Privacy Policy

Who we are

PedagogyFutures Inc. ("PedagogyFutures", "we", "us") is a 501(c)(3) nonprofit organization that runs professional development on artificial intelligence in education for teachers, schools, and districts. We operate the website at pedagogyfutures.org, the teacher dashboard, our online courses and webinars, the community forums, and our newsletter. For the personal information described in this policy, we are the data controller (the organization that decides how and why it is used).

You can reach us at team@pedagogyfutures.org or by post at One Beacon Street, Floor 15, Boston, MA 02108.

What this policy covers

This policy covers personal information we handle through pedagogyfutures.org and everything served from it: accounts and sign-in, the teacher dashboard, courses and certificates, webinars and events, forums and groups, hosted forms such as workshop requests, the newsletter, purchases, and donations. It also covers the sign-in service that lets you use your PedagogyFutures account on ethicaledtech.org and futureofeducation.ai.

ethicaledtech.org and futureofeducation.ai

ethicaledtech.org and futureofeducation.ai are projects of Pedagogy Ventures LLC, a separate company. Their courses and resources are offered free through PedagogyFutures, and PedagogyFutures provides the account you sign in with. That means we handle your PedagogyFutures account and the sign-in itself under this policy, while Pedagogy Ventures LLC runs those two websites and is responsible for what they collect, under their own privacy policies. Questions about your PedagogyFutures account or sign-in go to team@pedagogyfutures.org; questions about those websites go to Pedagogy Ventures LLC at the contact details in their policies. Both organizations share the postal address One Beacon Street, Floor 15, Boston, MA 02108.

It does not cover websites or services run by others, even when we link to them. Their own policies apply there.

Information we collect

Information you give us

Account details. Your email address, your name if you give it, and a password, which we store only as a salted hash. If you sign in with Google, we receive the name, email address, and profile picture on your Google account and whether Google has verified that address.
Profile details. Anything you add to your profile, such as a display name, school, district, state, country, grade bands, subjects, a short bio, a website, and a picture, plus your notification settings.
What you do in courses. Enrolments, lesson and topic progress, quiz answers and scores, and the certificates we issue.
What you post. Forum topics, replies, reactions, attachments, and reports; group memberships; prompts you save or write in the prompt library.
Organizations. If a school or district adds you to its organization on PedagogyFutures, we record your membership and the invitation that brought you in.
Forms. What you enter in a form on the site (for example a workshop request or a donation pledge), including any file you attach.
Webinar registrations. Your name and email address, and later whether you attended and for how long, as reported by Zoom.
Newsletter. Your email address and a record of your consent: when you signed up, the page you signed up on, your IP address, and your browser's user agent at that moment.
Payments and donations. When you buy a plan or a course, or make a donation, payment is handled by Stripe. We receive your name, email address, the amount, what it was for, your Stripe customer reference, and the status of the payment or subscription. We never receive or store your full card number.
Messages. Anything you send us by email, including support requests.

Information collected when you use the site

Security and operations. Our hosting provider records standard server logs, which include your IP address, the page requested, and your browser's user agent. We use IP addresses for short periods to limit repeated sign-in attempts and form spam. Hosted forms and webinar registrations store the IP address and user agent with the submission so we can deal with abuse.
Broken links. When a page is not found or an old link is redirected, we record the address that was requested, the referring page, and the browser's user agent, so we can fix links that still point at old pages. We do not record your IP address for this.
Error reports. If the site hits an error, a report goes to our error monitoring service (Sentry). Reports are filtered to remove cookies, sign-in headers, and email addresses before they are sent; if you are signed in, the report carries your account ID only.
Google Analytics (only with your consent). If you allow analytics, we load Google Analytics, which records the pages you visit, how you arrived (for example the referring site or search), your device and browser type, and your approximate location (country and region, derived by Google from your IP address). Google Analytics sets the _ga cookies described in our Cookie Policy. We turn on IP anonymization, turn off Google signals and all advertising features, and never grant advertising storage, ad user data, or ad personalization. Google Analytics does not run on our staff administration pages. Without your consent its script is not loaded at all.
Engagement analytics (only with your consent). If you allow analytics cookies, we count which downloadable files are taken and how much of a recorded webinar is watched. Each record holds the file or video, the page, the seconds watched, a device type (desktop, tablet, or phone), your country as reported by our network provider, the referring website's domain, a random visitor ID stored in the pf_vid cookie, and your account ID if you are signed in. No IP address is stored for this. If you do not allow analytics, the browser does not send these reports and no pf_vid cookie is set. Files we serve ourselves, such as forum attachments, are still counted when downloaded, without any cookie.

