FERPA Compliance

Overview

The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g) protects the privacy of student education records. Varsity Learning is committed to handling student data in compliance with FERPA requirements.

Our Role Under FERPA

When Varsity Learning is used by an educational institution, we act as a school official with a legitimate educational interest under FERPA § 99.31(a)(1)(i)(B). This means:

• We provide a service that the institution would otherwise perform itself
• We are under the direct control of the institution regarding use and maintenance of education records
• We use education records only for authorized purposes
• We do not re-disclose student information except as permitted by FERPA

Education Records We Process

In the course of providing our service, we may process the following education records:

• Student names and institutional email addresses
• Course enrollment information
• Assignment submissions and scores
• Gradebook data and academic progress
• LTI-exchanged identifiers and grade passback data

Our FERPA Commitments

AI Features & Education Records

Varsity Learning uses large language models, accessed through our AI inference gateway, to power three features: on-demand homework hints for students, step-by-step explanations for students who are stuck, and weekly course-analytics narratives for instructors. The specific model provider depends on the feature and current configuration, and currently includes Groq and Alibaba Cloud (Qwen models), with Anthropic's Claude used for select workflows. Where enabled, instructors may also use an AI-assisted lesson-planning tool; it processes instructor-provided lesson details (topic, grade band, duration, notes, and — for the lesson-differentiation mode — the source lesson being adapted) and published academic-standards data. It does not read student data from Varsity Learning records, and instructors must not enter student personal information into lesson-planning fields; requests are processed by Anthropic (Claude). When AI features process information derived from education records, the following safeguards apply regardless of provider:

• Data minimization. Hint and explanation requests contain the question text and the student's current answer attempt, screened by a best-effort automated filter before being sent; on adaptive practice assignments, these requests may also include the student's current mastery level on the topic and detected error patterns, so the response can target the specific misconception. Analytics requests contain only pseudonymized engagement metrics (e.g., “Student_123”). Student names, email addresses, and other directly identifying information are not deliberately sent to any AI provider; real names are re-associated only within Varsity Learning's own systems.
• Subprocessor controls. Each AI provider processes this data solely as our service provider under a Data Processing Agreement, with restrictions consistent with FERPA's school-official requirements for outside parties (34 C.F.R. § 99.31(a)(1)(i)(B)): a provider may use the data only to provide the service to us, may not re-disclose it, and may not use it to train its models.
• Limited retention. Retention terms vary by provider. Where we have a specific commitment — for example, Anthropic commits to deleting API inputs and outputs within 30 days (except content flagged by its automated trust-and-safety systems, which may be retained longer under Anthropic's policies) — we honor and disclose it on request.
• Transparency for students. AI-generated hints and explanations are clearly labeled as AI-generated, are scoped to the mathematics question being worked on, and are rate-limited per student. They do not affect grades — instructors retain full control of grading.
• Auditability. Varsity Learning keeps an internal audit log of each AI tutoring interaction — the student and question IDs, the feature used, adaptive skill ID, hint level, the model or generation method when recorded, and outcome, never the student's answer or the AI's response text. This log stays within Varsity Learning's systems and is not shared with AI providers. Separately, Varsity Learning maintains a record of access to student education records viewed through its administrative and support interfaces — who accessed them, in what role, which records, and when — supporting its record-keeping obligations under FERPA § 99.32.
• No commercial use. Data processed by AI features is never used for advertising, marketing, or building profiles of students, by us or by any AI provider we use.

Provider-specific certifications vary. Anthropic, for example, maintains SOC 2 Type II, ISO 27001:2022, and ISO/IEC 42001:2023 certifications, and publishes its subprocessor list at trust.anthropic.com. Our data processing agreements with our AI providers, together with our integration design (data minimization and defined retention), are configured to support our FERPA obligations as a school official's vendor.

Institutional Agreements

Institutions may enter into a Data Processing Agreement (DPA) or FERPA-specific addendum with Varsity Learning to formalize data handling obligations. Contact support@varsitylearning.com to request an institutional agreement.

Parent & Student Rights

FERPA grants parents (and eligible students over 18) the right to:

• Inspect and review education records
• Request amendment of inaccurate records
• Consent to disclosure of personally identifiable information
• File a complaint with the U.S. Department of Education

To exercise these rights regarding data held by Varsity Learning, contact your institution's registrar or FERPA compliance officer, or email us directly.

Contact

FERPA inquiries: support@varsitylearning.com