Educational User Privacy Policy

For Students, Guardians and Schools

Last Updated September 23, 2026

MaiaLearning, Inc. (“MaiaLearning”, “we”, “our”, or “us”) provides a college and career readiness platform and associated tool for students, guardians and schools (the “Service”). The Service is provided through schools, Independent Education Counselors, or other institutions (“Schools”, "Subscribers") as a way to connect students with the support they need in the career planning and college application process. 

This Educational User Privacy Policy applies to students', teachers', other educational staffs', such as counselors', and guardians' information we receive from Schools, staff, students, or guardians in the course of providing the Service. For information about how we handle personal information collected through our website and other activities, please review our Website Privacy Policy. 

Compliance with U.S. student privacy laws

The Service is subject to the Family Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Act (COPPA). MaiaLearning is a “school official” under FERPA and receives student information pursuant to agreements with Schools. Schools and/or guardians consent to our collection, use, and disclosure of students’ information as described in this policy as required by COPPA. MaiaLearning does not sell, license, or rent any student’s personal information, it does not engage in, inform, influence or enable advertising to students, and does not use students’ personal information other than to provide the Service or comply with legal obligations as described below.

1. Collection of information

Student information. With Schools' and/or guardians' consent, we collect student information as needed to provide the Service, from Schools and from students. The information we receive from Schools depends on what each School chooses to provide, and may include a student ID, names, usernames/passwords, email addresses, phone numbers, physical addresses, grade level, courses and grades, and demographic information such as gender, date of birth, citizenship or nationality, low-income status, English Language Learner status, and, for Schools outside Europe, race and ethnicity. From students, we collect the information they enter into the Service, which may include names, usernames/passwords, email addresses, phone numbers, assignment responses, experiences, essays, assessment responses, and survey responses.

‍School user information. MaiaLearning may collect teachers, staff members and other authorized users’ personal information such as name and email address to create and differentiate such user accounts. 

‍‍Guardians’ information. We may collect names, emails, phone numbers, addresses, survey responses from guardians.

‍Automatically generated information. We gather certain information automatically when Educational Users use the Service, such as IP address, browser type, information about how, how often and when a user engages with a page or feature of the Service. MaiaLearning may gather this information using cookies (small data files on a computer’s browser), web beacons (invisible electronic images embedded on web pages) and similar technologies. In some cases, third parties may deliver cookies to the user’s browser on MaiaLearning’s behalf. For example, MaiaLearning uses Google Analytics to help measure the performance of the Service.

MaiaLearning does not use or sell automatically generated information to market or advertise to students. 

2. Use of information

MaiaLearning may use personal information for:

‍Providing the Service. We use students’ information to facilitate delivery of the Service and to operate, maintain, and secure the Service. For Schools in Europe, we do not use student information to train or develop machine learning models unless the School has agreed to contribute data.

‍Creating aggregated/anonymized information. We may aggregate or anonymize the personal information we collect such that the resulting information (“Resulting Information”) cannot reasonably be linked to an individual or School. We may use the Resulting Information for our legitimate business purposes, such as creating reports about educational users' experiences and issues (for example, we may tell a School that 40% of its students received scholarships) or sharing anonymized data in marketing materials and investor communications. 

Improving the Service. We use students’ information and automatically generated information to assess the effectiveness of our Service and to improve our Service.

‍‍Research and development. We may use Resulting Information for educational research and development purposes. 

‍Providing customer support for Schools. We use personal information in the course of providing customer support. 

‍Legal compliance. We use personal information to comply with applicable laws and lawful requests, protect the rights and safety of MaiaLearning, students, and others, and to protect students and the Service from unauthorized, fraudulent, or illegal activity.

We will not use students’ information for marketing or other commercial purposes.

3. Sharing of information

MaiaLearning shares personal information as follows:

‍With service providers. MaiaLearning may disclose information to third parties as necessary for them to help us provide the Service, including hosting, assessment, evaluation, and analytics services. 

‍With professional advisors. MaiaLearning may disclose information to professional advisors like lawyers, accountants and auditors where doing so is necessary to facilitate the services those advisors provide to us.

