← Back to CORE

CORE Privacy Policy

Effective Date: April 17, 2026  |  Last Updated: April 17, 2026

Inteliflow Corporation, a Wyoming corporation (“Inteliflow,” “we,” “us,” or “our”) operates the CORE platform at app.inteliflowai.com (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard information about teachers, students, parents, school administrators, and other users of the Service.

CORE is a pedagogy-powered learning intelligence platform built for K-12 schools. We treat student data as a trust, not a commodity. We do not sell student data, ever.

1. Our Role Under Student Privacy Laws

When a school, district, or other educational institution (“School”) purchases or enables CORE for its students, the School is the data controller (or the FERPA “educational agency or institution”). Inteliflow acts as a service provider / school official performing services that the School would otherwise perform itself, under the School’s direct control.

Specifically:

  • FERPA (20 U.S.C. § 1232g; 34 C.F.R. Part 99): We process student education records as a “school official” with a legitimate educational interest, only as directed by the School.
  • COPPA (15 U.S.C. §§ 6501–6506): For users under 13, we rely on the School to provide consent on behalf of parents for the collection of personal information used solely for educational purposes.
  • State student privacy laws (including California SOPIPA, New York Education Law § 2-d, Colorado Student Data Transparency Act, Connecticut Public Act 16-189, Illinois SOPPA, and others): We comply with applicable requirements and execute Data Protection Addenda (“DPAs”) with Schools where required.
  • GDPR (where applicable): For users in the European Economic Area or United Kingdom, the School is the data controller and Inteliflow is the processor.

2. Information We Collect

2.1 Information provided by Schools and users

  • Account information: Name, school-issued email, role (student, teacher, parent, administrator, platform administrator), grade level, class/period assignments, and authentication credentials.
  • Roster data: Student–class assignments, teacher–class assignments, parent–student relationships. Typically provisioned by School administrators or via Google Classroom SSO/roster sync.
  • Learner profile data: Learning style band (3 bands × 6 styles = 18 profiles), Power Skills ratings, Core Attributes, and pedagogical notes entered by teachers.

2.2 Information generated through use of CORE

  • Learning activity: Homework submissions, quiz attempts, scores, mastery levels, reteach activity, and timestamps.
  • Behavioral signals: On-time submission flags, time-to-submit, hint counts, effort labels (effortful success / struggling but trying / independent success / independent struggle), consistency scores, and dominant effort patterns. These signals inform teacher insights only and do not silently alter student score bands.
  • Teli AI tutor interactions: Text prompts, audio recordings (for voice input), transcripts generated by speech-to-text, and AI responses. Voice recordings are retained only as long as necessary to transcribe and, if requested, to provide audit and parent visibility.
  • Student work artifacts: Uploaded images, canvas drawings, typed responses, and diagrams stored in our storage bucket.
  • Usage data: Pages viewed, features used, login times, and session duration.
  • Device and technical data: IP address, browser type, operating system, device identifiers, and diagnostic logs (via Sentry, with IP scrubbing enabled).

2.3 Information from integrations

  • Google Classroom: When a School enables integration, we receive roster lists, class lists, assignment metadata, and grade-sync confirmations under the Google OAuth scopes the School authorizes. We use this data solely to operate CORE for the School.
  • Parent email: If a School enables parent narratives, we send summary emails to the parent/guardian email the School has provided.

3. How We Use Information

We use information to:

  • Deliver differentiated learning, homework, reteach, and assessment experiences to students.
  • Provide teachers, parents, and administrators with reports, dashboards, and insights.
  • Power the Teli AI tutor (see Section 5 for AI details).
  • Generate parent narratives and weekly/periodic progress communications.
  • Maintain, secure, troubleshoot, and improve the Service.
  • Comply with legal obligations and enforce our Terms of Service.

We do not use student personal information to:

  • Serve targeted advertising.
  • Build non-educational profiles.
  • Sell or rent to third parties.
  • Train generalized third-party AI models (see Section 5).

