SpecialNeedsWare, Inc. dba Ori Learning · Version v2026.09 · Effective September 23, 2026
For students: the short version
Your school gave you your Ori Learning account, and your school and Ori Learning have an agreement about your information. Ori Learning keeps your name, your school and class details, your answers and work, including answers you record or speak, your progress, and some facts about your device. It uses them to give you your lessons, show your teachers how you are doing and keep the platform working and safe. Your teachers and school can see your work. On a class board, classmates in the same session can see your posts. Some companies help Ori Learning run the platform. Ori Learning does not sell your information, use it to show you ads or use it to train artificial intelligence. Questions? Ask your teacher or your school. Ori Learning is not an emergency service: if you are hurt or scared, tell an adult you trust right away.
About this notice
This notice explains how SpecialNeedsWare, Inc. dba Ori Learning (“Ori Learning”, “we”, “us”) handles information about the people who use the Ori Learning Platform at app.orilearning.com and login.orilearning.com. It is written for Parents, Students and schools, and it is our online notice under the Children’s Online Privacy Protection Act (COPPA) rule, 16 C.F.R. Part 312. We link this notice from the Student Portal’s landing screen and from each place where the Platform collects Personal Information from a Student.
Schools, districts and other educational organizations that have an agreement with us (each, “the school”) provide the Platform to their Students and decide how it is used. The school’s agreement, including our Data Privacy Addendum (orilearning.com/legal/data-privacy-addendum/) or a data privacy agreement the school has signed, may add to this notice and never reduces it. Our marketing website is covered by the Website Privacy Notice. For the Platform, this notice replaces the Privacy Policy previously posted at orilearning.com/privacy-policy/, including under its former names.
Terms we use. A Student is a person a school enrolls and gives a Platform account, whatever the person’s age. A Parent is a parent or legal guardian, or a person acting as a parent in their absence; for a request under the COPPA rule, it means a parent or legal guardian. Student Data is information about a Student that we hold for a school, including what the Student creates. The School-Authorized Educational Purpose is providing the Platform for the educational use the school has authorized, and no commercial purpose of our own. Other capitalized terms are defined in the Ori Learning Definitions at orilearning.com/legal/definitions/.
How we work with schools
Schools create Student accounts, by bulk import, a roster integration or manual roster management; Students do not register themselves, and there are no Parent accounts. Where the Family Educational Rights and Privacy Act (FERPA) applies, the school designates us as a school official with a legitimate educational interest under 34 C.F.R. §99.31(a)(1)(i)(B), under its direct control: we process Student Data only on the school’s documented instructions, use it only for the purposes for which the school disclosed it, and do not redisclose it except as the school’s agreement permits. Where FERPA does not apply to a school, we give the same commitments by contract.
Information we collect
The school decides which roster information to supply; the rest is generated as the Platform is used. About Students we collect:
- Identity and account: name; the identifier the Platform assigns; username; password, stored only as a hash; any identifier from a roster or sign-in service the school elects; and an email address, where the school supplies one.
- Enrollment: school, grade level, teachers, guidance counselor, curriculum program and courses, and, where the school supplies one, an indicator that the Student has an individualized education program (IEP) or Section 504 plan, never the plan itself.
- Learning activity: responses to assessments, surveys and check-ins; grades and scores; and answers and work a Student types, uploads or records, including by speaking.
- Collaboration Board posts, visible to classmates in the same session, and likes.
- Technology and use information: IP address; cookies and similar identifiers; device, browser and general location information; lessons and sessions started and completed; and error and performance data.
