Privacy Policy

Frizzle, Inc (“Frizzle,” “we,” “us”) provides an AI assessment and instructional-analytics service for schools and educators (the “Service”). This Privacy Policy explains how we collect, use, share, and protect personal information, including student data schools upload.

This is our public privacy notice and public student-data terms. It is incorporated into our Terms of Service. It is not a substitute for a signed Data Privacy Agreement. Schools and districts can request a signed DPA at support@frizzle.com. If you have a signed DPA, order form, or MSA with us, that document controls if it conflicts with this Policy.

We process student data as a school official under FERPA, only for the school, and only for the educational purposes the school authorized. The school (not Frizzle) owns and controls student data. Parents and eligible students exercise FERPA rights through the school.

The Service is for authorized educators and school staff. Students do not create accounts or log in.

1. Who this covers

• Educators and school staff who create accounts (including individual teacher plans).
• Schools and districts that buy or authorize the Service.
• Students, only as data the school or a teacher uploads (assignment images, names or identifiers the teacher includes, scores). We do not collect information directly from students.

If you are a parent, contact your school. We cannot verify parental identity against a school’s records from this website.

2. Information we collect

Educator and account information

• Name, email, profile image (if you use Google Sign-In)
• School or district affiliation you provide
• Authentication data (password hashes or SSO tokens)
• Role (teacher, admin) and account settings
• Billing details for teacher plans (processed by Stripe; we do not store full card numbers)
• Support emails and feedback

Student information (uploaded by the school or teacher)

• Images or scans of student work (handwriting, worksheets, quizzes)
• Student names, roster identifiers, class/section, grade level, if the teacher adds them
• Scores, flags, comments, misconception tags, and other Output we generate
• Optional assignment titles, standards, or rubric text the teacher enters

We do not need, and you should not upload, student home addresses, Social Security numbers, health records, or similar sensitive data that is not required to assess the work.

Usage, device, and diagnostics

• Log data (IP address, browser, timestamps, pages or features used)
• Approximate location derived from IP
• Cookies and similar tech on our sites (see §8)
• Product analytics to see which features work
• Security and abuse logs (see §9)

Information from integrations

If you connect Google Sign-In or a later LMS/SSO (for example Google Classroom), we receive only what that provider sends for login and the scopes you authorize. See §7.

We do not have to collect every item above for every user.

3. How we use information

We use personal information to:

• Provide the Service: authenticate you, assess and analyze uploaded work, show results to the teacher or school that submitted them
• Operate, secure, and debug the Service, including detecting Prompt Injection, Prompt Extraction, Model Extraction, fraud, ineligible (including competitor) use, and other abuse, as described in the Terms
• Bill teacher plans and school invoices, and prevent payment fraud
• Provide support and service-related notices (including auto-renewal reminders)
• Comply with law and with school instructions
• Create de-identified or aggregated insights that cannot reasonably identify a student, educator, or school

Student work and other Customer Data are not used to train Frizzle’s foundation models, and our model providers are contractually prohibited from using that data to train their models. “Improve the Service” in this Policy means product reliability, security, and support.

4. How AI processing works

The Service uses AI, including third-party models, to read student work and produce scores, flags, and comments.

• Input (the image or text you submit, plus limited context such as the problem or rubric) is sent to our systems and, as needed, to AI subprocessors listed on our subprocessor page.
• Those providers process Input to return Output to Frizzle for you. They are under contract not to train on that data and not to use it for their own purposes. We require zero-retention from all providers.
• We do not use student data for advertising, profiling for ads, or sale.
• Output can be wrong. Teachers must review it. We do not make autonomous high-stakes decisions about students (placement, discipline, report cards) without a human in the loop.

5. What we do not do

• Sell personal information
• Share personal information for cross-context behavioral advertising (CCPA/CPRA “sharing”)
• Use student data to market to students or families
• Allow students to create accounts
• Train foundation models on student work or educator content
• Let subprocessors use Frizzle data for their own ML, ads, or product training

6. When we share information

We share personal information only:

• With the school that owns the tenancy (admins can see their teachers’ use and Customer Data)
• With subprocessors who help us run the Service, under contract, listed at frizzle.com/legal/subprocessors. We will update that page when the list changes and, for student data, follow any notice period in a signed DPA.
• If you ask us to, or the school instructs us to
• For legal reasons: to comply with law or valid legal process; to protect students, schools, or Frizzle; to enforce the Terms (including shutting off injection, extraction, or ineligible company use)
• In a merger or sale of Frizzle, with the buyer bound to continue protecting the data as this Policy (or the signed DPA) requires. We will not treat a sale of the company as a sale of student personal information under SOPPA-style rules.

