Privacy Policy – Toolkit

This Privacy Notice for California Residents supplements our main privacy policy and applies to visitors, users, and others who live in California and whose personal information Enome processes as a “business.” It does not apply to personal information we collect in the following circumstances:

• From employees or job applicants in their capacity as employees or job applicants;
• Personal information we collect from employees, owners, directors, officers, or contractors of businesses in the course of our provision or receipt of business-related services; and
• Information that we process as a service provider on behalf of other businesses. Please see our main privacy policy for more information on how we process information as a service provider.

The CCPA defines “sale” and “personal information” very broadly. Certain uses of your data described above may constitute a sale under the CCPA, as we currently understand it. If you would like to opt out of our use of your information for purposes that are considered a “sale” under California law, or if you want us to delete tracking cookies that enable targeted advertising, which allow us to provide promotions and offers relevant to you, you may do so by sending an email to support@goalbook.com. If you clear your cookies after you asked us to delete tracking cookies, we will not be able to know that you made this request so you will need to opt-out again. Please note that we do not knowingly sell the personal information of minors under 16 years of age without legally required affirmative authorization. The CCPA requires us to give California residents certain information about the categories of personal information we collect and how we use it, the categories of sources of the information, categories of third parties to whom we disclosed the information during the past twelve months for business purposes, and the categories of third parties to which we sold or shared personal information in the past twelve months. While we have set out the categories below as required by the CCPA, you can review our main privacy policy for more detailed information that describes our collection, disclosure, and use. Depending on how you interact with us, we may collect, use, and disclose the categories of information summarized below.

Categories of Personal Information

Educator Identifiers

• Required data for user accounts: name, email, title, school name and/or district name
• Optional data if user or Contracting Organization elects to provide: phone, grade levels, subjects taught, and other educator-related data fields

Student Identifiers

• Required data for certain features: name, disability information, assessment and behavioral data
• Optional data includes the upload of work samples and other documents

Location and Device Data

Categories of Sources of Personal Information

• You
• Contracting Organization (e.g., district, school, etc.)
• Your browser and device

Categories of Third Parties That We Share Personal Information With

• Service providers
• Research partners, solely when agreed upon by Contracting Organization
• AI models for translation, summarizing, and recommendation services

Data entered by users is only used in AI model context windows to generate a specific model response, with the explicit understanding that AI responses are influenced by the data entered. Your data is never used for model training or any other purpose that persists and changes the model’s weights or behavior. AI models used are privately and securely hosted and accessed.

Please note that we may also disclose all personal information to (a) comply with federal, state, or local laws; (b) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities; (c) cooperate with law enforcement agencies concerning conduct or activity that we believe may violate federal, state, or local law, (d) when we sell, transfer or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction), or (e) to professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.

Categories of Third Parties That We Sell Personal Information To

We never sell personal information.

Categories of Business/Commercial Purposes for Our Use of Your Information

All of the categories of personal information we collect about you (as detailed above) are used for the following purposes:

• Providing our Services
• For our operational purposes
• Improving our existing Services and developing new products and services
• Detecting, protecting against, and prosecuting security incidents and fraudulent or illegal activity
• Bug detection, error reporting, and activities to maintain the quality or safety of our Services
• Uses disclosed in our privacy policy
• Other uses that we may notify you about

California Residents’ Privacy Rights

Subject to certain restrictions, California residents have the right under the CCPA to request that we:

• Provide you with the categories of personal information we have collected or disclosed about you in the last twelve months; the categories of sources of such information; the business or commercial purpose for collecting or selling your personal information; and the categories of third parties with whom we shared personal information.
• Provide access to and/or a copy of certain information we hold about you.
• Delete certain information we have about you.
• Honor your opt-out of the “sale” of your personal information.
• Correct inaccurate personal information we have about you.

You may have the right to receive information about the financial incentives that we offer to you (if any). You also have the right to not be discriminated against (as provided for in applicable law) for exercising your access, deletion, or sale opt-out rights. We will not discriminate against you for exercising your rights. Certain information may be exempt from such requests under applicable law. For example, we need certain types of information so that we can provide the Services to you. Asking us to delete your information may impact your ability to use our Services, including closure of your user account and you may no longer be able to access or use all or parts of the Services. If you would like to exercise any of these CCPA rights, you may send an email to support@goalbook.com. Please include “CCPA REQUEST” in the email subject line and include, in the body of the email, your name (First and Last), email address, state and zip code of residence, and a description of the CCPA rights you wish to exercise. After submitting your request(s), we are required to verify your request(s) to ensure it is not fraudulent. To verify your request, we will contact you via the email address you provided with, or to submit, your request. Further, we may require you to confirm ownership of the email address associated with your request or provide additional information necessary to verify the validity of your request. For example, we may ask for you to provide additional information to determine if it matches information we have. Please be sure to check your SPAM/junk folder in case the email is filtered out by your mail system. If you do not receive an email from us regarding your request(s) within 48 hours, your request or contact information may not have been submitted properly, and you will need to submit a new request. You may also designate an authorized agent to make a request on your behalf. To do so, you must provide us with a copy of written authorization or a power of attorney, signed by you, for the agent to act on your behalf. You will still need to verify your identity directly with us.

