Education Services Privacy Policy

Last Updated: February 5, 2026

At Building 21 (“Building 21,” “we,” “our,” or “us”), we recognize that privacy is important. This Privacy Policy describes the types of personal information we collect and process when you use Building 21’s education-related applications and websites, including Beacon Learning and any other Building 21 platform or software offered to schools and districts (collectively, the “Education Services”).

This Privacy Policy also describes how we collect and use information from Students (“Student Users”) who are enrolled in schools or districts that use the Education Services (“Partner Schools”), and Teachers, employees, officials, or agents of Partner Schools (“Licensed Users”).

Student Users and Licensed Users are collectively referred to as “Users.”

This Privacy Policy does not apply to our public, informational website (the “Informational Website”), which is covered by a separate website privacy policy.

Building 21 does not place ads in its Education Services.

Building 21 does not use personal information collected through the Education Services for advertising, including behaviorally targeted advertising.

Building 21 does not sell, rent, or lease personal information of Student Users or other Users.

Plain-language summaries are included for clarity. These summaries are explanatory only and do not alter the meaning of this Privacy Policy.

Key points to understand about this Privacy Policy include:

Privacy by design: Privacy and security are considered in how we build and operate the Education Services.

Data minimization: We seek to collect only the information reasonably necessary to provide the Education Services.

No selling of student data: Student User information is not sold or rented.

Educational purpose only: Student User information is used solely to provide school-authorized educational services, consistent with our agreements and applicable law.

School control: Partner Schools control configuration, access, and administrative functions for Student Users.
COPPA and FERPA alignment: Our practices are designed to support Partner Schools’ compliance with COPPA and FERPA.

Trusted vendors only: Service providers are vetted and bound by contractual privacy and security obligations.

Notice of changes: Partner Schools are notified of material changes to this policy.

In sum, the Education Services are designed for learning and reporting, not advertising, and information collection and sharing are limited to what schools need.

School-authorized use
The Education Services are provided to Partner Schools under a written services agreement (the “Agreement”). Student User accounts are typically created and managed by Partner Schools or their authorized educators. Student use of the Education Services is for school-authorized educational purposes.

COPPA educational consent
Where applicable (including for Student Users under 13), Building 21 relies on Partner Schools to provide consent on behalf of parents or guardians. Such consent applies only to school-authorized educational purposes, consistent with COPPA and related guidance.

User accounts
Accounts are personal to the registered User. Requests for access due to incapacity, death, or similar circumstances will be handled consistent with applicable law and the Agreement, and may require appropriate legal documentation.

In sum, schools authorize use of the platform and handle student consent when required.

Building 21 provides the Education Services directly to Partner Schools for educational purposes. We collect and use information only as needed to: a) provide and operate the Education Services, b) secure and maintain the platform, and c) comply with applicable law.

This use is governed by: The agreement with the Partner School, this Privacy Policy, and applicable privacy and student data protection laws.

For Student Users, “personal information” includes information that can identify a student directly or indirectly, including: a) education records or personally identifiable information under FERPA, and b) personal information under COPPA, where applicable.

In sum, student-identifying information is treated as sensitive and protected accordingly.

We collect the following categories of information: a) information provided to us (often by Partner Schools or Licensed Users), b) information collected automatically, and c) information received from third parties where necessary for integrations or operation.

4.1 Information Provided to Us
Partner Schools or Licensed Users may provide, or direct others to provide, information such as:
*Student or staff name,
*School email address (for Licensed Users; and for students only if the Partner School uses student email),
*Student ID or SIS identifier
*Grade level, cohort, homeroom or advisory, course or competency enrollment,
*Learning artifacts uploaded to the platform (for example, documents or images),
*Feedback, rubric ratings, progress indicators, and
*Communications within the platform, if enabled.

In addition, depending on the configuration of the Education Services and the scope of the applicable Agreement and any Data Privacy Addendum (DPA), Partner Schools may choose to provide or integrate additional categories of student data, such as attendance records, behavioral indicators, demographic information, or other education records, solely for school-authorized educational purposes.

We seek to collect and process only the information reasonably necessary to provision accounts and deliver the Education Services, as configured by the Partner School and permitted under applicable law and contractual agreements.

4.2 Information Collected Automatically
We may collect:
*IP address and general location information derived from IP address,
*Browser type, device type, and operating system,
*Login timestamps, activity logs, pages viewed, and feature usage, and
*Error logs and diagnostic data.

This information supports platform reliability, security, analytics, and continuous improvement of the Education Services.

4.3 Tracking Technologies (Education Services)
Cookies, local storage, and similar technologies are used for essential functions such as login, authentication, and session integrity, as well as for analytics and platform improvement.

Building 21 uses analytics and user experience tools, including Google Analytics and Hotjar, within the Education Services to understand how features are used, identify technical issues, and improve usability and performance.

Important limitations and safeguards apply:
*Analytics tools are used only for operational, reliability, and improvement purposes.
*Student User data is not used for advertising, behavioral targeting, or marketing.
*Building 21 does not use cross-site tracking technologies to monitor Student Users across unaffiliated websites, services, or applications.
*Analytics tools are configured to minimize data collection and are not intended to capture Student Users’ typed responses, student work, assessment content, or other education records.
*Where session replay or similar functionality is enabled, it is configured to support platform reliability and improvement and is not used to monitor individual Student Users. Session replay functionality, where enabled, is limited to licensed adult users and technical workflows, excludes Student Users, and is configured to mask inputs and content so that student work, typed responses, and education records are not captured or replayed.