‍As required by law or to ensure safety. MaiaLearning may be required to disclose or grant access to personal information to law enforcement, government authorities, and other parties in order to comply with law enforcement requests and legal processes. In particular, we may be a mandatory reporter in certain circumstances. This may require us to disclose personal information to authorities if we fear that a student is at risk of harming themselves or others. We may also share personal information to protect students’, our, or others’ rights, property, or safety. MaiaLearning may also report any law enforcement and other incident reports made by MaiaLearning to Schools.

‍In a business transition. In the event MaiaLearning goes through a business transition, such as a merger, acquisition, asset sale, bankruptcy, restructuring, or other corporate change, personal information maintained by MaiaLearning may be disclosed or transferred to the other company and other parties assisting with the transaction, provided the successor is bound by this Educational User Privacy Policy with respect to the transferred information.

4. Privacy Rights

COPPA permits guardians to request access to or deletion of children’s information and to instruct companies to stop collecting or using children’s information. Since MaiaLearning provides the Service to students on behalf of Schools, guardians should contact Schools with such requests. MaiaLearning will forward any requests it receives to the appropriate School, unless MaiaLearning’s contract with the School or applicable law requires otherwise.

5. Information security safeguards

MaiaLearning treats personal information received from Schools as confidential. MaiaLearning implements administrative, technical, and physical security procedures reasonably designed to protect the personal information stored on its servers, which are located in the United States. Even with these safeguards, however, we cannot guarantee the security of personal information.

6. Third Parties

The Service may contain links to other websites not operated or controlled by MaiaLearning, including social media services (“Third Party Sites”). The information that you share with Third Party Sites will be governed by the specific privacy policies and terms of service of the Third Party Sites and not by this Educational User Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these sites. Please contact the Third Party Sites directly for information on their privacy practices and policies.

You can log into MaiaLearning using Google credentials by clicking on the Google Sign-In button on the MaiaLearning login page. MaiaLearning's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

7. Privacy Frameworks

MaiaLearning complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. MaiaLearning  has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.  MaiaLearning has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.  If there is any conflict between the terms in this Educational User Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

MaiaLearning acts as a processor of personal information it receives under the Data Privacy Framework on behalf of Schools, and may transfer that information to third parties acting as sub-processors on its behalf. Where a School in the EU, UK, or Switzerland has agreed to contribute data for the training and improvement of machine learning models used in the Service, MaiaLearning acts as a controller for that processing, as described in Section 8.

MaiaLearning complies with the Data Privacy Framework Principles for all onward transfers of personal data from the EU, UK or Switzerland, including the onward transfer liability provisions. MaiaLearning’s contracts with third-party sub-processors that receive personal data under the Data Privacy Framework require such sub-processors to provide the same level of protection as is required by the DPF Principles. MaiaLearning shall remain liable under the DPF Principles if its sub-processor processes personal data in a manner inconsistent with the DPF Principles, unless MaiaLearning proves that it is not responsible for the event giving rise to the damage.

MaiaLearning, Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

Individuals in the EU, UK, and Switzerland whose personal data has been transferred to MaiaLearning under the Data Privacy Framework have the right to request access to their personal data. You may also request that we correct, amend, or delete your personal data where it is inaccurate or has been processed in violation of the DPF Principles. To exercise these rights, please contact us at legal@maialearning.com. We will respond to your request within a reasonable timeframe. We may limit or deny access where the burden or expense of providing access would be disproportionate to the risks to your privacy, or where the rights of persons other than the requesting individual would be violated. Where MaiaLearning processes personal data on behalf of a School, we will refer access, correction, and deletion requests to the School, consistent with Section 4, and assist the School in responding.

MaiaLearning will offer EU, UK, and Swiss individuals the opportunity to choose (opt out) whether their personal data is (a) to be disclosed to a non-agent third party, or (b) to be used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by the individual. For sensitive personal information, MaiaLearning will obtain affirmative express consent (opt in) from the individual if such information is to be (a) disclosed to a non-agent third party, or (b) used for a purpose other than those for which it was originally collected or subsequently authorized by the individual through the exercise of opt-in choice. To exercise these choices, please contact us at legal@maialearning.com.

