Instructure Product Privacy Notice

Effective Date: August 2, 2022

To see the previous version of this policy please view here.

Introduction:

Instructure is committed to protecting the information we process by doing our best to ensure that the information is used only to support students and education. We are guided in this mission by our foundational Privacy Principles:

1. Transparency:  We will work to ensure transparent data processing in our business. 
2. Accountability: We will demonstrate our commitment to privacy in concrete and tangible ways.
3. Integrity: We will strive to ensure that the data entrusted to us is complete, consistent, and accurate.
4. Security: We will implement and maintain appropriate technical, administrative, and organizational measures to protect data in accordance with regulatory requirements.
5. Confidentiality: We will establish and maintain policies, procedures, and practices that limit access to data and protect against unlawful or unintentional access or disclosure. 

As part of our commitment to protecting the privacy of students, educators, and institutions, we are a signatory to the Student Privacy Pledge and a member of the Future of Privacy Forum.

Instructure has also earned the TrustEd Apps Data Privacy Certification Seal.

We invite you to learn more about the data practices on our platforms that enable lifelong learning.

Contents:

1. About our Users and our Products.
2. Information Collection.
3. Our Use of Your Information.
4. Disclosure of Information.
5. Children’s Privacy.
6. Your Information, Your Control.
7. Other Important Information.
8. Security of Your Personal Information.
9. Privacy Shield Program
10. Contact Information.

Instructure, Inc. and its affiliates and subsidiaries (“Instructure,” “we,” “our,” or “us”) prepared this Product Privacy Notice (“Notice”) to describe our privacy practices. This Notice governs information collected and processed by our products and services (collectively, “Products”), which are listed here: www.instructure.com/product/all-products.

1. About our Users and our Products.

How we use your information depends on our relationship with you. We primarily provide our Products to Academic Institutions, such as K-12 schools and higher education, and Corporate Edu that use our Products to amplify teaching, elevate learning, provide professional development opportunities, and improve student outcomes.

If you are an end user of an Academic Institution or Company that uses our products, it means that your institution determines how your personal information is used. This means that your institution’s privacy notice governs the use of your personal information. This privacy notice is intended to provide transparency related to our privacy practices only.

We have provided the following summary to help you understand what we do with the information we process through our Products and the relationship between our users and Products.

Users	Products	Examples
Educators and Faculty Academic Institutions Students Parents/Guardians Institution Administrators Corporate Employees	Canvas by Instructure: Canvas LMS Canvas Studio Canvas Catalog Canvas Student Pathways Canvas Student ePortfolios Canvas Network Canvas Commons	Educators provide content and instruction through Canvas LMS Educators may use Canvas LMS to provide one-on-one feedback to students or offer their students collaborative workspaces Academic Institutions may use Canvas LMS to enable, personalize, and configure how educators and students use Canvas LMS Educators and students can submit video creations with Canvas Studio Parents can view their student’s academic work in Canvas LMS
Educators and Faculty Academic Institutions Students Parents/Guardians Institution Administrators Corporate Employees	Mastery by Instructure: Mastery Connect Mastery Item Bank Mastery Item Bank Supplemental Mastery View College Prep Mastery View Formative Assessments Mastery View Interim Assessments Mastery View Predictive Assessments	Educators use Mastery Connect to assess their students and plan curriculum Academic Institutions and Educators may use standards-based items to check for understanding and evaluate student learning
Educators and Faculty Academic Institutions Students Parents/Guardians Institution Administrators Corporate Employees	Elevate by Instructure: Elevate K-12 Analytics Elevate Data Quality Elevate Data Hub Elevate Data Sync Elevate Standards	Academic Institutions may use Elevate Data Quality to ensure their data is up-to-date and accurate Academic Institutions may use Elevate K-12 Analytics to provide integrated data, so they understand what is affecting student success
Educators and Faculty Academic Institutions Students Parents/Guardians Institution Administrators Corporate Employees	Impact by Instructure	Impact may be used by Academic Institutions to drive technology adoption across a district Academic Institutions may use Impact to evaluate the impact of technology on student engagement and outcomes
Students Academic Institutions Professionals Parents/Guardians	Canvas Student ePortfolios Portfolium	Students may showcase their achievements to potential employers and fellow students, and connect with other users, such as employers, professionals, and other students Employers may search and select job candidates

2. Information Collection.

Now that you know about our Products, we want to tell you about the information our Products collect and process.

