Privacy Policy

Last updated: June 13, 2025

Introduction

Purpose of the policy

Protecting your privacy is important to us, and this document explains how we collect, use, and safeguard your personal information. Our goal is to be transparent and ensure you understand how your data is managed when you interact with our services.

This privacy policy outlines:

  • What personal information we collect and why.

  • How we use, handle, and store, and protect your data.

  • Your rights regarding your information and privacy, and how to exercise them.

  • Our compliance with applicable privacy laws in the United States and Canada.

  • The measures we take to keep your data secure.

We aim to provide clear information so you can feel confident and informed when using our services.

Scope

This Privacy Policy applies to all services and interactions with WeWillWrite, where we operate as the data controller for teacher information and as a data processor or “school official” for student information, as applicable under relevant laws. This means we are responsible for deciding how and why your personal data is processed, or we process it on behalf of and under the direction of educational institutions. The scope includes all personal information collected through our platforms, communication channels, and any related services.

It also addresses specific considerations like international data transfers, compliance with regulations such as FERPA and COPPA, Canadian federal and provincial privacy laws, and the use of artificial intelligence in handling personal information.

If you are part of a school or school district, a separate data processing agreement (DPA) may apply, with the school or district governing the processing of student data. In such cases, the school or district acts as the data controller or an equivalent role under applicable law, and WeWillWrite acts as a data processor or “school official” under their direct control, as further detailed in such DPAs. Please contact your school or district to learn how your data is processed under their policies.

If you represent a school, school district, or organization and require a signed DPA to comply with federal regulations, please contact privacy@wewillwrite.com for assistance and to address any questions you may have.

By using our services, you trust us with your data, and this policy is our commitment to handle it responsibly and transparently.

Personal information we collect

We've created the table below to outline what personal information we collect, why we collect it, and our data retention practices. We are committed to collecting only the personal information that is reasonably necessary to provide and improve our services.

Information collected about teachers linked to their identity

Information What is it used for? How long is it stored?
Name To personalize the service for them. Until they delete their account.
Email
  • To provide secure login.
  • To provide support and communications.
 Until they delete their account.
Phone number Optional alternative to Email. Until they delete their account.
Password To provide secure login. Until they delete their account.
Country, state and school
  • To personalize the service for them.
  • Organize services by location and school.
 Until they delete their account.
Usage data (IP address, browser type, browser version, the pages of our Service that they visit, the time and date of their visit, the time spent on those pages, unique device identifiers and other diagnostic data)
  • To improve and analyze our service performance and security.
  • For error tracking.
 Until they delete their account.

Information collected about students linked to their identity

Information What is it used for? How long is it stored?
First Name
  • To let the teacher identify students and access students' results.
  • To reduce bullying.
  • As part of a unique identifier for tracking students' progress over time without requiring more complex login methods like email and passwords for every student.
  • Until the specific class the student belongs to is deleted.
  • Or until the teacher's account is deleted. (referring to the teacher who owns the class the student belongs to).
Last Name
  • To let the teacher identify students and access students' results.
  • To reduce bullying.
  • As part of a unique identifier for tracking students' progress over time without requiring more complex login methods like email and passwords for every student.
  • Until the specific class the student belongs to is deleted.
  • Or until the teacher's account is deleted. (referring to the teacher who owns the class the student belongs to).
Class ID To associate a student with their teacher's class.
  • Until the specific class the student belongs to is deleted.
  • Or until the teacher's account is deleted. (referring to the teacher who owns the class the student belongs to).
Device ID / Browser ID (App assigned device identifier) Helps us recognize a returning student:
  • To autofill their name.
  • To increase reliability of tracking students progress and learning outcomes over time.
Until the device is no longer associated with the student.
Texts written by the student
  • To give their teacher insight into how the student is using WeWillWrite.
  • To measure progress and learning outcomes.
  • Until the student is deleted from the class where the text was written.
  • Or until the specific class the student belongs to is deleted.
  • Or until the teacher's account is deleted. (referring to the teacher who owns the class the student belongs to).

Information collected from students, but not linked to their identity

Information What is it used for? How long is it stored?
Usage data (IP address, browser type, browser version, the pages of our Service that they visit, the time and date of their visit, the time spent on those pages, unique device identifiers and other diagnostic data)
  • To improve and analyze our service performance and security.
  • For error tracking.
 Indefinitely.

