Effective date: September 16, 2025
Who we are: Lennections Inc. ("Lennections," "we," "us," or "our").
Covered services: www.lennections.com and any related sites or apps we operate, including our educator platforms and services (collectively, the "Services").

​

1) Scope & Relationship With Schools & Districts

 

This Privacy Policy explains how we collect, use, disclose, and protect Personal Information when you visit our websites, create an account, or use our Services.

​

For school districts and individual schools (including public, private, charter organizations, regional service centers, and consortia), Lennections acts as a service provider (and a FERPA “school official” with a legitimate educational interest) when processing Student Data on behalf of an educational agency or institution (an Education Agency). We process Student Data solely to provide the Services to the Education Agency, in accordance with our agreement and its written instructions.

​

Student access & registration. Students access the Services only through Education Agency‑managed methods (e.g., district SSO, LTI launch from an LMS, SIS/LMS rostering, or teacher‑provisioned accounts). We do not permit direct student self‑registration on our public marketing site.

​

This Policy also applies when educators, parents/guardians, and students use our Services as authorized by an Education Agency.

​​

​

2) Key Definitions

 

Personal Information means information that identifies, relates to, describes, or can reasonably be linked to an individual or household.
Student Data means Personal Information that we process on behalf of an Education Agency about a student, parent/guardian, or educator in connection with educational purposes.
Education Agency means a U.S. K–12 public school district, individual school (public or private), charter network, regional service center/consortium, or similar entity that contracts for or authorizes use of the Services. References to “School” in this Policy include Education Agencies.
De‑identified/aggregated data means data that cannot reasonably be used to identify an individual.

​​

​

3) Information We Collect

 

We collect the following categories of information (depending on your relationship with us and your use of the Services):

​

Identifiers and contact details. Name, email address, school/district, role, grade/subject focus, account IDs, and similar identifiers.
Account and profile data. Credentials, preferences, roster/section details provided by Schools, and settings.
Student work and education records (Student Data). Student responses, submissions, scores/feedback, progress indicators, assessment assignment metadata, and related instructional context provided by educators or imported by the School.
Commercial information. Order history, quotes, transactions, and billing details processed by our payment providers.
Internet or device activity. Log files, IP address, device/browser type, pages viewed, session metadata, and interactions with our sites/apps.
Support communications. Messages and content you send to our support team.
Inferences. Limited inferences we derive to improve and personalize the Services (not for behavioral advertising).

​

We do not knowingly collect sensitive categories such as precise geolocation, biometric templates, or government IDs for typical use of the Services. Schools may enter limited health‑ or disability‑related flags to provide accommodations, solely for educational purposes at the School’s direction.

​​

​

4) Sources of Information

​​

• Directly from you when you register, request a demo/quote, place an order, or contact support.

• From Districts and Schools via roster files, SIS/LMS integrations, LTI launches, or educator input.

• Automatically from your browser or device when you access our Services.

• Service providers that support identity, analytics (marketing site only), hosting, and payments.
   

4a) Data Ownership & Control

​

Student Data (Education Agency‑provided records). The Education Agency (district or school) owns and controls Student Data. Lennections does not claim ownership of Student Data and processes it only to provide the Services at the Education Agency’s direction.
Educator/Admin content. Educators and Education Agencies retain ownership of instructional materials and other content they upload or create; you grant Lennections a limited license to host, process, and display that content as needed to operate the Services.
Marketing‑site personal data. Individuals retain their rights in personal data submitted via our website forms; Lennections acts as controller for that activity solely to run the website, fulfill requests, and comply with law.
Lennections IP. Lennections owns the platform, software, and content we supply. This Policy does not transfer our intellectual property rights.

​​

​

5) How We Use Information

 

We use Personal Information to:

• Provide, operate, secure, and troubleshoot the Services;

• Create and manage accounts;

• Deliver assessments, feedback, and reporting;

• Process orders and payments;

• Provide customer support and communicate about the Services;

• Analyze usage to improve quality, reliability, and performance;

• Develop new features and content;

• Comply with law, enforce terms, and protect rights, safety, and integrity.
   

