Product Privacy Notice 

Effective Date: December 31, 2023

To see the previous version of this policy please view here.

What’s Changed in this Notice?

• Instructure has updated Section 9 to reflect the updates for the EU-U.S. Data Privacy Framework to include information regarding the Swiss-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework.
• Instructure has added information regarding LearnPlatform services in Section 10.
• We have added a new Section 10 which describes our privacy practices related to the LearnPlatform by Instructure Products.

Introduction.

Instructure is committed to protecting the information we process by doing our best to ensure that the information is used only to support students and education. We are guided in this mission by our foundational Privacy Principles:

1. Transparency: We will work to ensure transparent data processing in our business.
2. Accountability: We will demonstrate our commitment to privacy in concrete and tangible ways.
3. Integrity: We will strive to ensure that the data entrusted to us is complete, consistent, and accurate.
4. Security: We will implement and maintain appropriate technical, administrative, and organizational measures to protect data in accordance with regulatory requirements.
5. Confidentiality: We will establish and maintain policies, procedures, and practices that limit access to data and protect against unlawful or unintentional access or disclosure.

As part of our commitment to protecting the privacy of students, educators, and institutions, we are a signatory to the Student Privacy Pledge and a member of the Future of Privacy Forum.

Instructure has also earned the TrustEd Apps Data Privacy Certification Seal.

We invite you to learn more about the data practices on our platforms that enable lifelong learning.

Contents:

1. About our Users and our Products.
2. Information Collection.
3. Our Use of Your Information.
4. Disclosure of Information.
5. Children’s Privacy.
6. Your Information, Your Control.
7. Other Important Information.
8. Security of Your Personal Information.
9. Data Privacy Framework.
10. Contact Information.

Instructure, Inc. and its affiliates and subsidiaries (“Instructure,” “we,” “our,” or “us”) prepared this Product Privacy Notice (“Notice”) to describe our privacy practices. This Notice governs information collected and processed by our products and services (collectively, “Products”), which are listed here: https://www.instructure.com/product/all-products.

1. About our Users and our Products.

How we use your information depends on our relationship with you. We primarily provide our Products to Academic Institutions, such as K-12 schools and higher education institutions, and companies that use our Products to amplify teaching, elevate learning, provide professional development opportunities, and improve student outcomes.

If you are an end user of an Academic Institution or company that uses our Products, it means that your institution determines how your personal information is used. This means that your organization’s privacy notice governs the use of your personal information. This Notice is intended to provide transparency related to Instructure’s privacy practices only.

We have provided the following summary to help you understand what we do with the information we process through our Products and the relationship between our users and Products.

2. Information Collection.

Now that you know about our Products, we want to tell you about the information our Products collect and process.

3. Our Use of Your Information.

Now that you’ve learned about the information we process, let’s go over what we do with it.

Please note that if we process your personal information for a purpose other than the purpose for which it was collected, we will provide you with notice in advance of the new processing and obtain consent if required.

We limit our collection and use of your personal information only to those elements required to operate our Products, or as otherwise disclosed in this Privacy Notice. We do not engage in automatic decision making, advertising to students, or profiling.

To provide, analyze, and improve our Products. We use the information described above to provide, analyze, and improve our Products, including to:

• Create and maintain your account.
• Identify you as a user.
• Notate and assign support tickets.
• Provide, operate, maintain, and improve our Products.
• Personalize and improve your experience.
• Contact you and communicate with you, including to respond to your comments or inquiries.
• Provide customer support.
• Solicit feedback about our Products, including by asking you to respond to surveys or questionnaires (with your permission).

Please see the “Third-Party Websites” section below for more details about sharing information with third-party websites or platforms.

De-identified or aggregate use. We may create and use de-identified or aggregate information, that is information removed of specific identifiers so that it cannot singly identify you (i.e., non-personal information) for any purpose.

4. Disclosure of Information.

Now we will review how we share or disclose information, including personal information. Please note that we share information, and permit you to share information, only as described in this Privacy Notice. We do not sell or rent personal information to third parties.

A. Instructure’s Disclosure of Information.

Instructure may share information with the following recipients or as set forth below.

Commonly owned entities. We may share your information, including personal information, with companies under common ownership or control of Instructure, including affiliates and subsidiaries, to help provide our Products.

Third-party service providers. We may share your personal information with authorized third-party service providers for the sole purpose of providing you with our Products.

We do not permit our third-party service providers to use personal information we share with them for their own advertising or marketing purposes, or for any other purpose other than in connection with the services they provide to Instructure. Additionally, we do not sell or rent your personal information to third parties.