Sharing and disclosure of information

WeWillWrite may share or disclose your information only in the following limited situations:

  1. With Consent: When you (the teacher, or the school or district on behalf of parents) explicitly agree, such as through accepting terms or authorizing a specific action.
  2. To Provide Services: Sharing with vetted service providers (sub-processors) who perform essential tasks on our behalf, such as cloud hosting, payment processing, or email delivery. These providers are contractually bound to protect your information and held to the same standards we hold ourselves to in this policy.
  3. Legal Obligations: To comply with applicable laws, regulations, or enforceable governmental requests.
  4. Business Operations: In the event of a merger, acquisition, or sale, your personal information may be transferred. We will require any acquiring entity to honor the commitments made in this Privacy Policy.
  5. Fraud Prevention and Security: To prevent fraud, illegal activities, or security breaches.

Subprocessors

Here's a list of trusted partners who help us deliver our services. As part of their role, they may process or come into contact with personal information. We carefully select and monitor all partners to ensure they meet our high standards for data privacy and security.

Your rights and choices

You have certain rights regarding your personal data. Parents should visit this section to learn more about their rights with respect to their child's information.

  • Access, Update, or Delete Your Data: You can manage your personal data directly in your account settings. If you need assistance, contact us at privacy@wewillwrite.com. You can also request a copy of your data.
  • Correct Your Data: Request corrections to any incomplete or inaccurate information we hold about you.
  • Object to Data Processing: If we process your data based on legitimate interests or for direct marketing, you can object to this (student data is never used for marketing purposes).
  • Request Data Deletion: You may delete your account directly from account settings. If you need assistance, contact us.
  • Transfer Your Data: Receive or transfer your data in a standard, machine-readable format, where applicable.
  • Withdraw Consent: You can withdraw your consent to data use at any time, though this may limit your access to some of our services.

Exercising Your Rights

  • Teachers: Please use your account settings or contact privacy@wewillwrite.com.
  • Parents: To exercise these rights, parents should first contact their child's school, which can then coordinate with WeWillWrite. If you have questions about exercising these rights, please contact us at privacy@wewillwrite.com

Data security

Measures to protect your information

  • Access Control: Only authorized team members with a specific need can access personal data necessary for performing their role. Role-based access controls (RBAC) are enforced.
  • Confidentiality Agreements: All team members with access to Personal Data are required to sign a confidentiality agreement.
  • Encryption in Transit: Information sent between systems is encrypted for protection.
  • Encryption at Rest: Stored data is encrypted to maintain its integrity and confidentiality.
  • Secure Systems: Our servers and systems are regularly updated and patched to guard against known security threats.
  • Regular Backups: Data is backed up daily, stored securely for 30 days, and maintained with zone redundancy to ensure availability and recovery in case of unexpected incidents.
  • Data Minimization: We only collect and store the personal information necessary for providing and improving our services, as outlined in this policy.
  • Employee Training: Our team undergoes regular training on data privacy and security best practices, including their obligations under relevant law.
  • Vendor Management: We vet our third-party service providers for their security practices and require them to contractually commit to protecting any data they process on our behalf.

Breach response plan

If a data breach compromises the security, confidentiality, or integrity of Personal Data maintained by WeWillWrite, we will take immediate steps to contain and investigate the incident. Affected users and/or educational institutions (in the case of student data) will be notified promptly, generally within 72 hours of our confirmation of a breach involving personal data.

The notification will include, at a minimum:

  • The notification date.
  • The types of personal data reasonably believed to be involved.
  • A summary of the breach.
  • The date, estimated date, or date range of the breach.
  • Steps we are taking to mitigate the harm and prevent future breaches.
  • Contact information for users to obtain more information.

Personal information and artificial intelligence

We are committed to the responsible use of artificial intelligence (AI).

  • No Training on Personal Information: We do not use teacher or student personal information to train artificial intelligence models. The third-party AI model providers we work with do not utilize teacher or student data from WeWillWrite users to train their AI models.
  • Teacher Personal Information: When an AI is prompted within WeWillWrite, the teacher's personal information is not included in the prompt shared with the model provider.
  • Student Personal Information: Similarly, when an AI is prompted within WeWillWrite, students' personal information, such as their names, school and ip-address, is not included in the prompt shared with the model provider.
  • Data Ownership and Control: WeWillWrite acknowledges that student-generated content, including texts, remains part of the student's education record under the control of the educational institution. Any processing of such content by AI is done on behalf of and under the direction of the school.