We may use de‑identified and/or aggregated data for analytics and to improve the Services. We will not attempt to reidentify de‑identified data.

​​

​

6) No Sale or Sharing; Student Advertising Restrictions

 

We do not sell or share Personal Information as defined by CPRA (including cross‑context behavioral advertising). We do not use or disclose Student Data for targeted advertising or for creating profiles for marketing purposes. We do not permit third‑party advertising networks in student‑facing Services.

​

We do not use sensitive Personal Information for purposes that require a right to limit under CPRA.

​​

​

7) Cookies and Similar Technologies
 

We use cookies and similar technologies to operate and secure the Services, understand usage, and improve performance.

​

Controls. You can manage cookies through your browser settings. On our marketing site, you may also use the Cookie Preferences link in the footer to opt out of non-essential analytics cookies. Student-facing Services use only cookies necessary for authentication, security, and core functionality; we do not serve third-party ads.

​

Cookie categories & examples (subject to change):

• Essential (Services). session_id, csrf_token, load-balancer/route cookies — required to sign in, keep you logged in, and protect against fraud; expire at end of session or within 12 months.

• Preferences (Marketing site). cookie_consent — records your cookie choices; typically 6–12 months.

• Analytics (Marketing site, if enabled). e.g., Google Analytics cookies — help us understand site usage; not used in student experiences. You can opt out via Cookie Preferences.

For a current list of cookies used on the marketing site and their lifespans, check the Cookie Preferences panel.

​​

​

8) How We Disclose Information

 

We disclose Personal Information to:

• Service providers/contractors (e.g., hosting, analytics, support, email, identity/SSO, payment processing) bound by contractual confidentiality and use restrictions;

• Education Agencies (districts and schools) and authorized educators, as needed to deliver the Services;

• Successors in a merger, acquisition, or similar transaction (subject to this Policy or substantially similar protections);

• Authorities when required by law or to protect rights, safety, or integrity.
   

Current subprocessors (as of the Effective Date). We engage service providers to help deliver the Services. The core categories and examples include:

• Hosting & infrastructure: Typical data elements: customer account identifiers, content stored and processed within the Services, and system logs necessary to operate the platform.

• Database services: Typical data elements: application database records (including Student Data entered by the Education Agency), backups, and metadata required for reliability and performance.

• Application hosting: Typical data elements: application binaries and runtime configuration, operational logs, and limited metadata needed to run the application.

• Customer support/in‑product messaging (educator/admin only): Typical data elements: educator/admin name, email, role, and support messages; not used in student‑facing experiences.

• Payments (if you purchase directly): Typical data elements: billing contact info, invoice details, and transaction metadata (card data handled by the processor and not stored by Lennections).
   

For each service provider, we share only the minimum data necessary for the stated purpose, and we require comparable security and privacy commitments. We remain responsible for our service providers’ processing of Student Data.

​

Changes to subprocessors. If we add or replace a subprocessor that handles Student Data, we will update this list and notify Education Agency administrators (e.g., via email or in‑product notice) at least 30 days before the change takes effect, where contractually required.

​

We do not allow service providers to use Student Data for their own marketing. We require them to implement appropriate security controls and to delete data when services end or as instructed.

​​

​

9) Data Retention and Deletion

 

High-level rules. We retain Personal Information only as long as necessary for the purposes described in this Policy or as required by law. When retention ends, we delete or de-identify data. Backups roll on fixed schedules, so complete purge may take additional time after primary deletion.

​

9A) Deletion on Request — Timelines

• Marketing-site personal data (non-Education-Agency accounts). Upon a verified deletion request, we delete active records within 30 calendar days and complete backup overwrites within 65 days of confirmation, absent legal holds.

• Student Data (Education Agency context). We act on the Education Agency’s written instruction. After the Education Agency approves/initiates deletion, we delete active Student Data within 30 calendar days and complete backup overwrites within 65 days, unless a longer period is required by law or a documented disaster-recovery cycle.

• We will confirm completion to the requester (or to the Education Agency, for Student Data).

​

9B) Standard Retention Schedule

The table below summarizes typical retention. Contract terms or law may specify different periods.