Google APIs. Our use of information received from Google APIs will adhere to Google's Limited Use Requirements. Our Product’s use and transfer to any other application of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. 

As required by law. In certain circumstances, we may be required to disclose information, including personal information, in order to:

• Comply with legal or regulatory processes (such as a judicial proceeding, court order, or government inquiry).
• Enforce the Instructure Acceptable Use Policy and other applicable policies.
• Respond to claims that any content violates the rights of third parties.
• Protect the rights, property, or personal safety of Instructure, its employees, its users, its clients, and the public.

Change of Control. We may share information about you in connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company. In the event that information is shared in this manner, notice will be posted on our website at www.instructure.com.

With your consent or at your direction. We may share information other than as described in this Privacy Notice with your consent, or at your specific direction, for example, if you choose to use the Products with social networking platforms (e.g., Facebook, YouTube, Twitter, etc.).

De-identified or aggregate use. We may share de-identified or aggregate information, that is information removed of specific identifiers so that it cannot singly identify you (i.e., non-personal information) for any purpose without limitation, unless prohibited by applicable law.

B. Disclosure of Information through Instructure’s Products.

Our Products have features that share information (including personal information) with authorized third parties or that allow you to share information with third parties or the public. These disclosures are described below.

Academic Institutions, course providers, or parents. We may share your personal information with the Academic Institution or company which is linked to your use of our Products. Where permitted, we may also share your information with relevant parties associated with the Academic Institution, such as educators or fellow students, or parents of students using our Products or fellow users.

For example, this would apply:

• If your Academic Institution uses our Products as a learning management platform and has given you access to the Products; or
• If you are taking a course via the Products, we will share your personal information you provided upon account registration and coursework registration with the educator and/or Academic Institution

Other Third Parties. You may choose to share information through our Products, such as Portfolium, with other users of the Products or the public when you post content or otherwise provide information about yourself. We are not responsible for others’ use of the available information, so you should carefully consider whether and what to post or how you identify yourself.

If you use Portfolium, examples of sharing your personal information may occur when you:

• Create an account, your name and other profile information will be viewable and searchable by other users and Employer Partners (as noted above).
• Post content to Portfolium, such as videos, photos, school projects, and comments, which are displayed on Portfolium and viewable by other users by default.
• Access public blogs, community forums, or the newsfeed within the Product.
• Post to our public blog, which is operated by a third-party application. Our Privacy Notice does not cover the practices of these third parties, and your interactions with these third-party applications are governed by their separate privacy policies.

On Portfolium, we do not make a child user’s account publicly available; only parents and Academic Institutions have access to a child user’s account. And we do not make users’ accounts or data publicly available on Canvas LMS & Mastery Connect.

With your consent or at your direction. As noted, we may share information other than as described in this Privacy Notice with your consent, or at your specific direction, for example, if you choose to use the Products with social networking platforms (e.g., Facebook, YouTube, Twitter, etc.).

5. Children’s Privacy.

For users of Canvas LMS and the Mastery suite of products, we may take steps intended to comply with the Children's Online Privacy Protection Act (“COPPA”). Please see our Children’s Online Privacy Protection Act Privacy Notice.

Except for authorized users of Canvas LMS, Canvas Studio, Canvas Student Pathways, or the suite of Mastery products, if you learn that a child under thirteen years of age has provided us with personal information, please alert us at privacy@instructure.com.

6. Your Information, Your Control.

We provide you with several ways to control your information.

Parents and Academic Institutions. Parents and educators may review information collected from children, request deletion of this information, or request no further collection or use of this information by contacting us at privacy@instructure.com or submitting a help desk ticket through our Products.

Account Information. You may change some of your personal information by editing your Product profile. You may also request that we modify or delete your information by emailing us at privacy@instructure.com or submitting a help desk ticket through our Products. We will respond to your request, when permitted by law and subject to exceptions, within 30 days. We may be unable to delete information that resides in our archives.

Portfolium Account Closure. If you wish to delete your Portfolium account, you can go to the "Privacy" tab under "Account Settings" and click "Disable Account." Once your account has been disabled, you can request deletion of your account by selecting "Permanently Delete" from the “disable” account screen. After requesting deletion, you have fifteen days to change your mind before we cannot undo your deletion request.

Employer Communications. Portfolium users (that are over 18 years of age) may receive private messages through Portfolium from approved employers. At any time, Portfolium users may unsubscribe from all employer-generated private messages. Portfolium users may also use the privacy settings in their account to opt out of their information being shared with employers.

