Privacy policy

1. Who we are

EduSpark Lab Inc. ("EduSpark Lab", "we", "us") is an edtech curriculum and teaching-tools design studio incorporated in British Columbia, Canada. Our registered address is 245 East 2nd Avenue, Suite 110, Vancouver, BC V5T 1B7. Business Number: 437619028 RC0001. We provide AI-assisted courseware development, teacher copilot design, assessment frameworks and learning-experience consulting for client institutions and educators. We are a professional services firm — not an accredited school, not a credential issuer, and not a data broker.

Privacy Officer: [email protected]

2. Scope and application

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, British Columbia's Personal Information Protection Act (PIPA) and the Freedom of Information and Protection of Privacy Act (FIPPA) as it applies to our clients in the public sector. It covers information collected through edusparklab.life, email correspondence, contracts, project delivery, and cookies on our website.

When we process personal information on behalf of client institutions — including student, educator or minor data — we act as a service provider under contractual data processing terms. The client institution remains the primary organization responsible for consent and lawful collection in those contexts. This policy describes our own collection practices and our obligations as a processor.

3. Information we collect

Contact and business information: Name, email address, phone number, organization name, job title, mailing address and project enquiry details when you contact us or enter a contract.

Website usage data: IP address, browser type, device information, pages visited, referral source and cookie preferences — collected only with your consent for analytics and preference cookies.

Project and delivery data: Courseware materials, instructional content, assessment items, feedback notes, accessibility audit results and communications related to engagements. This may include educator identifiers and, where scoped in contracts, learner data provided by client institutions.

Student and minor data: We minimize direct collection of student and minor personal information. When client institutions provide learner data for pilot testing or analytics, we process it only under contract, with defined purposes, retention limits and security controls. We do not sell student data. We do not use minor data for unrelated marketing.

4. Purposes of collection and use

We collect and use personal information for the following purposes:

• Responding to enquiries and delivering edtech studio services including courseware sprints, teacher copilot development and assessment design;
• Performing contracts with client institutions, colleges, universities, K-12 boards, training organizations and L&D teams;
• Managing accounts, invoicing and payment in Canadian dollars;
• Conducting accessibility (UDL / AODA) reviews, fairness audits and academic-integrity testing as part of project delivery;
• Improving our website and services where you have consented to analytics cookies;
• Complying with legal obligations, responding to lawful requests and protecting our rights;
• Maintaining security, preventing fraud and enforcing our Terms of Service.

We do not use personal information for purposes incompatible with those described without obtaining additional consent.

5. Legal basis and consent

Under PIPEDA, we rely on meaningful consent for collection, use and disclosure of personal information. Consent may be express — such as checking the PIPEDA consent box on our contact form — or implied where appropriate for business communications you initiate. You may withdraw consent subject to legal and contractual restrictions by contacting our Privacy Officer. Withdrawal may limit our ability to provide services.

For student and minor data processed on behalf of clients, the client institution is responsible for obtaining appropriate consent from learners, parents or guardians as required by applicable law. We support clients in meeting these obligations through data processing agreements.

6. Disclosure to third parties

We may disclose personal information to:

• Cloud hosting providers operating Canadian or contractually compliant infrastructure;
• AI and machine learning sub-processors used in content generation, teacher copilot prototyping and assessment tooling — only data approved by the client and scoped in contracts;
• Professional advisors (legal, accounting) bound by confidentiality;
• Government authorities when required by law.

We require sub-processors to provide comparable privacy protection. A current sub-processor list is available on request. Cross-border processing — for example, when an AI vendor processes data in the United States — is disclosed in contracts and governed by appropriate safeguards including contractual clauses and data minimization.

7. Retention

We retain personal information only as long as necessary for the purposes described or as required by law. Contact enquiry data: up to 24 months. Contract and project records: duration of engagement plus 7 years for business records. Cookie consent preferences: 6 months. Student data provided by clients: per contract terms, typically deleted or returned within 90 days of project completion unless longer retention is agreed for ongoing retainers.

8. Security

We implement administrative, technical and physical safeguards appropriate to the sensitivity of information we hold: access controls, encryption in transit, secure development practices, staff training on PIPEDA and student-data care, and incident response procedures. No method of transmission is fully secure; we commit to notifying affected individuals and regulators of significant breaches as required by law.

9. Your rights

Under PIPEDA, you have the right to access personal information we hold about you, request correction of inaccuracies, and challenge our compliance. Submit requests to [email protected]. We respond within 30 days unless an extension is permitted. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada:

Office of the Privacy Commissioner of Canada
30 Victoria Street, Gatineau, QC K1A 1H3
Toll-free: 1-800-282-1376 · www.priv.gc.ca

For matters under BC PIPA, you may also contact the Office of the Information and Privacy Commissioner for British Columbia.

10. Cookies

See our Cookie Policy for details on strictly necessary, analytics and preference cookies, storage durations and how to change your consent.

11. Children's and minor's privacy

We do not knowingly collect personal information directly from minors through our website. When projects involve K-12 learners, data is provided by the client institution under strict contractual terms. We apply enhanced care: minimized collection, no marketing use, no model training on minor data without explicit written consent, and prompt deletion per contract.

12. Automated decision-making

EduSpark Lab does not make automated decisions about individuals that produce legal or similarly significant effects without human involvement. Teacher copilot and content generation tools require educator approval before learner-facing deployment. Any profiling or recommendation features in deliverables are documented with opt-out mechanisms and human review paths as specified in project contracts.

13. International data transfers

Where personal information is processed outside Canada — for example by cloud or AI sub-processors in the United States — we disclose this in contracts and apply safeguards including data minimization, contractual clauses and vendor security assessments. Clients may request information about sub-processor locations before approving project scopes involving learner data.

14. Complaints process

We investigate privacy complaints promptly. Contact [email protected] with sufficient detail for us to respond. We aim to acknowledge within five business days and provide a substantive answer within thirty days unless an extension is required. Unresolved matters may be referred to the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia. We maintain internal records of complaints and resolutions as part of our accountability obligations under PIPEDA principle 1. Where a complaint involves data processed for a client institution, we coordinate with the client's Privacy Officer and follow contractual notification procedures.

15. Changes to this policy

We may update this policy to reflect legal, technical or business changes. The "Last updated" date at the top will change. Material changes will be noted on this page. Continued use after changes constitutes acceptance of the updated policy for website interactions. We encourage you to review this policy periodically, especially before submitting personal information through our contact form or entering a new project agreement with EduSpark Lab Inc.

16. Marketing and communications

We do not sell contact lists or send unsolicited bulk marketing unrelated to your enquiry. Follow-up email relates to your message or an active contract. Optional newsletters, if introduced later, will require separate opt-in under Canada's Anti-Spam Legislation (CASL) with clear unsubscribe options.

17. Contact

EduSpark Lab Inc., Privacy Officer
245 East 2nd Avenue, Suite 110, Vancouver, BC V5T 1B7
[email protected] · +1 (604) 419-7286

We aim to acknowledge privacy enquiries within five business days and to provide a substantive response within thirty days unless an extension is permitted under PIPEDA.