Personal Information
Information that may singly identify you, either alone or in combination with other information, such as: First and last name Gender or preferred pronouns E-mail address Academic Institution Username and password Geographic information, such as your location Profile information (such as a short bio or profile photo) Phone or mobile number Payment card information (Canvas Catalog only) Imported profile information from third-party websites if you choose to register and/or log in with credentials from these websites Information from Academic Institutions to register your profile (such as student ID number) In application messages or discussion group comments Date of birth (Portfolium, Mastery Connect and Elevate products only) Submitted content (such as research papers, class assignments) Data types described in the Ed-Fi Data Standard (Elevate products only described here: www.instructure.com/k12/products/elevate/elevate-k12-analytics) Video images and voice recordings	We collect your personal information when: You create an account for or use our Products When an Academic Institution creates an account for you in our Products You import information from third-party websites and sources, such as social media sites Others invite you to join our Products When an Academic Institution transfers information from student information systems, or other institutional systems, into our products
Product Usage Information
Information processed while using our Products, such as: Your interactions with other users, for example, messages, comments, and uploaded files Performance of the Products, such as how you use certain features Descriptions, images, hashtags, and other information associated with uploaded information How you use our Products, such as the time spent interacting with certain features and the date and time of your visits	When you use our Products, we collect information about how you use our Products
Communications and Other Interactions with Us
Any information, including personal information, you submit during your interactions with us, such as: Contact information Email content	We collect information from and about your communications and interactions with us.  For example, we collect information when you: Request assistance from our help desk Provide us with feedback on our Products Sign up for and attend a conference, webinar, or Instructure event Participate in surveys and contests Otherwise communicate or interact with us
Device Information
Information, including personal information, from and about your device, such as: Browser type, settings, and preferences Operating system Location information (e.g., Country or state) Persistent identifiers Internet Protocol (IP) address (a number that is automatically assigned to your computer when you use the Internet, which may vary from session to session) Domain name Unique device identifiers	When you use our Products on a device, like most Internet services, we automatically gather and store device information each time you use our Products
Professional Information
Information about your career and professional achievements, such as: Information required by the employer, which may contain personal information, like your resume Job descriptions and requirements	We collect this information, for example, when you apply for a job posted on Portfolium or student ePortfolios and activate an account created by your Academic Institution

3. Our Use of Your Information.

Now that you’ve learned about the information we process, let’s go over what we do with it.

Please note that if we process your personal information for a purpose other than the purpose for which it was collected, we will provide you with notice in advance of the new processing and obtain consent if required.

We limit our collection and use of your personal information only to those elements required to operate our Products, or as otherwise disclosed in this Privacy Notice. We do not engage in automatic decision making, advertising to students, or profiling.

To provide, analyze, and improve our Products. We use the information described above to provide, analyze, and improve our Products, including to:

• Create and maintain your account
• Identify you as a user
• Notate and assign support tickets
• Provide, operate, maintain, and improve our Products
• Personalize and improve your experience
• Contact you and communicate with you, including to respond to your comments or inquiries
• Provide customer support
• Solicit feedback about our Products, including by asking you to respond to surveys or questionnaires (with your permission)

Please see the “Third-Party Websites” section below for more details about sharing information with third-party websites or platforms.

De-identified or aggregate use. We may create and use de-identified or aggregate information – information removed of specific identifiers so that it cannot singly identify you (i.e., non-personal information) – for any purpose.

4. Disclosure of Information.

Now we will review how we share or disclose information, including personal information. Please note that we share information, and permit you to share information, only as described in this Privacy Notice. We do not sell or rent personal information to third parties.

4.1. Instructure’s Disclosure of Information.

Instructure may share information with the following recipients or as set forth below.

Commonly owned entities. We may share your information, including personal information, with companies under common ownership or control of Instructure, including affiliates and subsidiaries, to help provide our Products.

Third-party service providers.  We may share your personal information with authorized third-party service providers for the sole purpose of providing you with our Products.

We do not permit our third-party service providers to use personal information we share with them for their own advertising or marketing purposes, or for any other purpose other than in connection with the services they provide to Instructure. Additionally, we do not sell or rent your personal information to third parties.