Information from others

Google, when you choose to sign in with Google (see above).
Zoom, which tells us whether a webinar registrant attended and for how long.
Stripe, which tells us whether a payment went through and the state of a subscription or recurring gift.
Your organization, if a school or district administrator invites you by email.
Mailgun, which tells us when an email to you bounces or is reported as spam, so we stop sending to that address.

How we use information and our legal bases

If you are in the European Economic Area, the United Kingdom, or Switzerland, data protection law requires a legal basis for each use. The table below lists ours.

What we do	Legal basis
Create and run your account, sign you in, and provide courses, certificates, webinars, forums, the prompt library, and purchases you make	Performance of a contract with you
Send account, security, receipt, and service emails (verification, password reset, registration confirmations, recordings you registered for)	Performance of a contract; our legitimate interest in running the service safely
Send course reminders, forum reply notifications, and webinar reminders	Our legitimate interest in helping you use what you signed up for; you can switch these off in your dashboard settings or with the link in each email
Send the newsletter	Your consent, which you can withdraw at any time
Process payments, donations, and donation receipts, and keep financial records	Performance of a contract; compliance with tax and accounting law
Show your organization's administrators your membership, enrolments, and certificates	Performance of a contract with you and your organization; our legitimate interest in supporting school-wide programs
Protect the site from spam, fraud, and abuse; rate-limit requests; fix errors	Our legitimate interest in keeping the service secure and working
Measure how the site is used with Google Analytics, and count downloads and recording views using the `pf_vid` cookie	Your consent
Load embedded videos and the Google sign-in prompt, which involve third parties	Your consent
Respond to workshop requests, forms, and messages	Steps you asked us to take before a contract, or our legitimate interest in answering you
Comply with legal obligations and enforce our terms	Legal obligation; our legitimate interest in protecting our rights

Where we rely on legitimate interests, we have weighed them against your rights. You can object to that use (see "Your rights" below).

We do not use your personal information for automated decisions that have legal or similarly significant effects on you, and we do not use it to train artificial intelligence models.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not use advertising cookies or tracking pixels.

We share personal information only in these ways:

Service providers who process it for us under contract and only on our instructions:
- Heroku (Salesforce): application hosting and our database, in the United States.
- Cloudflare: content delivery, DNS, and security and bot protection for the whole site (every request passes through Cloudflare), storage of uploaded media files (R2) in the United States, and the Turnstile check that keeps bots out of our forms.
- Amazon Web Services (Amazon S3): file storage in the United States, where we configure it instead of Cloudflare R2.
- Mailgun: sending transactional email and the newsletter, and reporting bounces and spam complaints.
- Google Workspace: our staff email, so messages you send us, and our replies, pass through and are stored in Google's systems.
- Stripe: payments, subscriptions, donations, and the billing portal.
- Zoom: webinar registration and attendance.
- Google: sign-in with Google, if you choose it, and Google Analytics, if you allow analytics. We use Google Analytics only to understand how the site is used, not for advertising.
- Sentry (Functional Software, Inc.): error monitoring.
- Upstash: short-lived rate-limiting counters.
Video hosts. Recorded webinars are hosted on Vimeo, and some pages embed videos from YouTube. These load only after you allow embedded content or press play (see the Cookie Policy).
Your organization. If you join a school or district organization on PedagogyFutures, its administrators can see that you are a member, your course enrolments and progress, and the certificates you have earned.
Other members. Forum posts, replies, reactions, and your display name are visible to other people who can open that forum or group. Some forums are public.
Book companion sites. ethicaledtech.org and futureofeducation.ai are run by Pedagogy Ventures LLC, and their courses and resources are offered free through PedagogyFutures. If you sign in to one of them with your PedagogyFutures account, we send that site your account ID, email address, whether it is verified, your name, your role, and your membership level, so they can recognize you and open what your plan includes. They may also ask us for that membership level later, using your account ID.
Legal reasons. When we believe in good faith that the law requires it, or that it is needed to protect the rights, property, or safety of PedagogyFutures, our users, or others.
Organizational changes. If PedagogyFutures merges with or transfers its programs to another organization, personal information may move with them, and this policy (or one at least as protective) will continue to apply.
With your permission. In any other case where you ask us to or agree to it.