Data Retention We retain your information, including student data and personally identifiable information for as long as is necessary to provide the Services or for other necessary purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. In determining how long to retain information, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we process the information, applicable legal requirements, and our legitimate interests. The purposes for which we process information (as well as the other factors listed above) may dictate different retention periods for the same types of information. If you opt out of email marketing, we maintain your email on our suppression list for an extended time to comply with your request. We may delete or de-identify your information sooner if we receive a verifiable deletion request, subject to exemptions under applicable law. We may retain cached or archived copies of your information.

This Privacy Notice for Minnesota Residents supplements our main privacy policy and applies to visitors, users, and others who live in Minnesota and whose personal information Enome collects, uses, stores or processes as a “business.” It does not apply to personal information we collect in the following circumstances:

• From employees or job applicants in their capacity as employees or job applicants;
• Personal information we collect from employees, owners, directors, officers, or contractors of businesses in the course of our provision or receipt of business-related services;
• Information that we process as a service provider on behalf of other businesses. Please see our main privacy policy for more information on how we process information as a service provider.

Applicability and Scope

We comply with the Minnesota Student Data Privacy Act (Minn. Stat. Section 13.32) which governs the protection and permissible uses of educational data and education support services data for students in Minnesota.  Our role as a “technology provider” means we are subject to these legal requirements.  We are not the owner of any student data; all data is owned by the Contracting Organization.

Prohibited Uses and Data Treatment

We do not sell or commercialize student data or use it for marketing or advertising to students or parents. We share certain student data with certain of our partners to provide the Services as further described below.  We do not otherwise share any student data.  Aggregated or de-identified data may only be used to improve, maintain or support the Services.

We do not engage in surveillance, such as tracking location, recording audio or video, logging keystrokes, or monitoring web-browsing activities via school-issued devices.

We collect and use limited “sensitive data” relating to students, being learning disability solely in connection with student assessments.  We do not collect or use any other “sensitive data” of any student for any reason.  Certain sensitive data, being student learning disability data and such other sensitive data as may be entered by end users (but not required, requested or used by us) may be shared with Amazon Web Services (for both types of sensitive data) and Azure (for other sensitive data as may be entered by end users, but not required, requested or used by us) for purposes of providing the Services.

“Sensitive data” means personal information of or relating to a student’s racial or ethnic background, religious beliefs, mental or physical health condition or diagnosis, sexual orientation or citizenship or immigration status.

Parent Notice and Review Rights

Public agencies must provide parents with direct and timely notice of contracts with technology providers like us, including details about the educational data affected, provider identity, contact information, and the opportunity to review the contract.  Parents also have the right to inspect and review their student’s education records which may include certain student data we collect and use relating to student assessments.  Parents may also request correction of any incorrect, inaccurate or misleading student records. 

Parent Opt-Out Rights

Under Minnesota law, parents have the right to refuse the inclusion of any or all of their student’s data as directory information.

Exercise of Rights

If you would like to exercise any of these Minnesota law rights, you may send an email to support@goalbook.com. Please include “MINN REQUEST” in the email subject line and include, in the body of the email, your name (First and Last), email address, state and zip code of residence, and a description of the Minnesota law rights you wish to exercise. To verify your request, we will contact you via the email address you provided with, or to submit, your request. Further, we may require you to confirm ownership of the email address associated with your request or provide additional information necessary to verify the validity of your request. For example, we may ask for you to provide additional information to determine if it matches information we have. Please be sure to check your SPAM/junk folder in case the email is filtered out by your mail system. If you do not receive an email from us regarding your request(s) within 48 hours, your request or contact information may not have been submitted properly, and you will need to submit a new request. You may also designate an authorized agent to make a request on your behalf. To do so, you must provide us with a copy of written authorization or a power of attorney, signed by you, for the agent to act on your behalf. You will still need to verify your identity directly with us.

