Brainscape Privacy Policy

Summary

Respecting your privacy, your data, and your personal information is critical to achieving Brainscape's mission of helping you — and/or your students — study more efficiently.

In plain English, here are Brainscape's most important privacy and data security principles:

• Brainscape collects only minimal personal info from you: Just email & name. You can even use a fake name!
• The rest of the data we collect is mostly about your study behavior and is necessary to make the app work as intended.
• If you are studying in a class managed by your instructor, only your instructor can see your study data, unless you choose to share it with others manually
• All other usage data is kept securely to Brainscape and our trusted tech infrastructure providers (e.g. your device info, activity logs, credit card info, etc.)
• We do NOT share or sell your data, or integrate with third-party "ad" networks
• Brainscape never runs personalized ads to any users on our website or apps
• You can delete your Brainscape account (or your students' accounts) whenever you want, ideally after having first removed content you've created
• Brainscape complies with GDPR, COPPA, and other key data privacy and protection laws in multiple countries.

1. Information Brainscape Collects

1.1 No Sensitive Information

As described above, we limit data collection to what we need to provide the requested services. Brainscape does not collect data considered or defined as sensitive under any relevant country and state laws including COPPA, FERPA, CCPA, and other laws of the US, PIPEDA and related federal and provincial laws in Canada, GDPR, and related laws in the EU, UK, Switzerland, and EEA, and similar laws in Australia, Brazil and other countries in which Brainscape provides its service, such as those related to race or ethnicity, health and biometric information, or political affiliation. In addition to these categories, we do not collect information on student grades or free or reduced lunch eligibility.

1.2 Information You Provide

Brainscape requires an account to use effectively. The provision of any personal identifiable information is purely opt-in, at the user's discretion.

We collect only the minimum personal information required to operate our web and mobile apps, software and services. We do not access browser history, contact lists, search terms, preferences, device identification, biometric data, or health data. Behavioral data is only collected as directly related to providing the service.

If you create an account, Brainscape saves the account information you provide. This information may include: an email address, a parent or guardian email address, first name, last name, profile photo, or organization name. You are welcome to supply an anonymous name unless your instructor or organization requires a correct name.

If you join a shared flashcard collection made by another user or educator, your name and study activity may be visible to that content creator privately.

Your full provided name or personal information is not displayed publicly on our website to users who are not logged in, unless you have created publicly shared content. And even then, recall that you are able to use a fake name when creating your Brainscape account.

You may also be providing additional information to Brainscape if you communicate with our support team, participate in user research, marketing campaigns or sweepstakes, or otherwise use the services. We only collect this type of information from adults and non-students users and we do not permit minors, children or students to participate in user research, marketing campaigns or sweepstakes, or otherwise use the services.

All interactions with the Brainscape website or mobile app produce metadata that may identify you or could be identifiable information when paired with other information about you. In every case, Brainscape strives to collect only the minimum necessary information from you as is necessary or appropriate to fulfill the purpose of the visitor's interaction with Brainscape or that is required by law. Visitors to the Brainscape website or app may always refuse to supply personally identifying information.

If you engage in a financial transaction with Brainscape, we do not process or store this information beyond the transaction. Financial transactions are processed via a PCI-compliant payment provider and data is not stored by Brainscape. As you use the service, you may also create academic content including flashcards. This information is not typically personally identifying, but it may be deleted at any time either by the relevant account holder or by reaching out to our team at support@brainscape.com.

1.3 Information Collected Automatically

Each time you log into and/or use our product, we automatically collect information about your activity, which we use to continually customize our product, analyze technology performance, and refine our private communications with you. This information may include the following:

• Log Information: We collect log information about your use of the Platform, including the type of browser that you use; the time, duration and frequency of your access; Platform pages viewed; your IP address; and the page you visited before visiting our Platform
• Device Information: We collect information about the computer or mobile device that you use to access our Platform, including the hardware model, operating system and version, unique device identifiers, and mobile network information
• Location Information: We may collect information about the location of your device each time you use our Platform based on your consent to the collection of this information
• Learning Activity: As a core part of our product offering, we store information about your study frequency and your progress toward learning various subjects. If you share content you have created with other users, we may collect information about their learning activity as well
• Web and Mobile Usage Analytics: We may use internal or third-party analytics technologies, such as Google Analytics, to track your activity such as page views, clicks, time on page, and other standard usage information. The security of this information is guaranteed by our third-party analytics partners
• Information Collected by Cookies and Other Tracking Technologies: We and our service providers collect information using various technologies, including cookies and pixel tags (which are also called clear GIFs, web beacons, or pixels). Cookies are small data files stored on your hard drive or in device memory that help us improve our Platform and your experience, and track usage of our Platform. Pixel tags are electronic images that may be used in our Platform or emails, and track usage of our Platform and effectiveness of communications. Most web browsers enable you to disable Cookies, but such actions may limit or prohibit the product from functioning properly
• Other Information: With your specific permission, we may collect other information from your device, such as photos from your device that enable you to add images to flashcards

1.4 Data Retention

We will retain your information for as long as your account is active or as needed to provide you services. We conduct periodic reviews of accounts and may delete accounts that have been inactive for extended periods of time, normally not sooner than one year. We may retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. You may delete your account or update your information at any time by visiting www.brainscape.com/account.

