Privacy Policy

Who this applies to

This policy covers Reasonline (“we,” “us”), used by instructors to design AI-supported learning experiences and adaptive assessments, and by students to complete them. It applies whenever you create a Reasonline account, or use Reasonline as a student to work through a Learning Experience, submit an assessment, or respond to George.

What we collect

• Instructor account data — email address, and institutional or team affiliation where applicable.
• Course and learning-design content — syllabus or course material an instructor uploads or provides, the capabilities and Learning Experiences built from it, and instructor-authored assessment tasks, rubrics, and criteria.
• Student submissions and learning activity — the artifact a student submits (text, a file, audio, or video), the student’s name and email, their work within a Learning Experience, and their timed responses to George’s questions (written, audio, or video).
• Dialogue transcripts and evidence records — the text of George’s generated questions, the student’s responses, a machine-generated transcript synced to any audio or video recording, and the resulting evidence records connected to a course capability.
• Process evidence (Reasonline AgencyThread) — when an instructor uses AgencyThread (Early Access; pilots begin January 2027), the evidence packet a student submits with their work: exported or pasted AI conversations (which can include text the AI wrote and anything the student typed into the chat), drafts, notes, sources, revision-history exports or screenshots, and a statement of any evidence that is unavailable. It also includes the resulting process report, the instructor’s settings for the assignment, and any factual correction the student submits. Students receive guidance on removing unrelated personal content before they submit.
• Learning Intelligence and Course Pulse insights — patterns and recommendations generated from the evidence above (for example, a recurring misconception across several students, or a capability with little evidence yet), always traceable back to the underlying evidence.
• Team activities — in a team challenge, a student’s own responses stay visible only to them and their instructors. Teammates see only what the activity explicitly shares: George’s summary of the team’s positions (which names each contributor and summarizes their view) and the team’s proposed decision.
• Grades — grades an instructor records are visible to the student, and sent to an institution’s LMS where one is connected, only after the instructor releases them.
• Usage and technical data — sign-in timestamps, session identifiers, and the basic technical logs needed to operate and secure the service. We also record a small set of instructor product milestones (for example, that an instructor published their first activity or requested a pilot) to understand how the product is used; these records contain no student names, submissions, or other educational records.
• Marketing request forms — if you ask about the Learn plan, Reasonline AgencyThread, or Reasonline Complete, or request a pilot (on this website or from inside the product), we collect what you enter in that form (name, email, institution, role, and the other fields on the form) and, where present, basic campaign-attribution information (referring source and landing page).

Subprocessors — who else touches this data, and why

We use a small number of subprocessors, each for a narrow, specific purpose. This list matches what we describe on our Trust & Security page.

• Supabase — hosts our application database and file storage, with row-level security enforced by the database itself so one institution’s data is isolated from another’s. Receives essentially all application data (accounts, course content, submissions, transcripts, evidence records) because it is our hosting and database provider.
• Anthropic (Claude) — powers George’s dialogue questions and evidence review in both Reasonline Learn and Reasonline Assess, and also supports Learn-side course authoring: analyzing instructor-provided course/syllabus material, extracting candidate capabilities, drafting Learning Experiences and assessments, and generating Course Pulse / Learning Intelligence insights. Receives only what a given job needs — the relevant task or course material, the student’s work where applicable, and the dialogue or evidence transcript so far.
• OpenAI — reads Reasonline AgencyThread evidence packets and writes the process report, once AgencyThread is in use. Receives the evidence packet for one assignment (text extracted from files, PDFs uploaded to OpenAI’s file service, and images) together with the published method. Requests are made with response storage turned off, and uploaded PDFs are set to expire within an hour and deleted when the evaluation finishes. OpenAI is not used by Learn or Assess.
• Vercel — hosts and serves the Reasonline web application. Application requests, including the content of what students and instructors submit, pass through Vercel’s infrastructure on their way to Reasonline’s application code.
• Deepgram — transcribes audio and video responses only. Receives the audio/video recording and returns a text transcript; used for no other purpose.
• Stripe — processes subscription payments. Receives billing and payment details directly through Stripe’s own hosted checkout; card details never reach Reasonline’s own servers.
• Resend — sends transactional email where email notifications are configured, such as confirming receipt of an Early Access or pilot request. Receives only the email address and message content needed to send that email.
• Cloudflare Turnstile — provides bot/spam protection on sign-in forms where enabled. Receives browser/device signals used only for that purpose, not academic content.

We do not sell student or instructor data, and we do not use student submissions to train AI models.

The role of the instructor and institution

For student data, the instructor — and, where applicable, their institution — is the data controller: they decide what learning experiences and assessments to run and who participates. Reasonline acts as a data processor, handling that data only to provide the service as configured, and only for as long as the account or applicable agreement requires. We are preparing a formal Data Processing Agreement, a HECVAT response, and a documented FERPA posture for institutional pilots. None of these is finalized today, and we won’t claim a compliance status until it’s real — the same standard described on our Trust & Security page.

Retention

• Account data is retained for as long as the account is active, plus a limited period afterward for reactivation and our own recordkeeping.
• Student submissions, learning activity, evidence records, and transcripts are retained for the duration of the course or term and a reasonable period afterward for instructor and institutional recordkeeping, unless a specific institutional agreement sets a different schedule.
• AgencyThread evidence packets, process reports, and corrections are kept for 365 days after the course is archived, then deleted, unless an institution’s agreement sets a shorter period. They are never used as research data without a separate consent process.
• Marketing request-form submissions are retained for as long as reasonably needed to follow up on the request.
• Deleted data is removed from active systems promptly; backups cycle out over time rather than being purged instantly, consistent with standard operational practice.

Deletion and export requests

An instructor, student, or institution can request a copy of their data, or request deletion, by contacting info@reasonline.org. We’ll confirm the request, verify identity where appropriate, and aim to act within 30 days — an institutional agreement may specify its own process and timeline instead.

For a student, Reasonline can export everything it holds tied to that student, or erase it: submissions, learning activity, dialogue, evidence records, grades, recommendations, and course enrollments. When AgencyThread is in use, the same request covers its evidence packets, stored files, process reports, and corrections. Where another student’s work depends on a shared team artifact, we’ll explain what can and cannot be removed without affecting them. Each request is logged without recording the student’s email address.

Security

Role-based access control, per-school data isolation enforced at the database level, and audit logging of sensitive administrative actions are described in more detail on our Trust & Security page. We do not currently hold a SOC 2 report or other third-party security certification.

Children’s privacy

Reasonline is intended for use by instructors and students in the context of coursework administered through an educational institution. We rely on the instructor’s and institution’s own policies and consents for the students they enroll in a course or assessment, consistent with how classroom EdTech tools typically operate.

Changes to this policy

We’ll update the date above whenever this policy changes, and for material changes we’ll take reasonable steps to notify active account holders.

Contact

Questions, deletion requests, or data-export requests: info@reasonline.org