Privacy Policy
Last updated: May 24, 2026
Lorsey AI Corporation ("Lorsey", "we", "us"), a Delaware corporation, provides a learning orchestration platform for K-12 schools. This policy explains what information we collect, how we use it, and the choices available to schools, educators, students, and families. It also describes the commitments we make when handling student information.
If a school district or school has a signed services agreement or data privacy agreement (DPA) with us, that agreement governs our handling of student data and controls over this policy to the extent of any conflict.
Our commitments on student data
We align our handling of student personal information with widely adopted student-privacy principles:
- We do not sell student personal information.
- We do not use student personal information to serve targeted advertising, and we do not build advertising profiles of students.
- We use student personal information only to provide and improve the educational service the school has asked us to deliver.
- We do not use student personal information to train third-party foundation models, and the AI provider we use processes that information under terms that do not permit using it to train their models.
- Student records belong to the school. We act on the school's behalf and under its direction, and we return or delete student data on request or when our agreement ends.
How our service is structured
Lorsey is provided to schools. The school (or district) decides which students are enrolled, which connected platforms to link, and who on staff has access.
- For student educational records, the school is the party that controls the data. Lorsey processes that data as a service provider acting on the school's behalf, consistent with the "school official" role under the Family Educational Rights and Privacy Act (FERPA).
- Students and parents reach Lorsey through links the school's staff share. Where a student enters information directly (for example, in the chat companion), we collect it on the school's behalf, for the school's educational purpose, and for no other commercial purpose.
Information we collect
Student information from connected platforms. When a school links a platform it already uses, we ingest per-student data from that platform to power the orchestration features. Depending on the platform this includes:
- Roster information: name, grade level, and class or section enrollment.
- Engagement and usage: activity, time on task, login recency, sessions.
- Mastery and performance: skill-level results, assessment scores, and progress against curriculum standards.
- Aptitude and growth data: norm-referenced scores and percentiles (for example, RIT scores and instructional-area sub-scores from NWEA MAP).
Connected platforms currently include IXL, Savvas Realize, and NWEA MAP. These are independent services operated by other companies; their own privacy policies govern your direct use of them.
Student activity inside Lorsey. When a student uses the Lorsey chat companion, we store the conversation so the student and their teacher can return to it. Teachers and parents may add notes about a student (for example, a learning preference or a context note), which we store as part of that student's profile.
Account information for staff. For teachers and administrators we store name, email address, a securely hashed password, and the organization the account belongs to.
Family contact information. A teacher or school may add a parent or guardian's email address and phone number so the school can share progress and send messages through Lorsey.
Access links. Student and parent pages are reached through a secret link (a token in the URL) that the school's staff share. The token is the access credential for that page.
Website visitors. When you visit our public marketing site
(lorsey.ai):
- If you submit the contact form, we collect the name, email, and message you provide, and use an anti-abuse check (Cloudflare Turnstile) to filter spam.
- We use analytics (Google Analytics via Google Tag Manager) and standard
server logs (such as IP address, browser type, and pages viewed) to
understand and improve the site. Our product surface (
/app/*) is not indexed and is excluded from public analytics of this kind.
How we use information
- To provide the service: unify each student's data into one view, surface what needs attention, generate guidance, and power the student chat companion.
- To generate plain-language summaries and message drafts for teachers and families using AI (see below).
- To authenticate staff and secure access.
- To communicate with the school, respond to support requests, and send service or transactional messages.
- To maintain, secure, debug, and improve the platform.
- To comply with legal obligations.
We do not use student personal information for any purpose beyond providing and improving the educational service to the school, except as required by law or expressly authorized by the school.
Artificial intelligence processing
Some features use a third-party AI provider (OpenAI) to turn a student's data into useful output: short narratives for teachers, draft messages for families, small-group materials, and the student chat companion.
- Relevant profile and activity data is sent to the AI provider only to generate that output for the school.
- The AI provider processes this data under terms that do not permit using it to train their models.
- We do not use student personal information to train our own or any third party's AI models.
- AI-generated output is assistive and may contain errors. It is intended to support educator judgment, not to replace it.
Service providers and subprocessors
We share information with vendors who process it on our behalf, under contracts that limit their use to providing services to us:
| Provider | Purpose |
|---|---|
| DigitalOcean | Application hosting and database |
| OpenAI | AI generation (narratives, drafts, chat) |
| Postmark | Transactional and notification email |
| Sentry | Error monitoring (production) |
| Cloudflare | Anti-abuse check on the public contact form |
| Google Analytics | Marketing-site analytics only |
We may update this list as our infrastructure evolves; material changes affecting student data will be handled consistent with our school agreements.
How we disclose information
We do not sell personal information. We disclose information only:
- to the service providers listed above, under contract;
- to the school that owns the student records, and to people the school authorizes;
- when required by law, legal process, or to protect rights, safety, and the security of the service; and
- in connection with a business transfer, subject to the commitments in this policy and our school agreements.
Data retention and deletion
We retain student data for as long as needed to provide the service to the school, and then return or delete it at the school's direction or when our agreement ends, typically within 30 days, subject to any legal retention requirements. A school may request access to, correction of, or deletion of student data it controls by contacting us, and we will respond within a reasonable period.
Security
We use technical and organizational safeguards including encryption in transit and at rest, hashed account passwords, access controls scoped per organization, and append-only audit records for sensitive data. No method of transmission or storage is perfectly secure, but we work to protect information consistent with its sensitivity.
If we become aware of a security breach affecting student or other personal information, we will notify the affected school without undue delay and cooperate with the school's response.
Children's privacy
The platform is intended for use by schools, not for direct sign-up by children. Where the Children's Online Privacy Protection Act (COPPA) applies, the school provides any required consent on behalf of parents for the school-authorized educational use of the service, consistent with guidance permitting schools to consent in the educational context. We collect personal information from students only to provide the educational service to the school.
FERPA
We handle student education records consistent with the FERPA "school official" exception: we perform an institutional service the school would otherwise perform, we are under the school's direct control as to the use and maintenance of education records, and we use those records only for the authorized purpose and do not redisclose them except as permitted.
State student-privacy laws
For schools in states with student-privacy statutes (for example, California's Student Online Personal Information Protection Act, SOPIPA), we commit not to sell student information, not to use it for targeted advertising, not to build non-educational profiles, and to maintain reasonable security, consistent with those laws.
Rights of parents and eligible students
Because the school controls student education records, parents and eligible students should direct requests to access, review, correct, or delete those records to the school. We support schools in fulfilling those requests.
Where we operate
Lorsey is operated in the United States and intended for use by US schools. If you access the service from outside the United States, you do so on your own initiative.
Cookies and tracking
On our public marketing site we use cookies and similar technologies:
Google Tag Manager and Google Analytics to measure site usage, and
Cloudflare Turnstile to protect the contact form from abuse. You can
control cookies through your browser settings. Our product surface
(/app/*) does not run these marketing analytics.
California residents
Student personal information we handle for schools is governed by FERPA and the student-privacy commitments above, rather than treated as consumer data. For other personal information about California residents that we may handle (for example, website visitors, school staff, or family contacts), the California Consumer Privacy Act may provide rights to know, delete, correct, and to opt out of the sale or sharing of personal information. We do not sell personal information. To make a request, email [email protected].
Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify the schools we work with.
Contact us
Questions about this policy or our data practices:
- Email: [email protected]
- Lorsey AI Corporation, a Delaware corporation
- 305 E Huntland Dr, 5th Floor #3047, Austin, TX 78752
See also our Terms of Service.