2. Information Shared with Third Parties

2.1 Third-Party Cloud Provider: Amazon Web Services

Brainscape utilizes the services and infrastructure of outside parties to host its data, and we hold those providers to a standard at least as protective of student data as the measures outlined in this policy.

Our primary cloud provider, Amazon Web Services (AWS), is the world's largest data hosting company and has leading practices in security standards and personnel in place to constantly monitor this area. A link to AWS’s Privacy Center can be found here.

2.2 Third Party Cloud Providers: Google and Apple

Google's and Apple's application programming interfaces (“APIs”), including Google Sign-In and Apple Sign-in, are part of authentication frameworks that give Brainscape the ability to connect directly with users by requesting access to Google or Apple user data. The Google APIs Terms of Service and Apple Developer Terms of Service govern the use of such API Services when Brainscape requests access to this user data.

Brainscape commits to adhere to the Google and Apple API services user data policies, including their Limited Use requirements, for any data received from Google or Apple APIs.

Brainscape may collect information from these partners and integrated technologies. For example, if you choose to use Google Login or join using the Google Classroom integration, we may receive information including your name and email address from Google. Brainscape does not have access to the passwords used to log into your Google or Apple accounts.

2.3 Third-Party Artificial Intelligence (AI) Platforms

Brainscape products may integrate with the APIs of major providers of public generative AI services, such as OpenAI, Anthropic, or others, in the service of generating flashcards or explanations.

When offering such AI features, we do NOT transmit personal data to any third-party AI service providers. The only data shared with AI providers is the raw study materials that users provide to be transformed into flashcards.

We adhere to the following principles when sending data to AI platforms:

• Use of AI features is opt-in, with tooltips and descriptions provided before any AI results are presented to a user
• All information provided to these AI providers is securely transmitted, and not shared with any additional third parties
• Information uploaded by Brainscape users is only used to create educational materials and enhance our services
• Results of our AI Tools are only visible to Brainscape users for their own searches, unless our users choose to make the educational materials they create public on the Brainscape platform
• With all of our AI providers, we have disabled their use of any Brainscape user data for training their own large language models (LLMs), and our AI providers do not use our data to train their LLMs

2.4 Third-Party Services with Minimal Data Access

In order to provide and improve Brainscape, a limited number of third-party services may require access to your personal information. For example, your account data are saved in a data center so that you can log in from any device.

Our third-party services are contractually prohibited from using your information except to provide the service. Brainscape expends great efforts to ensure that we only work with the most trusted third parties with limited access to personal data or personally identifiable information.

2.5 Other Third-Party Details

Third-party services that transfer the personal information of EU residents are contractually bound to comply with GDPR. GDPR-specific information can be found in this Privacy Policy and Notice below.

Brainscape may be required to disclose your information to a third party to comply with the law or a valid legal request. In such cases, we will let you know in advance, unless we are legally prohibited from doing so.

2.6 Change of Control

If Brainscape (or substantially all of its assets) are acquired by another company, personal information will be transferred to a new owner. In such a transfer, you will be notified and the new owner may continue to use your personal information as set forth in this policy.

If you do not consent to the use of your personal information by such a successor company, subject to applicable law, you may request its deletion as described elsewhere in this policy. In the unlikely event that Brainscape goes out of business, or files for bankruptcy, we will protect your personal information, and will not sell it to any third-party.

3. How Brainscape Uses Your Information

3.1 We Limit All Disclosures

Brainscape uses the data we collect about you to operate, maintain, quality control, improve and develop and enhance the services we provide, secure information, develop new services, and protect our users and the company from security breaches or other unauthorized disclosures or uses.

Brainscape limits its disclosure of both information that could on its own or in combination with other information be used to identify you. We only disclose that information in order to (i) process it on Brainscape's behalf or to provide services available at Brainscape's website and mobile applications; and, (ii) with third party providers who agree not to disclose that information to others.

3.2 We Don’t Sell Any Personal Information or Data

Brainscape does not rent, sell or exchange any data, including but not limited to, personally identifying information or potentially personally identifying information to any third party.

