Effective Date: August 24, 2021

Instructure is committed to protecting the information we process by doing our best to ensure that the information is used only to support students and education. We are guided in this mission by our foundational Privacy Principles:

  1. Transparency: We will work to ensure transparent data processing in our business.
  2. Accountability: We will demonstrate our commitment to privacy in concrete and tangible ways.
  3. Integrity: We will strive to ensure that the data entrusted to us is complete, consistent, and accurate.
  4. Security: We will implement and maintain appropriate technical, administrative, and organizational measures to protect data in accordance with regulatory requirements.
  5. Confidentiality: We will establish and maintain policies, procedures, and practices that limit access to data and protect against unlawful or unintentional access or disclosure.

As part of our commitment to protecting the privacy of students, educators, and institutions, we are a signatory to the Privacy Pledge 2020 and a supporter of the Future of Privacy Forum.

Instructure has also earned the IMS Global Learning Consortium TrustEd Apps Data Privacy Certification Seal.

We invite you to learn more about the data practices on our platforms that enable lifelong learning.


  1. About our Users and our Products.
  2. Information Collection.
  3. Our Use of Your Information.
  4. Disclosure of Information.
  5. Children’s Privacy.
  6. Your Information, Your Control.
  7. Other Important Information.
  8. Security of Your Personal Information.
  9. Contact Information.

Instructure, Inc. and its affiliates and subsidiaries (“Instructure,” “we,” “our,” or “us”) prepared this Privacy Notice to describe our privacy practices. This Notice governs information collected and processed by our products and services (collectively, “Products”), which are listed here: https://www.instructure.com/product/all-products.

1. About our Users and our Products.

We have provided the following summary to help you understand what we do with the information we process through our Products and the relationship between our users and Products.





Academic Institutions




Corporate Employees

Canvas LMS

Canvas Network

Canvas Catalog

Canvas Pathways

Canvas Outcomes Assessments

Canvas Studio

Corporate Canvas

Canvas Program Assessment


MasteryView Assessments

Navigate Item Bank

CASE Assessments




  • Educators provide content and instruction through Canvas LMS
  • Educators may use Canvas LMS to provide one-on-one feedback to students or offer their students collaborative workspaces
  • Academic Institutions may use Canvas LMS to enable, personalize, and configure how educators and students use Canvas LMS
  • Educators use MasteryConnect to assess their students and plan curriculum
  • Parents can view their student’s academic work in Canvas LMS
  • Educators and students can submit video creations with Canvas Studio


Academic Institutions





Canvas Folio Management

  • Students may showcase their achievements to potential employers and fellow students, and connect with other users, such as employers, professionals, and other students
  • Employers may search and select job candidates


2. Information Collection.

Now that you know about our Products, we want to tell you about the information our Products collect and process.

Personal Information


Information that may singly identify you, either alone or in combination with other information (“personal information”), such as:

  • First and last name
  • Gender or preferred pronouns
  • E-mail address
  • Mailing address
  • Academic Institution/School
  • Geographic information, such as your location
  • Profile information, such as a short bio or profile photo
  • Phone or mobile number
  • Payment information (Canvas Catalog only)
  • Imported profile information from third-party websites if you choose to register and/or log in with credentials from these websites
  • Information from Academic Institutions to register your profile
  • Date of birth
  • Data types described in the Ed-Fi Data Standard (Videri only)
  • Biometric data such as video images and voice recordings

We collect your personal information when:

  • You create an account for or use our Products
  • When an Academic Institution creates an account for you in our Products
  • You import information from third-party websites and sources, such as social media sites
  • Others invite you to join our Products
  • When an Academic Institution transfers information from student information systems, or other institutional systems, into our products

Product Usage Information


Information processed while using our Products, such as:

  • Your interactions with other users, for example, messages, comments, and uploaded files
  • Performance of the Products, such as how you use certain features
  • Descriptions, images, hashtags, and other information associated with uploaded information
  • How you use our Products, such as the time spent interacting with certain features and the date and time of your visits

When you use our Products, we collect information about how you use our Products

Communications and Other Interactions with Us


Any information, including personal information, you submit during your interactions with us, such as:

  • Contact information
  • Email content

We collect information from and about your communications and interactions with us.  For example, we collect information when you:

  • Request assistance from our help desk
  • Provide us with feedback on our Products
  • Sign up for and attend a conference, webinar, or Instructure event
  • Participate in surveys and contests
  • Otherwise communicate or interact with us

Device Information


Information, including personal information, from and about your device, such as:

  • Browser type, settings, and preferences
  • Operating system
  • Geo-location information (e.g., Country or state)
  • Persistent identifiers
  • Internet Protocol (IP) address (a number that is automatically assigned to your computer when you use the Internet, which may vary from session to session)
  • Domain name
  • Unique device identifiers

When you use our Products on a device, like most Internet services, we automatically gather and store device information each time you use our Products


Professional Information


Information about your career and professional achievements, such as:

  • Information required by the employer, which may contain personal information, like your resume
  • Job descriptions and requirements

We collect this information, for example, when you apply for a job posted on Portfolium and activate an account created by your Academic Institution



3. Our Use of Your Information.

Now that you’ve learned about the information we process, let’s go over what we do with it.