International transfers

PedagogyFutures is based in the United States. Our databases are hosted in the United States on Heroku, and files are stored in the United States on Cloudflare R2 or Amazon S3. Our other service providers mostly store and process data in the United States too, although Cloudflare serves the site from data centers around the world, close to where you are. If you use the site from outside the United States, your information will be transferred there. Where the law requires a safeguard for that transfer, we rely on the European Commission's Standard Contractual Clauses (and the United Kingdom's addendum to them) in our agreements with providers, or on a provider's certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

How long we keep information

Your account stays until you delete it. Deleting your account (see below) removes your login, profile, enrolments, progress, quiz attempts, certificates, saved prompts, bookmarks, and memberships straight away.
Forum posts you wrote stay in the forum after your account is deleted, with your name removed. Ask us if you want them deleted as well.
Form submissions and webinar registrations are kept for as long as we need them to respond and to run our programs. They are separated from your account when it is deleted; ask us and we will delete them too.
Newsletter records are kept while you are subscribed. When you unsubscribe or an address bounces, we keep the address on a suppression list so we do not email it again.
Payment and donation records are kept for as long as tax, accounting, and nonprofit reporting laws require.
Engagement analytics records are kept while they are useful for understanding how our resources are used. They hold a random ID rather than your name, and the link to your account is removed when you delete it.
Error reports are deleted by Sentry under its retention settings, and server logs roll off under our hosting provider's schedule.
Backups of our database are kept for a limited period by our hosting provider and then overwritten, so deleted information may remain in a backup until it expires.

How we protect information

Passwords are stored as salted hashes, and one-time sign-in links expire within hours. Organization invitations and the codes and tokens we issue to partner sites are stored only as hashes. The site is served over HTTPS, access to administrative tools is limited to staff who need it, and changes made in those tools are logged. No system is perfectly secure; if a breach affects your personal information, we will tell you and the relevant authorities where the law requires.

Your rights

Everyone

Whoever you are and wherever you live, you can:

see and correct most of your details on your profile page;
download a copy of the information your account holds, as a JSON file, from Your data;
delete your account from the same page;
switch off optional emails in your dashboard settings or with the unsubscribe link in any email;
change your cookie choices at any time with the "Cookie settings" link at the bottom of every page;
email team@pedagogyfutures.org to ask what we hold about you, or to ask us to correct, delete, or stop using it.

If you are in the EEA, the UK, or Switzerland

You have the right to access your personal information, to have it corrected, to have it erased, to restrict how we use it, to receive it in a portable format, and to object to uses based on legitimate interests (including any direct marketing, which we will stop). Where we rely on consent, you can withdraw it at any time; withdrawal does not affect what was done before. You also have the right to lodge a complaint with a data protection authority where you live or work, or where you think a problem occurred. In the UK that is the Information Commissioner's Office. We would appreciate the chance to address your concern first.