As required by law. In certain circumstances, we may be required to disclose information, including personal information, in order to:

• Comply with legal or regulatory processes (such as a judicial proceeding, court order, or government inquiry)
• Enforce the Instructure Acceptable Use Policy and other applicable policies
• Respond to claims that any content violates the rights of third parties
• Protect the rights, property, or personal safety of Instructure, its employees, its users, its clients, and the public

Change of Control. We may share information about you in connection with or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or proceeding involving sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.  In the event that information is shared in this manner, notice will be posted on our website at www.instructure.com.

With your consent or at your direction. We may share information other than as described in this Privacy Notice with your consent, or at your specific direction, for example, if you choose to use the Products with social networking platforms (e.g., Facebook, YouTube, Twitter, etc.).

De-identified or aggregate use. We may share de-identified or aggregate information – information removed of specific identifiers so that it cannot singly identify you (i.e., non-personal information) – for any purpose without limitation, unless prohibited by applicable law.

4.2. Disclosure of Information through Instructure’s Products.

Our Products have features that share information (including personal information) with authorized third parties or that allow you to share information with third parties or the public. These disclosures are described below.

Academic Institutions, course providers, or parents.  We may share your personal information with the Academic Institution or company which is linked to your use of our Products. Where permitted, we may also share your information with relevant parties associated with the Academic Institution, such as educators or fellow students, or parents of students using our Products or fellow users.

For example, this would apply:

• If your Academic Institution uses our Products as a learning management platform and has given you access to the Products; or
• If you are taking a course via the Products, we will share your personal information you provided upon account registration and coursework registration with the educator and/or Academic Institution

Other Third Parties.  You may choose to share information through our Products, such as Portfolium, with other users of the Products or the public when you post content or otherwise provide information about yourself. We are not responsible for others’ use of the available information, so you should carefully consider whether and what to post or how you identify yourself.

If you use Portfolium, examples of sharing your personal information may occur when you:

• Create an account, your name and other profile information will be viewable and searchable by other users and Employer Partners (as noted above)
• Post content to Portfolium, such as videos, photos, school projects, and comments, which are displayed on Portfolium and viewable by other users by default
• Access public blogs, community forums, or the newsfeed within the Product
• Post to our public blog, which is operated by a third-party application. Our Privacy Notice does not cover the practices of these third parties, and your interactions with these third-party applications are governed by their separate privacy policies

On Portfolium, we do not make a child user’s account publicly available; only parents and Academic Institutions have access to a child user’s account. And we do not make users’ accounts or data publicly available on Canvas LMS & Mastery Connect.

With your consent or at your direction. As noted, we may share information other than as described in this Privacy Notice with your consent, or at your specific direction, for example, if you choose to use the Products with social networking platforms (e.g., Facebook, YouTube, Twitter, etc.).

5. Children’s Privacy.

For users of Canvas LMS and the Mastery suite of products, we may take steps intended to comply with the Children's Online Privacy Protection Act (“COPPA”). Please see our Children’s Online Privacy Protection Act Privacy Notice.

Except for authorized users of Canvas LMS, Canvas Studio, Canvas Student Pathways, or the suite of Mastery products, if you learn that a child under thirteen years of age has provided us with personal information, please alert us at [email protected].

6. Your Information, Your Control.

We provide you with several ways to control your information.

Parents and Academic Institutions. Parents and educators may review information collected from children, request deletion of this information, or request no further collection or use of this information by contacting us at [email protected] or submitting a help desk ticket through our Products.

Account Information. You may change some of your personal information by editing your Product profile. You may also request that we modify or delete your information by emailing us at [email protected] or submitting a help desk ticket through our Products. We will respond to your request, when permitted by law and subject to exceptions, within 30 days. We may be unable to delete information that resides in our archives.

Portfolium Account Closure.  If you wish to delete your Portfolium account, you can go to the "Privacy" tab under "Account Settings" and click "Disable Account." Once your account has been disabled, you can request deletion of your account by selecting "Permanently Delete" from the “disable” account screen.  After requesting deletion, you have fifteen days to change your mind before we cannot undo your deletion request.

