Effective Date: April 01, 2021
Instructure, Inc. (“Instructure”) values the privacy of children. This COPPA Privacy Policy (“COPPA Policy”) serves as our online notice under the Children’s Online Privacy Protection Act (“COPPA”) and contains important information about how we collect, use, and disclose the personal information we collect about Children who use our Services (defined below) that are directed to Children. In this policy, “Child” or “Children” means a user under 13 years old. This COPPA Policy also explains how a parent or guardian (“parent” or “you”) can restrict the collection, use and/or disclosure of your Child’s information and how you can request deletion of your Child’s information.
Instructure’s Services
This COPPA Policy applies to Child users of Canvas, a learning management system that schools, including administrators and teacher end users (collectively, “Schools”), use to facilitate learning outcomes. In some instances, other services provided by Instructure, including Portfolium and MasteryConnect, are bundled into Canvas, and in these instances this COPPA Policy will also apply to the bundled services. These services also may be offered through companion mobile applications (“Apps”). This COPPA Policy refers to all of these Instructure services collectively as the “Services”.
This COPPA Policy does not apply to:
-
Any personal information we collect about non-Child users (e.g., students over 13 years old, teachers, and parents) through our Services or any personal information we collect through other Instructure services that are not directed to Children, including Portfolium and MasteryConnect (when not bundled into Canvas). All such personal information is subject to the Instructure Product Privacy Policy, available here.
-
Our corporate website, www.instructure.com (“Site”), which is subject to the Instructure Marketing Privacy Policy, available here.
To use the Services, Schools may submit personal information about their students or ask Students to provide personal information to the Services. When a School uses our Services in the classroom or an educational setting, the School provides consent to this collection and use of personal information from and about Children as required under applicable laws, including COPPA.
Who Operates the Services?
Instructure operates the Services and will collect personal information about Children as described in this COPPA Policy. We can be contacted at:
Instructure, Inc.
6330 S. 3000 E.
Cottonwood Heights, UT 84121
1-800-203-6755
privacy@instructure.com
What Information Do We Collect About Children?
How Information is Collected. We may collect information about Children directly from Children and/or their Schools, as well as automatically through a Child's use of our Services. We will not require a School or Child to disclose more information than is reasonably necessary to use our Services.
Information We Collect Directly. We may collect a Child’s name and other personal information when a School provides it to us. For example, through our Services, Schools can create assessments and track their Students’ learning progress. In doing so, Schools may require the Child’s personal information in order to track and archive evidence of learning. Schools decide how they will use our Services and Schools are responsible for ensuring that their collection and use of personal information from Children through the Services complies with applicable laws. If you are a parent and you have questions about your Child's School’s use of our Services, you should discuss your questions with your Child’s School.
Schools also have the option of creating accounts for their Students which allows those Students to view their learning progress and access learning resources provided by their School. If a School chooses to register a Child for an account, Canvas will generate a username and temporary password and provide them directly to the School which may then share them with the Child. After logging in, the Child can then create a permanent password for their account.
Once an account is created, we collect information about Children’s performance and activities on our Services. We may use deidentified or aggregated data in order to improve our services.
Parents can tell us to stop collecting personal information from their Children; however, in such cases the Children will not be able to use our Services. If you direct us to stop collecting and using your Child's personal information, we will notify the School of your request and disable your Child’s use of our Services.
Information We Collect Automatically. We may automatically collect information about a Child’s use of our Services through our servers and in log files, such as the following: domain name; browser type and operating system; web pages viewed; links clicked; the length of time spent on our Services; the length of time our Services are used; the referring URL, or the webpage that led a user to our Site; language information; device name and model; operating system type, name, and version; and activities within our Services. We use this information to analyze trends, administer the Services, track users’ movements around the Services, gather demographic information about our user base, and better tailor our Services to our users’ needs. Except as noted in this COPPA Policy, we do not link this automatically collected data to a Child’s personal information.
We may also collect IP address, device identifier or a similar unique identifier from Child users of our Services; we use such identifiers solely to support the internal operations of our Services in the same manner as described above, including to maintain or analyze their functioning; perform network communications; authenticate users or personalize content; and protect the security or integrity of users and our Services. We never use unique identifiers to track Child users across third-party apps or websites.
We may also collect information from any mobile devices that a Child uses if the Child has downloaded one or more of our Apps to their device. This information is used to help us deliver the Services to the Child. Examples of information that may be collected and used include how the Child uses the App(s) and information about the type of device the Child is using. In addition, in the event our App(s) crash on a mobile device, we will receive information about the mobile device model software version and device carrier, which allows us to identify and fix bugs and otherwise improve the performance of our App(s). This crash information is sent to us as aggregated information that does not identify an individual.
How We Use Children’s Information
We use personal information about Children to provide the Services. We do not use personal information about Children for our own commercial purposes.