If you live in California or another U.S. state with a privacy law

Depending on where you live (for example California, Colorado, Connecticut, Delaware, Oregon, Texas, Utah, or Virginia), you may have the right to:

know what personal information we have collected about you, where it came from, why we collected it, and who we disclosed it to;
get a copy of it;
have it corrected;
have it deleted;
opt out of the sale of personal information, the sharing of it for cross-context behavioral advertising, targeted advertising, and certain profiling. We do not do any of these things, but the choices described below apply anyway;
limit the use of sensitive personal information. We do not collect sensitive personal information for the purpose of inferring characteristics about you, and we use account passwords only to sign you in;
not be treated differently for using any of these rights.

In the last twelve months we collected the categories of information described in "Information we collect": identifiers (such as name, email, IP address, account ID), customer records and commercial information (purchases and donations), internet activity (pages requested, and, with your consent, pages visited as measured by Google Analytics, downloads, and videos watched), approximate location (country, and region through Google Analytics with your consent), professional or education-related information you give us (school, district, subjects, grade bands), and the content of forms and posts. We disclosed these for business purposes only to the recipients listed in "How we share information".

You can use an authorized agent to make a request for you; we may ask the agent for proof of authority and ask you to confirm your identity. If we decline your request, you can appeal by replying to our decision or emailing team@pedagogyfutures.org with "Appeal" in the subject line, and we will respond within the time your state's law allows. If you are unhappy with the result of an appeal, you can contact your state attorney general.

How to make a request, and how long it takes

Email team@pedagogyfutures.org from the address on your account, or use the export and delete tools in your dashboard. To protect your information, we may ask you to confirm that the request comes from you before we act on it. We answer requests within one month (extendable by two further months for complex requests, as the GDPR allows) and, for U.S. state requests, within 45 days (extendable by another 45 days where the law allows). We will tell you if we need the extension and why. Requests are free unless they are clearly unfounded or excessive.

Your privacy choices

Cookies and similar technologies. Nothing optional runs until you choose to allow it. Use the "Cookie settings" link at the bottom of any page to change or withdraw your choice. Details are in our Cookie Policy.
Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of sale and sharing and we keep analytics, including Google Analytics, off. You can still turn a category on yourself in "Cookie settings" if you want to.
Do Not Sell or Share My Personal Information. We do not sell your personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of. If that ever changes, we will update this policy first and honor opt-outs, including Global Privacy Control.
Email. Every newsletter and optional email has an unsubscribe link, and your dashboard settings control course and forum notifications. Account and billing emails cannot be switched off while your account is open, because they are part of running it.

Cookies

We use a small number of cookies that the site needs to work (including Cloudflare's security cookies), optional analytics (Google Analytics and our own download counter), and optional content from Vimeo, YouTube, and Google. Our Cookie Policy lists each of them.

Children

PedagogyFutures is built for educators and other adults. Our services are not directed to children, and you must be at least 18 to create an account. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA and the UK). If you believe a child has given us personal information, email team@pedagogyfutures.org and we will delete it.

Educators, schools, and student information

Our courses, forums, and tools are for teachers and school staff, not for students. Please do not enter information that identifies your students, such as names or grades, into forum posts, forms, saved prompts, or anything else on the site.

When a school or district buys professional development for its staff or sets up an organization on PedagogyFutures, it does so for its educators. We do not receive student education records through these services. If a school needs us to handle student information for a separate engagement, we agree the terms for that in writing with the school first, including any obligations under the Family Educational Rights and Privacy Act (FERPA) and state student privacy laws.

Changes to this policy

We will update this policy when our practices change. The date at the top shows when it last changed. If a change is significant, we will say so on the site and ask for your cookie choices again, and we will email account holders where the change affects them.

Contact us

Questions, requests, or complaints about privacy go to team@pedagogyfutures.org. Our postal address is PedagogyFutures Inc., One Beacon Street, Floor 15, Boston, MA 02108.