Push Notifications. If you would like to stop receiving push notifications, please use the settings on your mobile device to opt out. Please note that opting out of receiving push notifications may impact your use of our Products (such as receiving a notification that you have a new message). Please note that the opt-out process differs depending on the mobile device you are using.

Location. Some Products may collect precise location information about your mobile device, but only with your consent. If you wish to revoke permission to collect precise location information, you can change the location settings on your mobile device.

If you require access to personal information not otherwise available through any of the mechanisms described above, please contact us at privacy@instructure.com or submitting a help desk ticket through our Products.

7. Other Important Information.

Student Data Privacy Agreements. When providing our Products to certain US Academic Institutions, we may sign a state-level Student Data Privacy Agreement (“SDPA”) with a Local Educational Agency (“LEA”). The LEAs make these SDPAs publicly available. You can access the SDPAs that we have signed with LEAs on the Student Data Privacy Consortium website located at https://sdpc.a4l.org/.

Third-Party Websites. Our Products may contain links to third-party websites or services that allow you to leave our Products and go to another website when you click on such a link. Your information, including personal information, may be collected by those separate entities. We have no control over, do not review, and cannot be responsible for these outside websites or their content.

Please be aware that the terms of this Privacy Notice do not apply to these outside websites or content, or to any collection of data after you click on links to such outside websites. The links to third-party websites or locations are for your convenience and do not signify our endorsement of such third parties or their products, content, or websites.

8. Security of Your Personal Information.

Instructure takes reasonable steps to help protect your personal information in an effort to prevent unauthorized access, use, or disclosure. You can find more details about our security program by visiting our security webpage at https://www.instructure.com/trust-center and reviewing our Security and Due Diligence Documents.

Despite these measures, you should know that we cannot fully eliminate security risks associated with personal information. No method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee absolute security. Any content you post or input you provide while using our Products is at your own risk.

Please be aware that the personal information we collect may be transferred to and maintained on servers or databases located outside your county, and personal information may be accessible to law enforcement and national security authorities in those jurisdictions.

9. Data Privacy Framework.

Instructure complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. Instructure has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Instructure has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (“DPF”) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Instructure commits to subject to the DPF Principles all personal data received from the EU, UK, and Switzerland in reliance on the relevant DPF.

Instructure is accountable for the processing of personal data it receives under the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles (collectively, “DPF Principles”) and subsequently transfers to a third party. Instructure complies with the DPF Principles for all onward transfers of personal data from the EU, UK, and Switzerland, including the onward transfer liability provisions. The Federal Trade Commission has jurisdiction over Instructure’s compliance with the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Instructure may be required to disclose personal data in response to law requests by public authorities, including to meet national security and law enforcement requirements.

Residents of the EU, UK, and Switzerland have the right to access the personal data that Instructure maintains, and in some cases, have choices to limit the use and disclosure of personal data. These rights are described more fully in Product Privacy Policy: the Your Rights section of the European Union Region Product Privacy Notice Addendum. To exercise these rights, contact us at privacy@instructure.com.

In compliance with the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Instructure commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK, and Swiss, individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Instructure as described in the “Contact Information” in Section 10 below.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Instructure commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to TRUSTe, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://feedback-form.truste.com/watchdog/request for more information or to file a complaint. The services of TRUSTe are provided at no cost to you. Under certain conditions, more fully described on the DPF website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

10. LearnPlatform Services.

This Section 10 applies only to users of the LearnPlatform by Instructure software, and any other extensions, mobile applications, software, or add-ons provided by us for use with LearnPlatform by Instructure (collectively the “Platform”)

A. Information We Collect.

We may collect the following types of information when you use the Platform.

Information you provide. When you sign up for the Platform, we ask you for some basic personal information, such as your name, email address, and Academic Institution. You may update or change your account or profile information through the Platform at any time. When you use the Platform, you may provide additional personal information at your sole discretion, including subject interests and grade level interests. As part of an Academic Institution, others in your Academic Institution and linked Academic Institutions may see your personal information and technology reviews.

If you are a Technology Provider, we may collect information from you concerning your Educational Tools. Any information you provide concerning the Educational Tools may be shared with other users of the Platform.

Cookies and Other Similar Technologies. We use cookies to help us understand how individuals utilize our Platform and to help us improve the quality of our Platform, including for storing user preferences, improving search results, and tracking user trends, such as how individuals use our Platform.

When you access the Platform we automatically record certain information, such as your web request, your interaction with the Platform, IP address, browser type, browser language, device type, operating system, and device ID. We use this information for troubleshooting and security monitoring.

