Privacy Policy

1. Introduction

Blacklink, Inc. ("Blacklink," "we," "us") builds tools for classrooms. This Privacy Policy explains what information we collect through our platform and websites, why we collect it, who we share it with, and the choices you have. It applies to BellRinger, Stickies, and any other Blacklink product that links to this policy.

2. Information We Collect

Account information

• Identity: name, email address, school or district affiliation, and grade level, if applicable
• Authentication: login credentials, authentication tokens, and identity data handled through Blacklink's authentication system or an approved school identity provider (see Section 4)
• Profile: display name, preferences, and profile picture, if you add one

Educational data

• Learning activity: assignments completed, quiz scores, and time spent on activities
• Content you create: notes, projects, bookmarks, and other material you add to the platform
• Usage patterns: which features are used and how, so we can find broken or confusing parts of the product

Technical data

• Device and connection: browser type, operating system, device type, and IP address, used for security, fraud prevention, and keeping the service running
• Usage logs: pages visited, features used, and session duration
• Cookies and local storage: authentication tokens, preferences, and session data — see Section 10 for the full list, including advertising cookies

3. How We Use Your Information

To run the platform

• Provide learning content and features, and personalize them to your grade level or role
• Track academic progress and generate reports for teachers, students, and parents
• Support collaboration between classmates and educators
• Respond to support requests

To improve the platform

• Analyze usage patterns to fix problems and prioritize new features
• Test new functionality with beta and alpha users
• Detect, investigate, and prevent security incidents or misuse
• Conduct research on educational technology, using anonymized or aggregated data only

We do not use student educational data to build advertising profiles, and we do not use it for any purpose unrelated to providing the service, without separate, explicit consent.

4. Authentication and Security

Centralized authentication

Blacklink uses a single sign-on system hosted at auth.blacklink.net across all of our products. When you log in:

• We issue a signed JSON Web Token (JWT) to authenticate your session
• Your password is never stored by individual Blacklink products — only by the central authentication service
• Tokens are encrypted in transit and expire automatically
• We support SSO with approved school identity providers (e.g., Google Workspace for Education, Clever)

Data security measures

• Data is encrypted in transit (TLS) and at rest
• Regular security reviews and vulnerability scanning
• Role-based access controls limit which employees can see personal information, and access is logged
• Infrastructure is hosted with providers that maintain independently audited physical and network security controls

No system is 100% secure. If we learn of a breach affecting your personal information, we'll notify you as described in Section 12.

5. Information Sharing and Disclosure

Within your school

• Teachers and administrators can access student progress and records as authorized by the school
• Parents and guardians can access their child's records and progress reports on request through their school
• District-approved partners may receive data only under a written data-sharing agreement approved by the district

Service providers

We share data with vendors who help us operate the platform, each bound by a contract limiting use of the data to the service they provide:

• Cloud hosting and storage: for running the platform and backups
• Analytics: to understand product usage, using aggregated or de-identified data wherever possible
• Advertising (non-student surfaces only): Google AdSense, as described in Section 10

Legal requirements

We may disclose information if required by law — for example, in response to a valid subpoena, court order, or to protect the safety of our users or the public. Where legally permitted, we'll attempt to notify the affected school or account holder before disclosing.

6. Children's Privacy (COPPA)

Users under 13

• We collect only the personal information necessary for the educational purpose of the product
• Where COPPA requires parental consent, we obtain it directly, or the school provides consent on parents' behalf for use in an educational context, as COPPA permits
• Parents can review, correct, or request deletion of their child's information at any time by contacting [email protected] or their school
• Children cannot make personal information public through the platform

School authorization

When a school deploys Blacklink for classroom use, the school may act as the parent's agent for consent purposes for that educational use, consistent with COPPA and FTC guidance. Schools remain responsible for evaluating whether Blacklink is appropriate for their students.

Advertising and children

We do not run personalized or interest-based advertising to any user we know is under 13, and we do not run advertising at all inside logged-in student experiences. Where advertising appears elsewhere on our marketing site, see Section 10 for details and how to control it.

7. Educational Records (FERPA)

• Student educational records created in Blacklink are maintained on behalf of the school district, which retains ownership and control of those records
• Blacklink acts as a "school official" with a legitimate educational interest, under FERPA's school-official exception, and uses student data only for the purposes the district authorizes
• We do not use FERPA-protected records for any purpose outside that authorization, including advertising
• Parents and eligible students (18+) have the right to request access to, and correction of, educational records — start by contacting your school, which can loop us in

8. Data Retention and Deletion

How long we keep data

• Account data: kept while the account is active, plus 30 days after closure to allow for reactivation
• Educational records: kept according to the school district's data retention policy, or as required by law
• Beta/alpha diagnostic data: kept up to 2 years, or until the product reaches stable release, whichever comes first
• Anonymized analytics: may be kept indefinitely, since it can no longer be tied back to an individual

Requesting deletion

• Individual users can request deletion of their personal data at any time
• School districts can request deletion of all associated student data when their contract ends
• We complete valid deletion requests within 30 days
• We may retain limited data where required by law, or where needed to resolve disputes or enforce our agreements

9. Your Rights and Choices

Access and control

• Access: request a copy of the personal information we hold about you
• Correction: ask us to fix inaccurate information
• Deletion: ask us to delete your data, subject to the limits in Section 8
• Portability: request your data in a commonly used, portable format

Where a state privacy law (such as California's CCPA/CPRA) grants additional rights — like opting out of the "sale" or "sharing" of personal information, as those terms are defined by that law — you can exercise them by contacting [email protected]. We don't sell personal data as described in plain terms in Section 5.

Communication preferences

• Turn off non-essential notifications from your account settings
• Control cookies through your browser settings — see Section 10

Marketing emails

We occasionally email about product updates, and may pass along opportunities from partners we think are relevant to educators and schools. Every marketing email includes an unsubscribe link; using it removes you from future marketing messages within a few days. Opting out doesn't affect account, security, or billing emails, which aren't marketing.

10. Cookies, Tracking & Advertising

Cookies we use

• Essential: required for login and core functionality — the platform doesn't work without these, so they can't be turned off while using the product
• Functional: remember your preferences and settings
• Analytics: help us understand how the platform is used, in aggregate

Local storage

We use browser local storage to keep you signed in and remember preferences across sessions, without needing to store that information as a traditional cookie.

Managing cookies

Most browsers let you block or delete cookies in settings. Blocking essential cookies will prevent you from logging in; blocking functional or analytics cookies won't.

11. International Data Transfers

Blacklink is designed primarily for U.S. schools, and our infrastructure is hosted in the United States. If you access the platform from outside the U.S., your information will be processed and stored in the U.S. Where we do transfer data internationally, we use safeguards such as standard contractual clauses, and we require any vendor handling that data to meet a comparable standard of protection.

12. Data Breach Notification

If we discover a security incident that compromises personal information, we will:

• Investigate and contain the incident promptly
• Notify affected school districts and, where legally required, affected individuals, without undue delay
• Describe what happened, what data was involved, and what steps we and you can take
• Comply with any state or federal breach-notification timelines that apply

13. Changes to This Privacy Policy

We may update this policy as our practices or applicable laws change. When we make a material change, we will:

• Post the updated policy on this page and update the effective date above
• Notify users by email or an in-product notice
• Seek new parental or school consent where a change affects children's data and consent is legally required

We keep prior versions available — see the link at the top of this page.