Employer Communications.  Portfolium users (that are over 18 years of age) may receive private messages through Portfolium from approved employers. At any time, Portfolium users may unsubscribe from all employer-generated private messages. Portfolium users may also use the privacy settings in their account to opt out of their information being shared with employers.

Push Notifications.  If you would like to stop receiving push notifications, please use the settings on your mobile device to opt out. Please note that opting out of receiving push notifications may impact your use of our Products (such as receiving a notification that you have a new message). Please note that the opt-out process differs depending on the mobile device you are using.

Location. Some Products may collect precise location information about your mobile device, but only with your consent. If you wish to revoke permission to collect precise location information, you can change the location settings on your mobile device.

If you require access to personal information not otherwise available through any of the mechanisms described above, please contact us at [email protected] or submitting a help desk ticket through our Products.

7. Other Important Information.

Student Data Privacy Agreements.  When providing our Products to certain US Academic Institutions, we may sign a state-level Student Data Privacy Agreement (“SDPA”) with a Local Educational Agency (“LEA”). The LEAs make these SDPAs publicly available. You can access the SDPAs that we have signed with LEAs on the Student Data Privacy Consortium website located here.

Third-Party Websites.  Our Products may contain links to third-party websites or services that allow you to leave our Products and go to another website when you click on such a link. Your information, including personal information, may be collected by those separate entities. We have no control over, do not review, and cannot be responsible for these outside websites or their content.

Please be aware that the terms of this Notice do not apply to these outside websites or content, or to any collection of data after you click on links to such outside websites. The links to third-party websites or locations are for your convenience and do not signify our endorsement of such third parties or their products, content, or websites.

Google APIs.

Our use of information received from Gmail APIs will adhere to Google's Limited Use Requirements.“Our Product’s use and transfer to any other application of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.”

8. Security of Your Personal Information.

Instructure takes reasonable steps to help protect your personal information in an effort to prevent unauthorized access, use, or disclosure. You can find more details about our security program by visiting our security webpage here and reviewing our Security and Due Diligence Documents.

Despite these measures, you should know that we cannot fully eliminate security risks associated with personal information. No method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee absolute security. Any content you post or input you provide while using our Products is at your own risk.

Please be aware that the personal information we collect may be transferred to and maintained on servers or databases located outside your county, and personal information may be accessible to law enforcement and national security authorities in those jurisdictions.   

9. Privacy Shield Program

Instructure complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework (“Privacy Shield”) as set forth by the U.S. Department of Commerce. While Instructure does not presently rely on Privacy Shield as a valid transfer mechanism between the United States and the European Union (“EU”) and Switzerland, we continue to honor our commitments to which we certified to the Department of Commerce. If there is any conflict between the terms in this Notice and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield Framework, visit the U.S. Department of Commerce’s Privacy Shield List: www.privacyshield.gov/list.

Instructure is accountable for the processing of personal data it receives, under Privacy Shield, and subsequently transfers to a third party. Instructure complies with the Privacy Shield Principles for all onward transfers of personal data from the EU and Switzerland, including the onward transfer liability provisions. Instructure is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission.

Residents of the EU and Switzerland have the right to access the personal information that Instructure maintains, and in some cases, may have the right to correct or amend information that is inaccurate or has been processed in violation of Privacy Shield, to the extent allowed by law. To exercise this right, contact us at [email protected].

Residents of the EU and Switzerland with inquiries or complaints regarding this Privacy Policy should first contact Instructure as described below in the “Contact Information” section below.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at feedback-form.truste.com/watchdog/request. Under certain conditions, more fully described on the Privacy Shield website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

10. Contact Information.

Instructure welcomes your comments or questions regarding this Privacy Notice.  Please email us at [email protected], or contact us at the following address or phone number:

Instructure, Inc.
6330 S 3000 E, Suite 700
Salt Lake City, UT 84121
United States of America
+1 (801) 869-5000

Instructure Global Ltd
New Penderel House, 4th Floor
283-288 High Holborn
London, UK WC1V 7HP
0900 358 4330

To contact our Data Protection Officer, please use the following email address: [email protected].

Changes to this Privacy Notice. We may change this Privacy Notice from time to time. If we make any changes to this Notice, we will change the “Effective Date” above. If such changes are material, a notice of the changes will be posted along with the revised Privacy Notice. We encourage you to visit this page from time to time for the latest on our privacy practices.