We collect no date of birth, and we do not request a Student’s race, gender, home language, health, financial or Social Security information, state or local student identification numbers, or any information about a Parent. Answers to check-ins and reflections may reveal a Student’s feelings or circumstances; we treat them as Student Data. We design our Curriculum Content not to ask Students to reveal information in the categories the Protection of Pupil Rights Amendment protects (20 U.S.C. §1232h(b)); a school that believes an item does may ask us to review it, and at its direction we remove the item from its assignments. For teachers and administrators we hold name, email address, school, any telephone number supplied, role and the same technology and use information. Annex A (Data Schedule) to our Data Privacy Addendum lists the elements in detail, and we update it and this notice when the Platform changes what it collects.
How we use information
We use Student Data only for the School-Authorized Educational Purpose and as the school’s agreement authorizes: to provide the Platform, its Curriculum Content, assessments, check-ins and Collaboration Boards as the school configures them, adapting instruction where a product provides it; to record and report Students’ work and progress to the Student and the school; to support the school and its users; to operate, secure and repair the Platform, including error monitoring and product-usage analytics; to comply with law; and for other purposes within the School-Authorized Educational Purpose that the school directs in writing. We improve the Platform only with De-identified Data and Aggregate Data, which we never re-identify or publish in a form that names a school without its written approval.
Our commitments. We do not, and do not permit any Subprocessor or other recipient to: sell, rent or trade Student Data; use Student Data or Persistent Identifiers for Targeted Advertising; build a profile of a Student for any purpose other than the School-Authorized Educational Purpose; market to Students or Parents; or use Student Data for any other commercial purpose. We place no advertising in the Platform. We do not use Student Data to train, develop or improve an artificial-intelligence or machine-learning model, and we do not authorize any Subprocessor or other recipient to do so.
Artificial intelligence. The Platform has no generative artificial-intelligence feature, chatbot, tutor or automated grading by a language model; its read-aloud and translation services only read aloud or translate what the Platform sends them. We will not enable a new feature that processes Student Data with artificial intelligence without first notifying the school and, where the feature materially changes how we collect, use or disclose Student Data, obtaining the school’s renewed authorization.
Collaboration Boards and who can see Student work
When a teacher turns on a Collaboration Board in a live session, Students can post text, colors and images that classmates in the same session can see and like. Moderation is a setting the teacher enables for a session; when it is enabled, the teacher approves each post before classmates see it. A teacher may remove a post or have it removed. A board exists only inside the school’s licensed environment, so a Student cannot use it to make information available to the public. Other Student work is visible to the Student and to the school’s teachers and staff as the school’s configuration allows. Our own staff look at Student work only as their duties require. We do not routinely or proactively review Student work or posts and have no duty to; our staff may come across them incidentally, for example in support, administration and the handling of reports. We claim no ownership of what a Student creates.
Cookies and similar technologies
The Platform uses cookies and similar identifiers, including in the Student Portal, only to run and secure the Platform, fix errors, understand its use and support the school. Platform pages load fonts and similar resources from the providers listed in Part B of the Subprocessor Schedule (orilearning.com/legal/subprocessors/), which receive the network information a browser sends with any web request; we use these services only in compliance with the law. We do not respond to Do Not Track browser signals, for which there is no common standard.
Who receives information
We disclose Student Data only to: the school’s own staff, and classmates in the same session on a Collaboration Board; the Subprocessors below; the services that receive network information when a Platform page loads, described under “Cookies and similar technologies”; the roster and sign-in services the school elects, such as Clever, ClassLink, Google or Microsoft sign-in; others the school directs in writing; a successor to our business, only after it assumes our Data Privacy Addendum in writing (such a transfer is not a sale); and authorities and others only as the law requires or permits, as described below.