In compliance with the Principles, MaiaLearning commits to resolve complaints about our collection or use of your personal information. EU, UK or Swiss individuals with inquiries or complaints regarding our Data Privacy Framework policy should first contact MaiaLearning at: legal@maialearning.com. We will investigate and attempt to resolve any complaints or disputes regarding the use or disclosure of your EU Personal Data, UK Personal Data or Swiss Personal Data within 45 days of receiving your complaint.

MaiaLearning's independent recourse mechanism for Data Privacy Framework complaints for use by EU, Swiss and UK individuals is JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please contact or visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

If your complaint is not resolved after following the recourse mechanisms described above, you may have the ability to invoke binding arbitration.  Additional information is available at https://go.adr.org/dpfeufiling.html for EU/EEA and UK (and Gibraltar) individuals and at https://go.adr.org/DPF_Swiss_AnnexI_Filing.html for Swiss individuals.

8. Additional Information for European and UK Users

Model training on contributed data (Europe). If a School in the EU, UK, or Switzerland agrees to contribute data, MaiaLearning uses some of its students' information to train and improve the machine learning models in the Service that estimate college admissions chances and recommend colleges. For this purpose, MaiaLearning is a controller, and the following applies.

What we use: courses, subjects, and grades; assessment results; activities and experiences, such as volunteering and work-based learning; college applications and admissions outcomes; graduation year; and, where a model requires it, the student's school. We do not use names, contact details, essays or other free-text content, race or ethnicity, low-income status, or any special categories of personal data. We receive this information from the School.

How we protect it: before training, we replace identifiers with coded values using a key that is destroyed after each extraction, so the data cannot be linked back to a student through those codes. Only personnel who need the data for model training can access it.

Legal basis: our legitimate interests in improving the accuracy and fairness of the recommendations the Service provides to students (Article 6(1)(f) GDPR). We have assessed these interests against students' rights and interests, and a summary is available on request.

Where it goes and how long we keep it: the data is processed in the United States under our Data Privacy Framework certification, and it is shared only with our service providers, such as hosting providers. We keep extracted training data for no longer than 48 months. Models trained on the data may continue to be used after that, but they do not contain student records.

Your rights: you can object to this use at any time. If you do, we will stop including your information in future training. Because identifiers in existing extracts are replaced using keys that are destroyed after extraction, we may be unable to identify your data in existing extracts; such extracts will be deleted at the end of their retention period. You can also request access to your identifiable information, and you have the right to complain to your local data protection authority. To exercise these rights, contact legal@maialearning.com or use the Data Subject Access Request form below.

Osano UK Representative can be contacted at:

Osano UK Compliance LTD
ATTN: XZMJ
42-46 Fountain Street
Belfast
Antrim
BT1  5EF

9. Changes to this Policy

MaiaLearning may modify this Educational User Privacy Policy to reflect new legal requirements or as its information practices evolve. We will post any adjustments to this Educational User Privacy Policy on this web page, and the revised version will be effective when it is posted (or as otherwise indicated at the time of posting).

10. Questions and Contact information

Osano has been appointed as MaiaLearning's representative in the European Union for data protection matters, pursuant to Article 27 of the General Data Protection Regulation of the European Union and in the United Kingdom, pursuant to Article 27 of the UK GDPR. In addition to the Data Subject Access Request form and legal@maialearning.com, Osano can be contacted, only on matters related to the processing of personal data, via the mailing address below.

Osano EU Representative can be contacted at:
‍
Osano International Compliance Services Limited
ATTN: XZMJ
25/28 North Wall Quay
Dublin 1, D01 H104
IRELAND

Please contact us at support@maialearning.com with any questions about this Educational User Privacy Policy.

Revisions:
2024-08-26: v1.1: Updated Section 6 to reflect additional Google service requirements and Limited Use.
2026-04-14: v1.2: Updated Section 6 to fix company name. Updated Section 7 to add FTC enforcement statement, DPF access rights, DPF choice/opt-out provisions, expanded onward transfer liability language, and corrected JAMS hyperlink per DPF re-certification requirements.
2026-09-23: v1.3: Updated student information definition. Updated In a business transition to make sure obligations carry forward. Section 7 processor update for GDPR and requests to schools. Section 2 (Improving the Service), Section 6 (policy name), and Section 8 (the representatives and the model-training notice).