How we collect, use, and protect your data.

EdCertly does not own — and does not claim ownership of — any data uploaded to or processed through the Platform by a School Partner or by any individual acting on behalf of a School Partner. This includes teacher names, certification status, expiration dates, uploaded documents, performance data, and any reports or analytics derived from that data.

All such data remains the sole property of the School Partner. CMOs that upload data on behalf of their affiliated schools own that data on those schools' behalf, consistent with their internal arrangements. Each School Partner is at all times the data controller — the party that determines what data is processed, why it is processed, and with whom it may be shared.

EdCertly serves only as a data processor. We process School Partner data only on the instructions of the School Partner and only as necessary to deliver the contracted services. We do not exercise independent judgment over what data should be processed or shared, except as needed to maintain the security, integrity, and operation of the Platform.

EdCertly does not independently access, query, or extract data from any state teacher certification system — including the New York State Education Department's TEACH system or any equivalent system in other states. All certification data within the Platform comes from one of three authorized sources: (a) the School Partner uploading the data; (b) the individual teacher entering it through the Teacher Portal; or (c) an integration the School Partner has explicitly authorized in writing and that operates under the School Partner's credentials and consent.

EdCertly provides the tools — but the School Partner is responsible for what the data contains, who can access it, when it is updated, and how it is used. Specifically, each School Partner is responsible for:

• Determining what data is uploaded
• Verifying data accuracy and currency
• Managing user access and permissions for their staff and teachers
• Deciding when and how data is shared with their HRIS or other systems
• Responding to record access, correction, or deletion requests from teachers or other individuals
• Ensuring their use of the Platform complies with applicable law

When an institution registers, we collect information about the authorized administrator:

• Name, job title, and contact information
• School or organization name and address
• Login credentials (passwords stored in hashed, non-reversible form)
• Subscription and billing information (processed through a PCI-compliant third-party processor; we do not store full payment card details)
• Platform usage data (login timestamps, features accessed)

Teacher data processed on the Platform may include:

• Name, employee ID, contact information, and date of hire
• Certification type, status, and expiration dates
• Pathway progress and gap analysis data
• Documents uploaded for certification (transcripts, scores, verification forms)
• Subject area, grade level, and assignment information as provided by the school
• Performance review data, to the extent provided by the school and required by NY Ed Law §2-d

EdCertly is primarily a teacher workforce platform. We do not directly collect, solicit, or process student data as part of our core service. To the extent any student PII is incidentally included in documents uploaded by a School Partner, we treat it under the protections of FERPA and Ed Law §2-d, and notify the School Partner immediately.

• IP address and general location (not street-level)
• Browser type, operating system, device type
• Pages visited and navigation paths
• Error logs and performance data

To deliver the Platform, EdCertly uses subcontractors such as cloud infrastructure providers, security monitoring services, and PCI-compliant payment processors. All subcontractors are bound by written agreements imposing data protection obligations materially equivalent to those EdCertly owes to the School Partner. Subcontractors may not use data for any purpose other than supporting EdCertly's services. A current list is available on request.

Where a School Partner explicitly authorizes EdCertly to transmit data to a third-party system (such as their HRIS, EIS, payroll provider, or a state certification system the School Partner has chosen to integrate with), EdCertly will transmit data solely as directed by that authorization. The integration partner is selected by the School Partner.

EdCertly will only disclose data to third parties when compelled by a legally binding order from a court of competent jurisdiction, a valid subpoena, a lawfully issued government request, or as otherwise required by applicable law. In any such case, EdCertly will:

• Promptly notify the affected School Partner unless legally prohibited
• Disclose only the minimum data required to comply
• Cooperate with the School Partner in seeking, where appropriate, a protective order or other legal mechanism to limit disclosure
• Provide a full disclosure account to the School Partner as soon as legally permissible

In the event of a merger, acquisition, or sale of substantially all assets involving A12 Labs LLC, School Partner data may be transferred to the successor entity, which will be bound by this Privacy Policy and applicable law. School Partners will receive at least sixty (60) days' advance notice and the opportunity to export data and terminate before any transfer.

EdCertly does not and will not sell, rent, trade, or monetize School Partner data. We do not use data for advertising, marketing, behavioral profiling, or AI model training for general use. This commitment is binding regardless of any change in ownership.

• Access — request a copy of data we hold about your school
• Correction — request correction of inaccurate information
• Deletion — request deletion subject to legal retention requirements
• Portability — export your data in a standard format anytime during your subscription
• Restriction — request limitation of processing in certain circumstances

Teachers may access and export their own certification records through the Teacher Portal. Requests regarding data held under a School Partner's account should first be directed to the School Partner, as the School Partner is the data controller. EdCertly will cooperate in responding.

Parents and eligible students retain all rights under FERPA. The School Partner is responsible for fulfilling FERPA rights requests; EdCertly will cooperate.

EdCertly fully complies with NY Education Law §2-d and 8 NYCRR Part 121. School Partners receive the full protections of Ed Law §2-d, including the Parents' Bill of Rights, breach notification within seven calendar days, and the prohibition on selling protected data.

As EdCertly expands to other states, our New York-level protections serve as the baseline. Additional state-specific provisions will be added as required by the laws of each state we operate in.