standard contractual clauses, as required by applicable law.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, restrict, or object to the processing of your personal information, and to data portability. Where processing is based on consent, you may withdraw it. To exercise these rights, contact us using the details below; note that for data controlled by an Institution, we may direct your request to that Institution.

If you are a California resident, you may have rights under the CCPA/CPRA, including the right to know, delete, and opt out of the “sale” or “sharing” of personal information. We do not sell personal information.

11. Children’s privacy

The Service is intended for use by educational institutions and their users. Where students under the age of 13 (or the applicable age) use the Service, we rely on the Institution to provide any required consents. We do not knowingly collect personal information from children outside the educational context.

12. Cookies

We use cookies and similar technologies as described in our Cookie Policy. You can manage cookies through your browser settings.

13. Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where required, provide additional notice.

14. Contact us

If you have questions or requests regarding this Privacy Policy or your personal information, contact us at privacy@penciil.com, or by mail at [Penciil, Inc.], [Company address].