FERPA compliance

We adhere to FERPA requirements when applicable. Under FERPA, we act as a "school official" for our school or school district customers. This designation means we operate under the direct control of the school or district and use students' personal information solely to deliver our services to them.

  • We perform an institutional service or function for which the school would otherwise use its own employees.
  • We operate under the direct control of the school or district with respect to the use and maintenance of education records. This "direct control" is established and detailed in our Data Processing Agreements (DPAs) with educational institutions, which outline the school's authority over student data.
  • We use students' personal information from education records solely to deliver our services to them for legitimate educational interests, as directed by the school.
  • We are subject to FERPA's limitations on the re-disclosure of personally identifiable information from education records.
  • We will assist schools in fulfilling parental rights to access, review, and request amendments to their child's education records maintained by us.

COPPA compliance

We are fully compliant with the Children's Online Privacy Protection Act (COPPA).

  • School Consent in the Educational Context: The Federal Trade Commission (FTC) permits schools to provide consent on behalf of parents for the collection of students' personal information by online operators, provided the information is used solely for educational purposes and not for commercial purposes. We rely on this school-based consent for students under 13 using WeWillWrite in a school setting.
  • Use Limitation: Data collected under school consent is used strictly for the educational purposes authorized by the school and for no other commercial purpose. We do not use or disclose student personal information for targeted advertising or create profiles of students for such purposes.
  • Data Minimization: We collect only the personal information from students that is reasonably necessary for them to participate in the WeWillWrite platform as an educational tool.
  • Data Retention: We retain children's personal information only for as long as is reasonably necessary to fulfill the specific educational purpose(s) for which it was collected. We do not retain children's personal information indefinitely. We have a written data retention policy outlining these practices.
  • Parental Rights: We honor parents' rights under COPPA to review their child's personal information, direct its deletion, and refuse further collection or use. (See the sections "For Parents" and “Exercising Your Rights” for more information).
  • Security: We maintain a comprehensive security program with reasonable safeguards to protect the confidentiality, security, and integrity of children's personal information, including conducting regular risk assessments.
  • Direct Notice to Schools: We provide schools with clear and conspicuous notice of our data collection, use, and disclosure practices for student information.

For Parents

  • FERPA Rights: Parents (or eligible students) have the right to inspect and review the student’s education records, request amendments to records they believe are inaccurate or misleading, and have some control over the disclosure of PII from education records. These rights can be exercised through the student’s school. WeWillWrite will fully support schools in meeting their FERPA obligations.
  • COPPA Rights (for parents of children under 13 in the U.S.): Even when a school provides consent for data collection, parents retain:
    • The right to review personal information collected from their child.
    • The right to direct the deletion of their child’s personal information.
    • The right to refuse further collection or use of their child’s personal information.
  • Canadian Rights (PIPEDA and Provincial Laws): Individuals in Canada have rights to access and request correction of their personal information. For student information, these requests are managed through the school. Residents of Quebec have additional rights under Law 25, including the right to data portability and specific consent rules for minors under 14 (requiring parental consent). We are committed to assisting schools in fulfilling these rights.

International data transfers

We operate globally, but all of our server infrastructure is located in the United States. This means that any data you provide to us will be transferred to, stored, and processed in the United States. By using our services, you acknowledge this transfer.

Our commitments

  • No Selling or Sharing of Personal Information: We do not sell, rent, or share personal information with third parties for any purpose, including marketing.
  • No Personalized Advertising or Data Profiling: We do not display personalized ads or create data profiles for advertising purposes.
  • Protecting Student Data: WeWillWrite will never use student data for commercial purposes, nor will we allow any third parties to do so. Student data is used solely for providing and improving the educational service as directed by the school.

Updates to this privacy policy

We occasionally make updates to our Privacy Policy to keep it up to date and ensure transparency. Whenever changes are made, we'll let you know by posting the updated policy here and updating the "Last updated" date at the top.

For material changes, we'll notify you in advance through email (if we have your email address, such as for teacher accounts) or a noticeable announcement on our service before the changes take effect. We encourage you to review this Privacy Policy periodically.

Contact us

If you have any questions about our Privacy Policy, feel free to reach out to us by email at privacy@wewillwrite.com.