Willow Ed Privacy Policy

1. Who we are and who this policy covers

Willow Ed, PBC, doing business as Willow Education ("Willow," "we"), provides a career readiness curriculum and web application (the "Platform") to schools, school districts and education organizations ("Schools") for use by their students and staff. Questions about this policy go to privacy@willowed.org.

Most of the personal information we hold is student education records. The School owns those records; Willow processes them on the School's behalf and under its direction. Where a School has signed a services agreement with Willow that includes a data protection addendum, that agreement governs and controls over this policy to the extent of any conflict.

2. Information we collect

Account and roster information. Name, school email address, school, grade level and role, provided by the School directly or through a rostering or sign-in service such as Clever or Google. Sign-up does not require or validate a birthdate.

What students create on the Platform. Responses to interest and strengths assessments, written reflections and portfolio content, postsecondary plans and application activity, bookmarked careers and colleges, and conversations with the Platform's AI assistant. A student may optionally use voice input, which is transcribed to text.

Optional contact details. A mobile phone number, only if a student or staff member opts in to text-message reminders.

Technical and usage data. Device and browser type, IP address, pages visited, actions taken and error reports, used to run and secure the Platform.

We do not collect Social Security numbers, government identification numbers, financial account numbers or payment card data from students or staff.

3. How we use information

We use personal information only to provide, maintain, secure and support the Platform for the School: to deliver the curriculum, personalize career and postsecondary recommendations, operate the AI assistant and its safety screening, provide reporting to the School's authorized staff, send account and task communications, provide support, and protect the Platform and its users.

Willow does not sell student data, does not use it for advertising, and does not use it to train AI models. Willow's AI providers operate under enterprise terms that prohibit training their models on Willow's data. We may create de-identified, aggregated data that cannot reasonably be linked to a student and use it to improve the Platform.

4. Artificial intelligence

The Platform includes an AI assistant, called Alma, and other AI-assisted features. This section describes how they handle student information.

AI use. Willow's AI features, including the Alma assistant, send their prompts to Anthropic, the only generative AI provider Willow uses. A prompt contains the student's first name, grade, a short summary of the student's goals relevant to the conversation, and the student's typed message. Prompts never include email, phone, address, date of birth, demographic fields, or other students' data. Alma conversations are kept for 24 months after their last activity, then deleted. Other AI features, such as reflections, exit tickets and offer-letter review, also send the student-written text or uploaded document they work on. Willow does not operate a proprietary AI model.

OpenAI. OpenAI is used only to turn reference content (career and school descriptions) and search queries into numerical search data called embeddings. It generates no content and receives no student identifiers.

Provider retention. Anthropic retains API inputs and outputs for no longer than thirty (30) days; Willow has requested a zero-day retention setting. No embeddings or other derived representations of student content are stored.

Safety screening and escalation. Every conversation is screened automatically by a dedicated safety classifier. Content that indicates a possible safety concern, including self-harm, crisis, violence, bullying or hate speech, is routed in real time to authorized staff at the student's school and district, who review it on a dedicated safety-review screen. Where a crisis is detected, the assistant responds with supportive, hotline-aware language and staff are notified. The assistant is not a substitute for a qualified adult, and the student-facing wording says so.

What the assistant can and cannot do. Alma provides information, coaching and recommendations only. It has read-only access to the information above. It cannot create, change, approve or finalize any entry in a student's academic or postsecondary record, and no decision about a student is made or determined by the assistant. It is instructed to coach a student's own writing and thinking, not to draft essays, applications or other work a student could submit as their own.

Disclosure and choice. AI features are marked on screen. Before first use, each student is shown an AI agreement describing how the assistant works and must accept it. A student who declines keeps full access to the rest of the Platform; only the assistant stays unavailable, and the student can accept later.

Logging and review. Every conversation with the assistant is logged in full and retained for twenty-four (24) months from its last activity, then permanently deleted. Flagged conversations are visible to authorized school and district staff. A School may request a student's conversation records at any time and Willow will provide them within thirty (30) days.

Where processing happens. All AI processing of student data takes place in the United States.

5. How information is shared

Willow shares student data only with the service providers listed below and in these school-directed ways: (a) Common App: once a school turns on its Common App integration, and only after a student links their Common App account and signs Common App's FERPA waiver, counselors, school administrators and the student's assigned teachers submit school reports, recommendations and related forms, which can include GPA, class rank, transcripts and letters, to the colleges on that student's Common App list; (b) counselors and school administrators can email a student's documents to a college's admissions address on file. Willow's only message to a parent or guardian is a request to sign an Early Decision agreement, sent only when the student asks. Willow also shares student data with the School itself and its authorized staff, and discloses it where the law requires.

We never sell student information, never share it for advertising, and will not transfer it in a merger, acquisition or bankruptcy except to a successor that agrees in writing to be bound by these commitments.

6. Service providers

Willow uses the following providers to operate the Platform. Each is bound by written terms no less protective of student data than Willow's own commitments to Schools, and Willow remains responsible for their handling of student data.

Student data is stored in the United States. Willow will update this list within thirty (30) days of adding or removing a provider that handles student data, and will notify Schools under the terms of their agreements.

7. FERPA and student privacy law

When Willow serves a school, Willow acts as a school official under FERPA. It uses education records only for the school's purposes and does not redisclose them without the school's written permission, except as FERPA allows. Parents and eligible students exercise their rights to inspect, amend, and consent through their school. Willow performs a service the School would otherwise perform with its own staff and acts under the School's direct control with respect to the use and maintenance of education records.

The AI providers named in Section 4 are service providers to Willow in the same sense. AI processing is part of delivering the Platform to the School; it is not a separate use, and it does not extend to training or any purpose outside the School's authorization.

Willow supports parents', guardians' and eligible students' requests made through the School and responds to a School's request for a student's records, including AI conversation records, within thirty (30) days.

Students under 13. The Platform is provided to students through their School. Where a student is under 13, the School provides consent on the parent's behalf for the collection of the student's information for educational purposes, as the Children's Online Privacy Protection Act permits, and Willow relies on that consent. Willow collects from students under 13 only the information needed to provide the Platform, and does not use it for any commercial purpose. Grade 8 access is switched off for every School unless the School's administrator turns it on.

State law. Willow's services agreements address the student privacy laws that apply to each School's state.

8. Security

Student data is encrypted in transit using TLS 1.2 or higher and at rest. Access is limited by role to the people who need it, staff and contractors with access to student data or Platform systems pass background checks and are required to complete security and privacy training, multi-factor authentication is enforced on Willow's corporate systems, and production systems are logged and monitored. Willow notifies affected Schools of a confirmed security incident involving their student data within seventy-two (72) hours.

9. Retention and deletion

Willow retains student data for the term of the School's agreement. Within thirty (30) days of a School's written request, or of the end of the agreement, Willow deletes the School's student data or returns it in a commonly used format, as the School elects, and provides written certification on request. Copies in backups are purged within ninety (90) days. AI assistant conversations are deleted twenty-four (24) months after their last activity regardless. Willow may retain de-identified data and records it is legally required to keep.

10. Access and correction

Students, parents and guardians exercise their access and correction rights through the School. School administrators and anyone with a question may also contact privacy@willowed.org, and we will respond promptly.

11. Changes to this policy

We may update this policy. We will post the updated version here with a new date and, for a material change affecting student data, notify School administrators by email at least thirty (30) days before it takes effect.

12. Contact

Willow Ed, PBC (d/b/a Willow Education), 167 Orchard Run, Cornwall, VT 05753. privacy@willowed.org.