Other than to Brainscape's employees, contractors, and affiliated organizations, as described above, Brainscape discloses potentially personally identifying information only when required to do so by law such as to comply with a court order, or when Brainscape believes in good faith that disclosure is reasonably necessary to protect the property, or legal rights or safety of Brainscape, third parties or the public at large.

• Brainscape does not benefit or profit from students’ or users’ personal information
• Brainscape does not profile children for marketing purposes or in ways that lead to unfair, unethical or discriminatory treatment
• We do not monetize bid-stream data or audience data originating from child-directed or child-user content or traffic
• We do not repurpose student data with personally identifiable information or use it for research without express consent, unless authorized by statute or all data anonymized
• We securely destroy or make anonymous in a timely manner all personal information that is no longer required to provide the app/software/service

The information we collect helps us to provide the service, maintain a consistent experience, and improve it or develop new services. Examples of how this information is used include:

• Providing access to your account and saving progress over time
• Personalizing your experience based on factors such as general location, preferred language and areas of study
• Helping teachers identify and support individual students
• Analyzing engagement with specific features over time

We also use personal information to enforce our policies, comply with the law, and promote safety on the platform. These efforts protect the property, or legal rights or safety of Brainscape, third parties or the public at large. Examples of these efforts include:

• Preventing security breaches and fraud
• Protecting users from inappropriate content
• Verifying the identity of a user
• Complying with privacy legislation

Brainscape may aggregate statistics about the behavior of visitors to our website and app to improve our services. For instance, Brainscape may monitor the most popular flashcards on the Brainscape site. Brainscape may display this information publicly or provide it to others.

3.3 Consent to Identification as a Customer

Notwithstanding the above limits on disclosures, by using the Brainscape platform, services and/or educational or other products, you agree that, (a) if you are a paid school account or business user, (b) a corporation or other business, school, school district or agency or other company, or (c ) an individual acting on behalf of one of the above entities, then (i) Brainscape may identify you as a customer and user of Brainscape services, and (ii) use your logo in sales presentations, marketing materials and press releases.

Unless stated otherwise in a customer order, you agree to grant Brainscape a revocable limited license to use your organization’s name and logo solely to identify you as a customer of Brainscape, on Brainscape's website, in marketing materials, presentations, or substantially similar formats. Brainscape will not identify any child or student as an individual user for any of these purposes.‍

3.4 Communicating with You; Updates

‍If you are a registered Brainscape user, Brainscape may occasionally send you communications via email (if provided) or push notification (for mobile app users) to tell you about new features, get your feedback, and to keep you up to date with what's going on with Brainscape and our products.

By registering to use our service you consent to the receipt of these communications, including text communications. You may choose to participate in sweepstakes and promotions which may have additional terms and conditions.

You may choose to stop receiving such communications by unsubscribing from emails and by disabling push notifications.

If you send us a request (for example via a support email or via one of our feedback mechanisms), we reserve the right to publish it anonymously in order to help us clarify or respond to your request or to help us support other users.

We use de-identified queries and answers to build our knowledge base for users and to improve our products. We will not identify you in any posting or publication of your request. We will only engage in these activities where we have a legitimate interest, such as those stated above, and for de-identified data only, or with your consent.

3.5 We Do Not Run Personalized Advertisements

• Brainscape complies with all applicable laws and regulations regarding advertising, and specifically advertising on sites designed for and used by children
• Brainscape does not allow or run personalized ads in its platform, make use of any third party trackers, or otherwise attempt to collect personal information from minors or on content sets as made for children
• Brainscape may occasionally promote or endorse educational products offered by our content partners in addition to our own products. These offers are carefully vetted by humans and are targeted by Brainscape's own data processors; no education partner offering products to Brainscape users has access to our targeting data
• Brainscape does not permit any paid ads that incite children to purchase a product or service or urge parents or others to buy the item. Brainscape does not permit any paid ads that incite parents or others to purchase a third-party product or service

3.6 Openness and Transparency

Brainscape makes every effort to communicate privacy notices, terms of use, contracts etc., in clear, specific and unambiguous language that explains to users how their personal information is being used, processed, disclosed and retained by the provider and any third parties. In the event that any of our policies are unclear, please reach out to us to clarify and update.

4. Managing Your Personal Information and Data

4.1 Data Subject Rights

‍You have the right to delete, access, update, correct errors in, and export for transfer any of your personal information. Brainscape makes these data subject rights available to you regardless of which country or US state you reside in.

4.2 Managing Subsequent Use and Disclosure of Personal Information

‍As explained throughout this Privacy Policy, you have the ability to control the use of your personal information by Brainscape. If you wish to prevent Brainscape from using your information in any way whatsoever, you always retain your right to delete your account at any time.