For the Services. We use the personal information that we collect about Children for the following general purposes:
- To provide our Services;
- To respond to customer service and technical support issues and requests;
- To identify the Child as a user in our system;
- To improve our Services; and
- To tailor the content and information that we may display to Children, to offer personalized help and instructions, or to otherwise personalize a Child’s experiences while using the Services.
As Requested by Schools. When a School provides a Child’s name and other personal information, we use that personal information for the following additional purposes:
- To provide Children and Schools with information and reports about a Child’s performance and use of the Services; and
- If requested, to facilitate creation of a Child’s account.
Aggregate or De-identified Information. We may use aggregate or de-identified information about Children for research, analysis, and similar purposes. When we do so, we strip out names, email, contact information, and other personal identifiers. For example, we may use aggregate or de-identified information for one or more of the following purposes, among other purposes:
- To better understand how users access and use our Services;
- To improve our Services and respond to user desires and preferences; and
- For other research and analytical purposes.
How We Share Children’s Information
We do not sell personal information about Children, and there is no means for a Child to make his or her personal information public through our Services (though Schools may choose to share a Child’s information and responses with the Child’s classmates or with other teachers). We will disclose the personal information that we collect about Children only as follows:
- Parents, Teachers and Classmates. We will disclose Children’s personal information: (1) to each Child’s individual teacher(s) and parent(s); and (2) as directed by the Child’s School. Parents may request information about the information we have collected from their Child(ren) by contacting us atprivacy@instructure.com.
- Third-Party Service Providers. We may disclose a Child’s personal information to third-party service providers who perform functions on our behalf and/or on behalf of a School or district customer in order to: provide the Child and the Child’s School with the Services that we offer through our Services; conduct quality assurance testing; facilitate creation of accounts; provide technical support; and/or provide other services to us. These third-party service providers are permitted to use personal information only to provide the services requested by Instructure or the School or district customer.
- Business Transfers. If we are acquired by or merged with another company, if all or a portion of our assets are transferred to another company, or as part of a bankruptcy proceeding, we may transfer the personal information we have collected about Children to the other company. We will notify all users of any material change in our information practices, as well as any choices users may have regarding their personal information.
- In Response to Legal Process. We may disclose personal information that we have collected from Children in order to comply with applicable law, a judicial proceeding, court order, or other legal process.
- To Protect Us and Others. We may disclose personal information that we have collected from Children where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our Terms of Service or our policies including this COPPA Policy, or as evidence in litigation in which Instructure is involved.
- Disclosure to Other Third Parties Only with Consent. Beyond the disclosures described in this COPPA Privacy Policy, Instructure will disclose a Child’s information to any other third party only at a School’s direction.
Our Use of Cookies
We use cookies and similar technologies to collect personal information about a Child’s use of our Services. “Cookies” are alphanumeric identifiers that we transfer to a computer’s hard drive through a web browser for record-keeping purposes. We may use both session Cookies (which expire once a user closes a web browser) and persistent Cookies (which stay on a computer until a user deletes them). Some Cookies make it easier for a Child to navigate our Site and Services, while others are used to enable a faster log-in process or to allow us to track a Child’s activities on our Services for operational purposes.
Third-Party Analytics. We may also use third-party analytics tools and technologies, such as Google Analytics, to track and analyze data from our Site, Apps, or Services. These tools use Cookies and similar technologies to collect information such as how often users visit the Site, what pages they visit, and what other sites they used prior to coming to the Site. We use the data collected by such third-party analytics tools only to help us administer and improve the quality of our Site, Apps, and Services and to analyze Site and Apps usage. These third parties are not permitted to use the information collected on our Services, except to help us conduct and improve our business. Google’s ability to use and share information collected by Google Analytics about a user’s visits to the Site is restricted by the Google Analytics Terms of Use and the Google Privacy Policy. For more information on Google’s privacy practices, please click here. For information about how to opt out of Google Analytics, please click here.
Third-Party Links
Schools may provide Children with links to third-party educational and learning resources located on third-party websites or apps, through our Services. Any access to and use of such linked websites and apps is not governed by this COPPA Policy, but instead is governed by the privacy policies of those third-party websites and apps. We are not responsible for the information practices of such third-party websites and apps.
Rights to Review, Delete, and Control Our Use of Children’s Personal Information
Parents and Schools have a right to review and correct the information we have collected about their Child(ren) and Students, respectively, and to delete it, and to tell us to update it or stop using it. To exercise these rights, you may contact us atprivacy@instructure.com. You will be required to authenticate yourself as the Child's parent or School to receive information about that Child. Please note that we cannot delete copies of information that a Child's School has already collected and/or copied, and copies of information that you have deleted may remain in archives for a period of time.
Changes to this COPPA Policy
This COPPA Policy is current as of the effective date set forth above. We may change this COPPA Policy from time to time, so please be sure to check back periodically. If we make any changes to this COPPA Policy that materially affect our practices with regard to the personal information we have previously collected from a Child, we will provide your Child’s School with notice of the revised COPPA Policy and request renewed consent in advance of such change becoming effective. The revised COPPA Policy will also be posted and highlighted on our Site