Changes to Provisions

The following provision set forth in Section “Information We Collect – User-provided Information” of the Privacy Policy is hereby replaced with:

• User-provided Student Information. We may receive personally identifiable information about a student when a user of the Services (such as a teacher or administrator) enters information about a student. We use such information only to provide the Services (with any personally identifiable or “sensitive information” as defined under Minnesota law being used solely to conduct certain student assessments pursuant to our Services), although certain features require the retention and storage of such information. Our use, retention and storage and protection of this personally identifiable information in accordance with this Privacy Policy, Federal Educational Rights Privacy Act (FERPA), and applicable state laws.

The following provision set forth in Section “How We Use Collected Information” of the Privacy Policy is hereby replaced with:

We use the information that you provide or that we collect to operate, maintain, enhance and provide all of the features of the Services. This may include sharing of information with third party service providers solely in order to provide you the Services although we do not share any “sensitive information.” We use the information that you provide that we collect to understand and analyze the usage trends and preferences of our users, to improve the Services, and to create new features and functionality. We may use your email address or other personal information to contact you for administrative purposes such as customer service, to address intellectual property infringement, right of privacy violations or defamation issues related to your User Content posted on the Services, or other messages related to the Services. We may use “cookies” information and “automatically collected” information to: (a) personalize our services, such as remembering your information so that you will not have to re-enter it during your visit or the next time you visit our website; (b) monitor and analyze the effectiveness of Service; and (c) monitor aggregate site usage metrics such as total number of visitors and pages viewed.

The following provision set forth in Section “When We Disclose Information” of the Privacy Policy is hereby replaced with:

Your privacy is very important to us, and we are not in the business of selling your information, nor do we do so. Any information, including personally identifiable information, that you voluntarily choose to include in an area of the Services accessible to other users, such as when you share resources with others through our private and secure links, will be available to anyone who has access to that content, including other users. Once you make your personally identifiable information available in this way, it may be collected and used by the recipients. We work with third-party service providers to provide website and application development, hosting, maintenance, and other services for us related to the operation of the Services. We may disclose your personally identifiable information (but not “sensitive information”) to the extent it is necessary for these third-party service providers to complete their contractual obligations to us. Such disclosure is made under these third-party service provider terms, and limited to using the information for the purpose of providing the Services. We gather certain information automatically and store it in log files. This information may include IP addresses, browser type, internet service provider (“ISP”), referring/exit pages, operating system, date and time stamp, clickstream data and other data. We use this information to manage and operate the Services. We automatically collect and aggregate non-personally identifiable information to: (i) comply with various reporting obligations; (ii) for business or marketing purposes; or (iii) to assist us in understanding our users’ interests, habits, and usage patterns for certain programs, content, services, advertisements, promotions, and/or functionality available through the Services. We may also disclose your information if required to do so by law or in the good-faith belief that such action is necessary to comply with state and federal laws (such as U.S. Copyright law), in response to a court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement activity. We also reserve the right to disclose your information when we believe, in good faith, that disclosure is appropriate or necessary to take precautions against liability; to protect us and others from fraudulent, abusive, or unlawful uses or activity; to investigate and defend ourselves against any third party claims or allegations; to assist government enforcement agencies; to protect the security or integrity of us and the Services; or to protect the rights, property, or personal safety of Enome, our users, or others. In the event that we are acquired by or merged with a third-party entity, we reserve the right to transfer or assign the information we have collected from you as part of such merger, acquisition, sale, or other change of control. You will be notified by email or a prominent notice on our Services of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

The following provision set forth in Section “Your Choices” of the Privacy Policy is hereby replaced with:

You may, of course, decline to share certain personally identifiable information or “sensitive information” with us, in which case we may not be able to provide to you some of the features and functionality of the Services. You may update or correct your profile information and preferences at any time by accessing your account preferences page through the Services. You may request deletion of your account, including all profile information and any library data you stored on our system, by writing an email request from your email account to support@goalbook.com. Please note that while your changes are reflected promptly in active user databases, we may retain information you submit for a variety of purposes, including backups and archiving, prevention of fraud and abuse, and analytics.

The following provision set forth in Section “Data Retention” of the Privacy Policy is hereby replaced with:

We retain your information, including student data and personally identifiable information for as long as is necessary to provide the Services or for other necessary purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. In determining how long to retain information, we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we process the information, applicable legal requirements, and our legitimate interests. The purposes for which we process information (as well as the other factors listed above) may dictate different retention periods for the same types of information. If you opt out of email marketing, we maintain your email on our suppression list for an extended time to comply with your request. We may delete or de-identify your information sooner if we receive a verifiable deletion request, subject to exemptions under applicable law. We may retain cached or archived copies of your information. Notwithstanding the foregoing, we comply with any contractual requirements to return data pursuant to our contract with the Contracting Organization.