‍With the exceptions explained below for information you shared with other Brainscape users, this allows you to eliminate any subsequent use and disclosure of your personal information. If your personally identifiable information changes, or if you no longer want to use Brainscape, you may review, edit, or delete it by visiting Brainscape's Account page, found at https://www.brainscape.com/account.

‍Parents may remove, delete or update an account or any information concerning their child that is posted on Brainscape by visiting their child’s settings page, working with their child’s teacher, or by contacting us at support@brainscape.com.

‍You have the right to erasure of your data, and Brainscape does not charge a fee for this service.

5. Data Security

5.1 Standards

Brainscape follows generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. Our security measures include the use of access-controlled data centers hosted in the United States, encryption of all data in transit, and the encryption of user password data both in transit and at rest. No method of transmission over the Internet, or method of electronic storage, however, is 100% secure.

Brainscape reviews our Data Security regularly as part of its comprehensive security program in place that is reasonably designed to protect the security, privacy, confidentiality, and integrity of students’ and educators personal information against risks, (such as, unauthorized access or use, unintended or inappropriate disclosure) through administrative, technological, and/or physical safeguards appropriate to the sensitivity of the information, as detailed within this policy.

Brainscape's security program includes, but is not limited to, enforcement of strong password protection and full encryption of sensitive or confidential information.

Brainscape uses some outside parties to host its data and holds those providers to a standard at least as protective of student data as the measures outlined in this policy. Our main cloud provider, Amazon Web Services (AWS), is the largest data hosting company and has leading practices in security standards and personnel to constantly monitor this area. A link to AWS Privacy Center can be found here.

5.2 Data Processing Location and Jurisdiction

Brainscape is a U.S. company and the service is hosted in the United States. The information we collect is hosted on servers located in the United States. By using Brainscape, you consent to the transfer and processing of your personal information in the United States.

Brainscape is committed to compliance with all applicable privacy laws and regulations of the EU, UK and Switzerland, primarily outlined in the General Data Protection Regulation (GDPR). Brainscape is also cognizant of and committed to upholding the UK variations from or amendments to EU regulations on data privacy and security.

The Data Protection Act 2018 (DPA 2018) is, in essence, the UK's implementation of the EU General Data Protection Regulation (GDPR). All references herein to compliance with the EU GDPR principles and requirements shall apply equally with respect to Brainscape compliance with UK DPA 2018.

Similar national, regional, or state data processing compliance requirements may also be covered by Brainscape's data processing practices. For more information on whether Brainscape meets your regional requirements, please contact support@brainscape.com.

5.3 Breach Protocol

Brainscape has a detailed data breach protocol and checklist prepared in the event of breach. Our actions upon identifying a breach will include notifying affected individuals as soon as reasonably possible after discovering a security that poses a real risk of significant harm, or if the breach affects or may affect your data. We will provide details of the breach or potential breach and mitigation measures we are taking.

In the event of a security breach, we will notify affected account holders within the amount of time required by law so that you can take steps to keep your data safe.

5.4 Questions About Security Practices

If you have any questions about Brainscape security practices, you can contact us at support@brainscape.com. Brainscape reserves the right not to disclose our policies, procedures and the technologies and methods we employ to advance the security of your data to safeguard our practices.

6. Compliance with Privacy Laws

Brainscape complies with all applicable country, state and other applicable privacy laws in the places in which it provides its services.

This includes but is not limited to the Children’s Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), state laws including but not limited to the California Consumer Privacy Act (CCPA), which has been updated by the California Privacy Rights Act (CPRA), Virginia (VCDPA), Colorado (ColoPA) and other applicable federal and state laws in the United States; the European Union’s GDPR and related laws in non-European Union jurisdictions in which we do business (Switzerland and UK), Australia, Canada, Brazil and other applicable national laws and regulations.

Each of these sets of regulations and standards is hereby incorporated by reference with respect to any mandatory compliance elements.

This Brainscape Privacy Notice and Policy is deemed and shall be read and construed to include all mandatory elements of these laws and regulations, and any conflict between this Notice and Policy and mandatory elements of any applicable regulations shall be read in favor of those laws and regulations.

7. How to Contact Us About Your Privacy

Brainscape's official company name is Bold Learning Solutions, Inc. (dba "Brainscape"), incorporated in the U.S. state of Delaware and subject to that state's jurisdiction and arbitration regulations.

If you have questions or wish to send us comments about this Privacy Policy, please send an email to support@brainscape.com, or write us at:

Bold Learning Solutions, Inc. (dba Brainscape)
159 W 25th St, Ste 517
New York, NY 10001
Attention: Data Privacy