| Subprocessor | What it does |
|---|---|
| Microsoft Corporation (Azure) | Hosting and storage; application logs; live-session transport |
| Google LLC | Translation and read-aloud of lesson text, and translation of any Student-written text the Platform sends for translation |
| Amplitude, Inc. | Product analytics and in-product reports; for Students, usage events under a pseudonymous identifier, never a Student’s name, username or contact details |
| ChurnZero, Inc. | Customer success; for Students, usage events under a pseudonymous identifier, never a Student’s name, username or contact details |
| TrackJS, LLC (Request Metrics) | Error and performance monitoring |
| Twilio Inc. (SendGrid) | Transactional email, including to a Student’s email address where supplied |
| HubSpot, Inc. | Support chat for educators, which never loads in the Student Portal |
We evaluate each Subprocessor before it receives Student Data, and our Subprocessors work under written terms that require them to protect it consistent with our commitments and limit their use to providing their services to us; we do not authorize any of them to use it to train artificial-intelligence models. Our Subprocessor page (orilearning.com/legal/subprocessors/, Exhibit 2 to our Data Privacy Addendum) states for each the data it receives. It lists the recipients we have identified; we keep it current and notify the school’s privacy and security contact by email of changes to it. A school that objects to a change on reasonable grounds relating to the protection of Student Data may end the affected Services on written notice and receive a refund of prepaid Fees for the remainder of the Subscription Term.
Children under 13
We are the operator of the Platform under COPPA, and nothing in a school’s agreement transfers, waives or limits our duties under the rule. Consistent with the Federal Trade Commission’s guidance on educational technology in schools, the school authorizes us, in place of Parents and in the school context, to collect Personal Information from its Students for the School-Authorized Educational Purpose and for no other purpose; any other use would need a Parent’s verifiable consent, which we do not seek through the Platform. Because we collect no date of birth, we protect every Student this way, whatever the Student’s age: we collect no more Personal Information than is reasonably necessary for the School-Authorized Educational Purpose, and we do not condition a Student’s participation in an activity on disclosing more than it reasonably needs.
Parents’ rights. A Parent of a Student under 13 may ask us directly to review the Personal Information collected from the Student, to Delete it, or to refuse further collection or use. Email [email protected] or write to the address under “Contact us”, giving your child’s name and school and your relationship to the child. We acknowledge the request within 5 Business Days, verify your identity and authority by a method reasonably designed for that purpose, which may include the school’s confirmation, tell the school, and answer a verified request within 30 days after we receive it, at no charge. If you refuse further collection or use, then once your request is verified we stop collecting and using your child’s Personal Information, complete any Deletion your refusal requires and, within 10 Business Days, disable your child’s account, so your child can no longer use the Platform; the school chooses among the available arrangements that collect nothing further from your child. The school’s authorization does not extinguish these rights. Requests about Students 13 or older go through the school.
How long we keep information
We keep Student Data only as long as reasonably necessary for the purposes above and the school’s instructions, and never indefinitely. Our written retention policy for children’s Personal Information is Section 12 of our Data Privacy Addendum with the Retention & Deletion Schedule (orilearning.com/legal/retention/), which states for each category of data its purpose, business need, retention period and the event that ends it. In summary:
| Information | Purpose and business need | How long |
|---|---|---|
| Student accounts, roster data, responses, work, progress, board posts and account-linked usage data | Providing the Platform and reporting progress to the school during its subscription and export window | The Subscription Term and the 60-day Export Window after the Services end, then Deleted within 30 days after the school confirms its export or the window closes, and no later than 90 days after the Services end. Sooner: within 30 days after the school’s written request, within 90 days after the school tells us a Student has left, or on a verified request from the Parent of a Student under 13 |
| Operational logs, and data at our analytics, customer-success and error-monitoring Subprocessors | Operating, securing and supporting the Platform | The periods the Schedule states; Deleted at each Subprocessor on our instruction at the end of the Subscription Term and on the school’s request |
| De-identified Data and Aggregate Data | Improving the Platform; reporting to the school | May be kept after the underlying Student Data is Deleted |
These periods yield to a school’s renewal or written instruction, and data is kept longer only under a Legal Hold, including a school’s written preservation direction, or to preserve material for a report the law requires. Deletion removes the live records from the Platform, and we instruct each Subprocessor holding the data to Delete it. A Deleted record persists in a Backup, which Azure states it encrypts, until the backup rotation overwrites it after a limited period.