Note that if we process your personal information for a purpose other than the purpose for which it was collected, we will provide you with notice in advance of the new processing. We limit our collection and use of your personal information only to those elements required to operate our Products, or as otherwise disclosed in this Privacy Notice. We do not engage in automatic decision making, advertising to students, or profiling.

To provide, analyze, and improve our Products. We use the information described above to provide, analyze, and improve our Products, including to:

  • Create and maintain your account
  • Identify you as a user
  • Notate and assign support tickets
  • Provide, operate, maintain, and improve our Products
  • Personalize and improve your experience
  • Contact you and communicate with you, including to respond to your comments or inquiries
  • Provide customer support
  • Solicit feedback about our Products, including by asking you to respond to surveys or questionnaires (with your permission)

Please see the “Third-Party Websites” section below for more details about sharing information with third-party websites or platforms.

De-identified or aggregate use. We may create and use de-identified or aggregate information – information removed of specific identifiers so that it cannot singly identify you (i.e., non-personal information) – for any purpose.

4. Disclosure of Information.

Now we will review how we share or disclose information, including personal information.  Note that we share information, and permit you to share information, only as described in this Privacy Notice. We do not sell or rent personal information to third parties.

5. Instructure’s Disclosure of Information.

Instructure may share information with the following recipients or as set forth below.

Commonly owned entities. We may share your information, including personal information, with companies under common ownership or control of Instructure, including affiliates and subsidiaries, to help provide our Products.

Third-party service providers.  We may share your personal information with authorized third-party service providers for the sole purpose of providing you with our Products. For example, we may share information with service providers who host our Products or provide email services on our behalf.

We do not permit our third-party service providers to use personal information we share with them for their own advertising or marketing purposes, or for any other purpose other than in connection with the services they provide to Instructure. Additionally, we do not sell or rent your personal information to third parties.

Our use of information received from Gmail APIs will adhere to Google's Limited Use Requirements. Our Product’s use and transfer to any other application of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

As required by law. In certain circumstances, we may be required to disclose information, including personal information, in order to:

  • Comply with legal or regulatory processes (such as a judicial proceeding, court order, or government inquiry)
  • Enforce the Instructure Acceptable Use Policy and other policies
  • Respond to claims that any content violates the rights of third parties
  • Protect the rights, property, or personal safety of Instructure, its employees, its users, its clients, and the public

Change of Control. We may share information about you in connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.  In the event that information is shared in this manner, notice will be posted on our website at www.instructure.com.

With your consent or at your direction. We may share information other than as described in this Privacy Notice with your consent, or at your specific direction, for example, if you choose to use the Products with social networking platforms (e.g., Facebook, YouTube, Twitter, etc.).

De-identified or aggregate use. We may share de-identified or aggregate information – information removed of specific identifiers so that it cannot singly identify you (i.e., non-personal information) – for any purpose without limitation.

6. Disclosure of Information through Instructure’s Products.

Additionally, our Products have features that share information (including personal information) with authorized third parties or that allow you to share information with third parties or the public. These disclosures are described below.

Academic Institutions, course providers, or parents.  We may share your personal information with the Academic Institution or company which is linked to your use of our Products. Where permitted, we may also share your information with relevant parties associated with the Academic Institution, such as educators or fellow students, or parents of students using our Products or fellow users.

For example, this would apply:

  • If your Academic Institution uses our Products as a learning management platform and has given you access to the Products; or
  • If you are taking a course via the Products, we will share your personal information you provided upon account registration and coursework registration with the educator and/or Academic Institution

Employers.  We allow approved employers ("Employer Partners") to have access to Portfolium to recruit students or job seekers.  Employer Partners can see certain professional information about Portfolium users, including their name, school status, degree program, and year of graduation. Employer Partners are not provided with the email address or other contact information of these users and can communicate with users only via the private messaging functionality within Portfolium.