4. How We Share Information

We share information only as follows:

  • With the School: The School has full access to its users’ data. Teachers see their students; School admins see their school.
  • With parents/guardians: As authorized by the School, and limited to their own student(s).
  • With service providers (“subprocessors”) performing functions on our behalf under written data protection terms. Our current subprocessors include:
    • Supabase, Inc. — database, authentication, object storage (US region).
    • OpenAI, L.L.C. — GPT-4o inference for differentiation, grading assistance, Teli tutor, and parent narratives. OpenAI API data is not used to train OpenAI models under our API terms.
    • Anthropic, PBC — Claude model inference, where enabled.
    • Black Forest Labs (BFL) — Flux image generation for educational diagrams.
    • Runway AI, Inc. — Video generation for visual learning materials.
    • Vercel Inc. — application hosting.
    • Google LLC — optional Google Classroom SSO and roster integration (controlled by School).
    • Resend — transactional email delivery.
    • Sentry — error monitoring and diagnostics (with IP scrubbing).
    • Upstash, Inc. — rate limiting and caching (Redis), where enabled.
  • For legal reasons: If required by law, subpoena, or court order; to protect rights, safety, and security; or in connection with a merger, acquisition, or asset sale in which student data protections survive the transaction.

5. Artificial Intelligence Disclosure

CORE uses large language models to provide:

  • Differentiated homework content
  • AI-assisted grading suggestions (teacher reviewable)
  • The Teli AI tutor
  • Parent narratives
  • Signal explanations and teacher insights

AI is an assistive layer. Teachers remain the educational decision-maker. AI-graded items surface as suggestions that teachers can override.

We send only the data necessary to produce the requested output. Under our agreements with OpenAI and Anthropic, inputs and outputs from API calls are not used to train their foundation models. Providers may retain limited data for abuse monitoring per their respective published policies.

Voice inputs (Whisper transcription) are used only to produce a transcript and are deleted on the provider’s standard schedule. Schools may disable voice input district-wide.

6. Data Security

We implement administrative, technical, and physical safeguards including:

  • TLS 1.2+ encryption in transit.
  • Encryption at rest for databases and object storage.
  • Role-based access control with Supabase Row Level Security and SECURITY DEFINER functions.
  • Least-privilege access for Inteliflow personnel.
  • Audit logging.
  • Error monitoring via Sentry with PII scrubbing.
  • Password reset and account recovery controls.
  • Incident response procedures.

No system is perfectly secure. In the event of a data breach affecting student personal information, we will notify the affected School without undue delay and cooperate with the School’s legal notification obligations.

7. Data Retention and Deletion

  • During the School’s subscription: We retain data for the period the School’s active contract requires.
  • After termination or upon School request: We delete or return student personal information within 60 days, except where retention is required by law.
  • De-identified / aggregate data: May be retained for service improvement and research. De-identification is irreversible and subject to re-identification prohibition under applicable law.
  • Parents and eligible students may request access, correction, or deletion of their student records; we route such requests through the School, which is the controller under FERPA.

8. Your Rights

Depending on jurisdiction, you may have the right to:

  • Access the personal information we hold about you or your child.
  • Correct inaccurate information.
  • Delete personal information.
  • Object to or restrict processing.
  • Data portability.
  • Withdraw consent (where processing is based on consent).
  • Lodge a complaint with a supervisory authority.

For student data, please contact your School first — they are the data controller. For direct inquiries to Inteliflow, email privacy@inteliflowai.com.

California residents (CCPA/CPRA): We do not sell or share personal information as those terms are defined under CCPA. Student data collected on behalf of a K-12 school is generally exempt from CCPA, but we honor functionally equivalent rights when requested through the School.

9. Children’s Privacy (COPPA)

CORE is designed for use in K-12 educational settings. When CORE is used with students under 13, we rely on the School to provide COPPA-required consent on behalf of parents for the collection and use of personal information for educational purposes within the School’s authorized control. Parents may review, request deletion of, or refuse further collection of their child’s information by contacting the School.

We do not use students’ personal information for commercial purposes such as behavioral advertising or building non-educational profiles.

10. International Transfers

We are based in the United States. If you access CORE from outside the U.S., your information will be transferred to and processed in the U.S. and other countries where our subprocessors operate. Where required, we rely on appropriate transfer mechanisms (such as EU Standard Contractual Clauses).

11. Changes to This Policy

We will notify Schools and, where appropriate, users of material changes to this Privacy Policy by email and by posting a notice on the Service at least 30 days before the change takes effect, unless a shorter period is required by law.

12. Contact

Inteliflow Corporation

Privacy inquiries: privacy@inteliflowai.com

Data Protection Officer (where applicable): Marvin Leventhal / mleventhal@inteliflowai.com

Postal address: 9398 Isles Cay Drive, Delray Beach, FL 33446

For a copy of our standard School Data Protection Addendum (DPA), email legal@inteliflowai.com.