Edpuzzle is a platform that helps teachers engage with their students through video learning. The Privacy Policy states that teacher profiles are publicly viewable through Edpuzzle's search engine, however, that student profiles are not visible to the general public. The Privacy Policy provides that Edpuzzle collects personal information including first and last names, email addresses, unique usernames, passwords, a unique code provided by a teacher in order to join a class, and a profile photo. While the Privacy Policy states that personal information is shared with third parties, the terms fail to state what information is shared. The Privacy Policy states that users’ information is encrypted in transit, but states that only users’ passwords are encrypted for information in storage. The terms clearly and unambiguously designate schools as the responsible party for obtaining parental consent, and/or determining whether a FERPA exception exists, before a student under the age of 13 can use Edpuzzle and have their information collected by Edpuzzle.

Edpuzzle can be accessed through its website, and is available for download at the iOS App Store, and the Google Play Store. The Privacy Policy and Terms of Use used for this evaluation can be found on Edpuzzle’s website, iOS App Store, and the Google Play Store. This evaluation only considers policies that have been made publicly available prior to an individual using the application or service.

Safety

The terms do not clearly indicate if certain user information is required to be shared or revealed in order to participate in social interactions. However, the Privacy Policy states that teacher profiles may be viewed by other teachers in the same school, or when searching for the teacher’s profile through Edpuzzle’s search engine. The Terms of Service clearly indicate that users may interact with both trusted users and untrusted users because “Edpuzzle cannot guarantee the identity of any other users with whom you may interact.” The terms do not disclose whether Edpuzzle reviews, screens, or monitors user-created content, takes reasonable measures to delete personal information from a user’s posting before they are made publicly available, or whether social interactions may be moderated or logged for review. The terms do not disclose whether users can report inappropriate content, harassment, or cyberbullying.

Privacy

The Privacy Policy clearly discloses that Edpuzzle collects behavioral data in the form of the frequency and duration of site visits, teachers’ precise geolocation information, and usage data including students’ viewing history, quiz responses, browser type, IP addresses, and device information. The Privacy Policy provides that the collection and purpose of personal information is limited to only data that are specifically required for the product and providing the product’s services. The Privacy Policy indicates that third parties are unable to collect users’ personal information, unless the user directly provides a third party with their personal information.

The Privacy Policy clearly indicates that Edpuzzle shares personal information with third parties for analytics, research, marketing, and to support Edpuzzle. Also, the Privacy Policy indicates that third-party log-in is available, including through an educational institution’s learning management system, and that Edpuzzle collects information from third party log-in platforms. Furthermore, the Privacy Policy says that Edpuzzle does not sell users’ personal information. However, the Privacy Policy indicates that teachers and parents may be subject to direct marketing and advertising. The Privacy Policy does not disclose whether users are able to opt-out of any advertising or marketing communications.

Security

The Privacy Policy clearly indicates that users’ personal information is protected with reasonable security, including physical access controls to limit employee access to user information. The Privacy Policy indicates that an account is required to use Edpuzzle and that Edpuzzle provides schools and teachers with managed accounts to control students’ use of Edpuzzle and to control students’ personal information. The Privacy Policy provides that Edpuzzle verifies the user’s identity with additional personal information when the user makes a privacy request. The Privacy Policy does not clearly indicate whether the security of a user’s account is protected by multi-factor authentication. The Privacy Policy states that in the event of a data breach, affected users will be notified “no later than forty-height [sic] (48) hours of such discovery.”

Compliance

The terms clearly indicate that users can create “User Submissions” on Edpuzzle, and that users retain all ownership rights for their content, granting Edpuzzle a limited, narrow license over the content. The terms disclose that authorized individuals, including current employees of an educational institution, are granted access to review, modify, and delete users’ information. The Privacy Policy provides that Edpuzzle automatically deletes inactive accounts and the user’s information after 18 months of inactivity, and that users can receive a copy of their information in a portable format. The Privacy Policy provides that users can control with whom they share information.

The terms fail to state whether Edpuzzle knowingly collects personal information from children under the age of 13 and furthermore fails to include a section designated for children’s privacy. The terms do not clearly indicate whether a parent can consent to the collection and use of their child’s personal information without also consenting to the disclosure of the information to third parties. The Privacy Policy discloses that if Edpuzzle discovers it has “collected information form a child in a manner inconsistent with COPPA, FERPA, GDPR, or any other applicable laws or regulations,” that Edpuzzle will take appropriate steps to delete the information.

• Intended for children under 13.
• Collection or use of data is limited to product requirements.
• Personal information can be displayed publicly.
• Users can interact with trusted users.
• Notice is provided in the event of a data breach.
• Parental consent is required before personal information is collected or disclosed.