We do not sell student information. We do not disclose student information except as the school directs or as this Policy / a DPA / law allows.

7. Google Sign-In

If you log in with Google, we receive basic profile information (name, email, profile image) for authentication and account administration. We do not request Classroom, Drive, Gmail, contacts, or Calendar unless we later add an integration you separately authorize.

Frizzle’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising. You can disconnect Google in account settings or through your Google account.

8. Cookies, analytics, and the marketing site

We use cookies and similar storage to keep you logged in, remember preferences, and measure use of the product and marketing site. We do not use student data for advertising cookies.

You can block cookies in your browser; the Service may not function fully without essential cookies.

9. Security, monitoring, and retention

We use encryption in transit and at rest, access controls, authentication, logging, and vendor contracts.

We may monitor Input, Output, images, and metadata to operate and secure the Service and to detect abuse, as described in the Terms. That monitoring is for security and enforcement.

Retention. Educator account data is kept while the account is open and for a reasonable period afterward for billing, security, and legal records.

Student data is kept only as long as needed to provide the Service to that school, or as the school instructs. On contract or account termination, or earlier on school request, we delete or return Customer Data from production systems within sixty (60) days (backups in the ordinary cycle, longer if a legal hold applies), unless a signed DPA sets a different timeline.

10. Security incidents

If we discover a breach of personal information, we will notify the affected school without unreasonable delay and within legally required timelines, including as required by FERPA guidance, state student-privacy laws, and NY Education Law 2-d (notification to the educational agency no later than 7 calendar days after discovery, where that law applies). We will not notify parents directly unless the school or law requires us to; the school is the point of contact for families.

11. FERPA, COPPA, SOPPA, NY 2-d, SDPC

• FERPA. We act as a school official with a legitimate educational interest. We use student data only for authorized educational purposes, under the school’s direction. We do not redisclose except as the school directs or FERPA allows.
• COPPA. Students cannot create accounts. We do not knowingly collect personal information directly from children under 13. The school is the consenting authority for student data it uploads (COPPA school-consent).
• SOPPA, NY Ed Law 2-d, SDPC. We support school compliance: no sale of student data, no targeted ads to students, subprocessors under contract, deletion on request, breach notice, and a signed DPA on request. A Parents’ Bill of Rights-style summary: the school owns the data; Frizzle does not sell it; parents should go to the school to inspect or correct education records.

12. Your choices and rights

Schools may access, correct, export, or request deletion of educator and student data in their tenancy by emailing support@frizzle.com or using in-product admin tools.

Educators may access and update account information in settings, disconnect Google, cancel a teacher plan as described in the Terms, and request deletion of their account. If the account holds a school’s student data, we will follow the school’s instructions on that data.

Parents and eligible students exercise rights through the school, as FERPA requires. We will cooperate with the school’s request.

California and other U.S. state privacy laws. If a consumer privacy law applies to you as an educator (not to FERPA-covered student education records, which those laws often exclude), you may request access, deletion, or correction at support@frizzle.com. We do not sell personal information or share it for cross-context advertising. We will not discriminate against you for exercising those rights. We may need to verify the request. Authorized-agent requests: have the agent write to the same address with proof of authority.

13. U.S. service; international

The Service is operated from the United States. If you access it from elsewhere, you understand information is processed in the U.S. If we process personal data of individuals in the EEA, UK, or Switzerland, we will do so under a signed DPA with appropriate transfer tools (such as Standard Contractual Clauses). Email support@frizzle.com.

14. Children

The Service is not directed at children. Students must not create accounts. If we learn a student has created an account, we will close it and delete it, except to the extent the school instructs us to retain something as an education record.

15. Changes

We may update this Policy. We will change the “Last updated” date and, for material changes, notify the primary email on the account or post an in-product notice where practicable. Continued use after the effective date is acceptance. If you do not agree, stop using the Service and ask us to delete your account.

16. Contact

Questions: support@frizzle.com Privacy / DPA requests: support@frizzle.com (subject “Privacy” or “DPA”) Security or abuse: security@frizzle.com (subject “Security” or “Abuse”)

Frizzle, Inc 169 Madison Ave STE 38417 New York, NY 10016 United States