Security
We maintain a written information security program, as the COPPA rule requires, coordinated by our Chief Technology Officer as Security Officer and described in our Security Overview (orilearning.com/legal/security/). The Platform is hosted on Microsoft Azure, and Student Data held in the Platform is stored at rest in the United States. The Platform is designed and configured to limit access by role and by the school’s organization, schools and classes, and our staff access production data only for their duties. Every connection to the Platform uses HTTPS, and Azure encrypts every production data store at rest, including the Platform’s database and file storage. If a security incident affects a school’s Student Data, we notify the school as its agreement provides and help with any notice the law requires; the school decides whether and how Parents and Students are told, unless a law places that duty on us. No system is completely secure.
Your choices and rights
Through the school. The school holds Student records and the authority to answer questions about them. A Parent, a Student, or an Eligible Student (a Student to whom a Parent’s rights have passed by law, for example under FERPA at 18 or on attending a postsecondary institution) who wants to see, correct, export or delete Student Data asks the school, which acts through its own tools or directs us. A request that reaches us is acknowledged within 5 Business Days and referred to the school. We complete a request the school directs within 30 days, or sooner where the law requires, with no fee for the help the law ordinarily requires, and release nothing to a requester we cannot verify.
Directly with us. A Parent of a Student under 13 may come to us directly, as “Children under 13” explains. Where a state law gives a Parent, Student or Eligible Student a right to ask us directly, we honor the request after verification and tell the school. A Student may ask a teacher, the school or us to remove content the Student posted; removal may not erase every copy, such as one in a Backup or one another user has copied. For New York educational agencies, our New York package is at orilearning.com/legal/new-york/.
Teachers, administrators and independent educators
Information about an educator whose account a school provides is the school’s Customer Data, governed by the school’s agreement; ask your Administrator, or write to us and we will refer your request. If you created an account for yourself as an independent educator, Section 6 of the Authorized User Terms describes how we handle your information, and you may ask us at [email protected] to access, correct or delete it. An independent educator’s account may not be used to add a Student or Student Data: a Student’s information belongs in the Platform only under an agreement between the Student’s school and Ori Learning that covers that Student, and only in an account the school’s authorization actually reaches.
Emergencies, legal requests and required reports
We disclose Student Data under a subpoena, court order or other binding legal demand only to the extent it requires, after notifying the school so it can seek protection unless the law prohibits the notice. In a health or safety emergency we disclose Student Data only at the school’s direction, as its agreement authorizes when its contacts cannot be reached in time and a person appears to be in imminent danger, or where the law requires it of us, and we tell the school as soon as possible. Nothing in this notice prevents us from making a report the law requires, such as a report of suspected child abuse or neglect. Where our staff come across content that appears to be a credible threat to someone’s safety, we refer it promptly, during our support hours (regular business hours, Eastern Time, on Business Days), to the school’s designated safety contact. The Platform is not an emergency or crisis service.
Contact us
SpecialNeedsWare, Inc. dba Ori Learning, Attention: Legal, 66 Summit Ave, Chatham, NJ 07928. Email: [email protected], read on Business Days. Telephone: 646-278-9959, answered on Business Days. Ori Learning, as the operator, answers privacy questions, requests and complaints about the Platform. Questions about using the Platform go to [email protected], and accessibility problems or accommodation requests to [email protected].
Changes to this notice
Each version of this notice carries a version and an effective date; prior versions are at orilearning.com/legal/archive/. Before a material change to how we collect, use or disclose Student Data takes effect for a school, we deliver an updated COPPA Direct Notice to Schools and obtain the school’s renewed authorization. We post any other change at orilearning.com/legal/student-privacy-notice/ and give the school’s privacy and security contact at least 30 days’ notice by email. No change during a school’s Subscription Term materially reduces the protection of its Student Data under its agreement.