As you interact with the Platform, we obtain information regarding your interactions, such as time of day and date, how long you spend on different pages; some of this information is collected via cookies that may uniquely identify your browser or your account. We use this information to understand how your hardware and software interacts with the Platform and how we can better improve usage of the Platform.

If you or your Academic Institution have installed our extensions to your browser, we may automatically record certain information while the extension is activated, such as your username, the websites you visit, and the amount of time spent on each site. The extension records only application or website information on products that are included in the Platform’s product library as described below.

User Communications. When you send communications to us or to other users through the Platform, we may retain those communications in order to process your inquiries, respond to your requests and improve our Platform. We may use your email address to communicate with you about our Platform, including service-related notices.

B. Integrated Metrics Producing Analytics on Classroom Technology (IMPACT) Data

This section applies only if your Academic Institution uses IMPACT. The IMPACT module of the Platform (“IMPACT”) is an optional tool that integrates data from multiple sources including student demographic information, product usage, and student achievement data to produce evidence-based reports and dashboards on product effectiveness. The data used in IMPACT are defined, approved, and controlled by the Academic Institution using IMPACT, and usage of IMPACT only happens at the direct instruction of -- and via direct involvement with -- the Academic Institution. IMPACT does not use any data collected via browser extensions. All data used for IMPACT are used only for the specific educational purpose defined by the Academic Institution.

C. How We Use and Share Information

We use information we collect to administer the Platform, to allow you and other users to use the Platform and to improve our Platform and as otherwise described above in Section 10.A. We will disclose information to our service providers that work on our behalf as described in Section 4.A., to provide the Platform.

Certain information and the reviews that you post to the Platform will be shared through the Platform and will be accessible to other users of the Platform. Please note once you have posted information to the Platform or communicated with another member of the Platform, we cannot control how other users may use the information you provide. Additionally, your Academic Institution may have access to your information, including as posted to the Platform, and may use such information in accordance with the Academic Institution policies.

Our Technology Providers do not have access to data you provide us or data we collect unless you expressly initiate such a request or expressly consent to such disclosure. If given permission, our Technology Providers may provide information about their educational tools and respond to requests from users.

If you are a Technology Provider and are using the Platform to respond to a request for proposal ("RFP") from an Academic Institution, we may collect the information you submit through the Platform and share that information with the designated Academic Institution.

We may use the information you provide through the Platform in response to RFPs in an aggregate and de-identified manner to provide aggregated and statistical data about such responses to our users and schools.

We may also create aggregated and statistical data about our users and/or Academic Institution and the use of the Platform. We may share or provide aggregated and statistical data, including reviews, to Academic Institutions, educational organizations, or Technology Providers.

We may also use de-identified or aggregated information to improve the Platform, including by sharing such information with our third-party collaborators and partners.

D. Platform Extensions

If you use the browser extension portion of our Platform, the Platform will collect information relating to your use and interactions with various websites accessed through your Chrome browser or your iOS device. Because the explicit purpose of the extensions is to help our customers understand how educational tools are used in their environments, the extensions collect general information only when you use sites related to educational tools that are listed on the Platform and included in the product library. You can review whether the extension is collecting information as follows:

• Chrome Extension: When the Chrome extension is grayed out in your browser, no information is being sent to the Platform. When the Chrome extension is colorized, you are on a website that is part of the product library, and general information is sent back to the Platform.
• iOS Extension: When you are on an application or website that is not part of the Platform product library, no information is being sent to the Platform from the iOS extension.

The information collected through the extensions is not used to identify an individual student and is used only in aggregated form. For Academic Institutions that have a paid subscription to the Platform, the names of individual teachers can be listed on a per Academic Institution basis. We do not otherwise track or collect personal information about your online activities once you leave the Platform.

11. Contact Information.

Instructure welcomes your comments or questions regarding this Privacy Notice. Please email us at privacy@instructure.com, or contact us at the following address, or phone number.

Instructure, Inc.
6330 S 3000 E, Suite 700
Salt Lake City, UT 84121
United States of America
Phone: +1 (800) 203-6755

Instructure Global Ltd. 
Birchin Court, 5th Floor 
19-25 Birchin Lane 
London EC3V 9DU 
United Kingdom 

To contact our Data Protection Officer, please use the following email address privacy@instructure.com

12. Changes to this Privacy Notice.

We may change this Privacy Notice from time to time. If we make any changes to this Notice, we will change the “Effective Date” above. If such changes are material, a notice of the changes will be posted along with the revised Privacy Notice. We encourage you to visit this page from time to time for the latest on our privacy practices.