Other Third Parties.  You may choose to share information through our Products such as Portfolium with other users of the Products or the public when you post content or otherwise provide information about yourself. We are not responsible for others’ use of the available information, so you should carefully consider whether and what to post or how you identify yourself. If you use Portfolium, examples of sharing your personal information may occur when you:

  • Create an account, your name and other profile information will be viewable and searchable by other users and Employer Partners (as noted above)
  • Post content to Portfolium, such as videos, photos, school projects, and comments, which are displayed on Portfolium and viewable by other users by default
  • Access public blogs, community forums, or the newsfeed within the Product
  • Post to our public blog, which is operated by a third-party application. Our Privacy Notice does not cover the practices of these third parties, and your interactions with these third-party applications are governed by their separate privacy policies

On Portfolium, we do not make a child user’s account publicly available; only parents and Academic Institutions have access to a child user’s account.  And we do not make users’ accounts or data publicly available on Canvas LMS & MasteryConnect.

With your consent or at your direction. As noted, we may share information other than as described in this Privacy Notice with your consent, or at your specific direction, for example, if you choose to use the Products with social networking platforms (e.g., Facebook, YouTube, Twitter, etc.).

7. Children’s Privacy.

For users of Canvas LMS and MasteryConnect, we may take steps intended to comply with the Children's Online Privacy Protection Act. Please see our Children’s Online Privacy Protection Act Privacy Notice.

Except for authorized users of Canvas LMS or MasteryConnect, if you learn that a child under thirteen years of age has provided us with personal information, please alert us at [email protected]

8. Your Information, Your Control.

We provide you with several ways to control your information.

Parents and Academic Institutions. Parents and educators may review information collected from children, request deletion of this information, or request no further collection or use of this information by contacting us at [email protected]

Account Information. You may change some of your personal information by editing your Product profile. You may also request that we modify or delete your information by emailing us at [email protected] We will respond to your request, when permitted by law and subject to exceptions, within 30 days. We may be unable to delete information that resides in our archives.

Portfolium Account Closure.  If you wish to delete your Portfolium account, you can go to the "Privacy" tab under "Account Settings" and click "Disable Account."  Once your account has been disabled, you can request deletion of your account by selecting "Permanently Delete" from the disable account screen.  After requesting deletion, you have fifteen days to change your mind before we cannot undo your deletion request.

Employer Communications.  Portfolium users may receive private messages through Portfolium from approved employers. At any time, Portfolium users may unsubscribe from all employer-generated private messages. Portfolium users may also use the privacy settings in their Account to opt out of their information being shared with employers.

Push Notifications.  If you would like to stop receiving push notifications, please use the settings on your mobile device to opt out. Please note that opting out of receiving push notifications may impact your use of our Products (such as receiving a notification that you have a new message). Please note that the opt-out process differs depending on the mobile device you are using.

Location. Some Products may collect precise location information about your mobile device, but only with your consent. If you wish to revoke permission to collect precise location information, you can change the location settings on your mobile device.

9. Other Important Information.

Student Data Privacy Agreements.  When providing our Products to US Academic Institutions, we may sign a state-level Student Data Privacy Agreement (“SDPA”) with a Local Educational Agency (“LEA”). The LEAs make these SDPAs publicly available. You can access the SDPAs that we have signed with LEAs on the Student Data Privacy Consortium website located here.

Third-Party Websites.  Our Products may contain links to third-party websites or services that allow you to leave our Products and go to another website when you click on such a link. Your information, including personal information, may be collected by those separate entities. We have no control over, do not review, and cannot be responsible for these outside websites or their content. Please be aware that the terms of this Privacy Notice do not apply to these outside websites or content, or to any collection of data after you click on links to such outside websites. The links to third-party websites or locations are for your convenience and do not signify our endorsement of such third parties or their products, content, or websites.

10. Security of Your Personal Information.

Instructure takes reasonable steps to help protect your personal information in an effort to prevent unauthorized access, use, or disclosure. You can find more details about our security program by visiting our security webpage here and reviewing our Security and Due Diligence Documents.

Despite these measures, you should know that we cannot fully eliminate security risks associated with personal information. No method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee absolute security. Any content you post or input you provide while using our Products is at your own risk.

11. Contact Information.

Instructure welcomes your comments or questions regarding this Privacy Notice.  Please e-mail us at [email protected], or contact us at the following address or phone number:

Instructure, Inc.
6330 S 3000 E, Suite 700
Salt Lake City, UT 84121
United States of America

+1 (801) 869.5000

Instructure Global Ltd
New Penderel House, 4th Floor
283-288 High Holborn
London, UK WC1V 7HP

0900 358 4330

To contact our Data Protection Officer, please use the following: [email protected]

Changes to this Privacy Notice. We may change this Privacy Notice from time to time. If we make any changes to this Notice, we will change the “Effective Date” above. If such changes are material, a notice of the changes will be posted along with the revised Privacy Notice. We encourage you to visit this page from time to time for the latest on our privacy practices.


You may contact us at anytime with questions by emailing us at [email protected]

Previous Versions

You can access the previous version of our Product Privacy Notice here.