Partner Schools may request additional information about analytics configurations and safeguards applicable to the Education Services.

4.4 Third-Party Integrations and SSO
If a Partner School uses third-party authentication or rostering tools (for example: Google Workspace for Education, Microsoft, Clever, ClassLink, or OneRoster or SIS integrations), Building 21 may receive limited information necessary to create and manage accounts and access, as configured by the Partner School.

4.5 Information We Do Not Intend to Collect
We do not intentionally collect or require:
*Precise geolocation (GPS),
*Biometric identifiers, or
*Sensitive government identifiers (such as Social Security numbers).

If such data is discovered, we take reasonable steps to delete, restrict, or address it with the Partner School.

Building 21 does not own Student User data; Partner Schools retain ownership and control of student records, subject to applicable law and our agreements. Student User data handling following termination is governed by the applicable Agreement and any Data Privacy Addendum, including provisions related to retention, deletion, or return of data.

Building 21 may use limited personal information from adult users, such as educators or school leaders, to communicate about our programs, services, events, or offerings, in accordance with applicable law. We do not use Student User data for marketing or advertising purposes.

Personal information is used to:
*Provide, maintain, and secure the Education Services
*Create and manage accounts and permissions
*Deliver reporting and progress-monitoring tools
*Provide customer support
*Improve functionality, usability, and security
*Comply with legal obligations and enforce agreements

We may anonymize or de-identify information so it cannot reasonably identify an individual and use it for service improvement and internal reporting.

What we do not do
We do not:
*Place ads in the Education Services,
*Use Student User personal information for marketing,
*Sell, rent, or lease Student User personal information,
*Allow service providers to use Student User data for their own advertising or marketing, or
*Build commercial profiles of Student Users unrelated to school purposes.

Personal information is shared only in limited circumstances, including:
*With Partner Schools and authorized users as part of the Education Services,
*With service providers supporting platform operations under confidentiality and security obligations,
*With authentication or rostering providers at the direction of the Partner School,
*For legal compliance and safety purposes, and
*In connection with rare business transfers, subject to continued protection of student data.

Aggregated or de-identified information that does not identify individuals may also be shared. Building 21 does not sell personal information.

Subprocessors
Information about service providers (“subprocessors”) is addressed through the Agreement and any Data Privacy Addendum (DPA). Where required by contract, Building 21 will provide subprocessor information and related notices.

Building 21 uses certain third-party service providers to support operation of the Education Services. These providers act solely as subprocessors under contract with Building 21 and are prohibited from using Education Services data for their own purposes, including advertising, profiling, or cross-service tracking. These subprocessors currently include:
*Google Analytics, which is used to support aggregated, non-advertising analytics related to platform performance and usage, and
*HubSpot, which is used within the Education Services to provide an on-site chatbot and searchable knowledge center for technical support and informational purposes. HubSpot is used solely to help users find support resources or submit support requests. If a user chooses to submit a request, they may voluntarily provide contact information, such as an email address, so that Building 21 can respond. HubSpot may process limited technical and interaction data (such as IP address, device information, timestamps, and chatbot interactions) only as necessary to operate the support tools, maintain service functionality, and improve user experience.

Building 21 does not permit subprocessors to use Education Services data for advertising, marketing, or unrelated commercial purposes.

Additional subprocessors, if any, are governed by the Agreement and any applicable Data Privacy Addendum, which may include notice and objection rights for Partner Schools.

Partner Schools may request deletion or de-identification of Student User data. Requests are typically made by the Partner School; parents or guardians should coordinate through the school. Unless otherwise required by law, the Agreement, or a DPA, data will be deleted or de-identified within 60 days of a verified request.

Personal information is retained only as long as necessary to provide the Education Services and meet legal and contractual obligations. Upon termination or deletion request, data is deleted, disposed of, or de-identified within 60 days unless: a) a different period is requested by the Partner School, or b) Retention is required by law or for security or audit purposes consistent with the Agreement.

Administrative, technical, and physical safeguards are maintained to protect personal information. Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. Security incidents affecting personal information will be addressed and communicated as required by law and applicable agreements.

This Privacy Policy may be updated from time to time. Material changes will be communicated through the Education Services and/or to Partner Schools. Continued use after the effective date constitutes acceptance of the updated policy.

Licensed Users may receive operational communications such as invitations, password resets, and service notices. Building 21 does not send marketing communications to Student Users. Licensed Users may receive optional service-related communications, which include an unsubscribe option.

FERPA
The Education Services are designed to support Partner Schools’ compliance with FERPA. Partner Schools control access to education records. Requests to access or amend records should be directed to the Partner School.

COPPA
Where COPPA applies, Building 21 relies on Partner Schools to provide consent for collection and use of student information for school-authorized educational purposes only.

Partner Schools may be subject to state student data privacy laws (for example, California SOPIPA, Colorado, Connecticut, Illinois, and New York Education Law 2-d). Building 21 complies with applicable state requirements to the extent they apply to our role and services, typically through the Agreement and any DPA. This Privacy Policy does not replace a DPA. DPAs commonly address:

*Breach notification timelines,
*Subprocessor lists and notices,
*Data location,
*Security standards,
*Deletion windows, and
*Restrictions on secondary use.

The Education Services are hosted and operated in the United States. Information may be transferred to and processed in the U.S., where data protection laws may differ.

Building 21
Email: info@b-21.org
Mailing Address:
Building 21
600 West Germantown Pike, Ste 400-144
Plymouth Meeting, PA 19462 USA