Privacy Policy
Effective June 29, 2026 · Last updated June 29, 2026
Nudge K12, Inc. ("Ebby," "EbbyK12," "we," "us," or "our") provides an AI-powered admissions assistant that private K-12 schools embed on their websites to help prospective families explore the school, get answers, and schedule visits. This policy explains what information we collect, how we use it, and the choices you have. It covers ebbyk12.com, our admissions assistant widget, our admin dashboard, and related services (together, the "Services").
The short version
- We collect contact details you give us (name, work email, school) when you request a demo or contact us.
- On our website we use cookies and tools like the Meta Pixel to understand traffic and measure advertising — you can opt out.
- When our assistant runs on a school's website, we process family information on that school's behalf; the school controls that data.
- We never sell your personal information.
- We minimize data by design: students' full names are never sent to AI providers (first initial only), we never store raw IP addresses, and we don't use family or student data to train AI models.
- You can ask us to access or delete your information.
Our two roles
Ebby handles personal information in two distinct capacities:
As a business (data controller). When you visit ebbyk12.com, request a demo, or correspond with us, we decide how your information is used. This policy governs that.
As a service provider to schools (data processor). When a school embeds the Ebby assistant on its website, families interact with it, and we process their information on the school's behalf and under the school's instructions. The school is the controller of that information, and the school's own privacy policy governs it. For requests about family data collected through a school's website, please contact that school directly.
Information we collect
1. Information you provide to us
Demo and contact requests: your name, work email address, role, school name, and anything you include in a message or lead form (including forms submitted through Facebook or Instagram lead ads).
Account information: if you're a school administrator, your name, email, role, and authentication details (managed via our identity provider).
2. Information collected automatically on our website
Usage and device data: pages viewed, referring page, browser type, approximate location, and similar analytics data.
Cookies and similar technologies: including advertising and analytics tools such as the Meta Pixel (see Cookies & Advertising).
IP address: used transiently to estimate coarse location and protect against abuse. We do not store raw IP addresses — where location is derived, we discard the IP and retain only the approximate location and a one-way (SHA-256) hash for de-duplication.
3. Information we process on behalf of schools
When the Ebby assistant runs on a school's website, we may process, as the school's service provider:
- Parent/guardian name, email, and phone number (e.g., from a visit-booking form)
- A student's first name and grade level
- Family interests, enrollment timeline, and chat messages
- Pseudonymous visitor and session identifiers used for session continuity and aggregate analytics (not linked to a person unless and until a family submits a booking form)
We apply data minimization to all of the above.
How we use information
We use information we collect as a business to:
- Respond to demo requests and inquiries, and contact you about Ebby
- Provide, maintain, secure, and improve the Services
- Measure and improve our marketing and advertising
- Comply with legal obligations and enforce our terms
We process information on behalf of schools solely to provide the assistant service to that school — to answer family questions, personalize responses, capture inquiries, and schedule visits — under the school's instructions. We do not use it for our own purposes.
We do not sell personal information, and we do not use families' or students' personal information to train AI models.
Cookies & advertising
Our website uses cookies and similar technologies for functionality, analytics, and advertising. This includes the Meta Pixel, which helps us measure the performance of ads on Facebook and Instagram and reach relevant audiences.
You can control these in several ways:
- Adjust your ad preferences in your Facebook and Instagram account settings
- Use your browser settings to block or delete cookies
- Opt out of interest-based advertising via industry tools such as the Digital Advertising Alliance (optout.aboutads.info) or Network Advertising Initiative (optout.networkadvertising.org)
The assistant widget uses your browser's local/session storage to keep a conversation continuous and recognize returning visitors; it does not require advertising cookies.
How we share information
We share information only as described here. We do not sell personal information.
Service providers (subprocessors). We use trusted vendors to run the Services. They may process information only to provide services to us, under contractual confidentiality and data-protection obligations. Key providers include: Anthropic (Claude) for AI chat — students' full names are never sent, first initial only; OpenAI for text embeddings — only school knowledge content, never family or student data; Pinecone for knowledge-base vectors; Resend for transactional email; Supabase for database and authentication; Railway and Vercel for hosting; Cloudflare for CDN; base44 for our marketing website; and Meta Platforms for advertising measurement.
Schools. Information families provide through a school's embedded assistant is made available to that school's authorized staff through our dashboard.
Legal and safety. We may disclose information to comply with law, enforce our agreements, or protect the rights, safety, and security of users and the public.
Business transfers. If we're involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
Children's privacy (COPPA)
Ebby is designed for adults — parents, guardians, and school staff — not children. We do not knowingly collect personal information directly from children under 13. Where a school uses Ebby and a parent provides limited information about a child (such as a first name and grade), the school acts as the operator under the FTC's school official exception. We minimize child-related data: a student's full name is never transmitted to third-party AI services (first initial only), and no information is collected directly from children. If you believe a child has provided us personal information, contact us and we will delete it.
Student & family data (FERPA)
When families interact with the assistant on a school's website, we process their information as the school's service provider, under the school's direction and agreement with us. The school is the controller of that data. Schools can access all data tied to a family inquiry through an authenticated, school-scoped dashboard, and can permanently delete/anonymize a family's personal information at any time. If you're a parent or guardian and want to access or delete information you provided through a school's website, please contact that school.
Data retention
We keep personal information only as long as needed for the purposes described here, then delete or anonymize it. School administrators can delete a family's personal information from the dashboard at any time; deletion anonymizes identifying fields (name, email, phone, student name, notes, and AI-generated summaries) and clears associated chat messages, while retaining anonymized records for aggregate analytics.
How we protect your information
We use administrative, technical, and organizational safeguards designed to protect personal information, including:
- Data minimization by design — we collect and transmit the least data necessary
- Encryption in transit for data moving between systems
- Row-Level Security on all database tables, blocking direct or anonymous access
- Role-based, school-scoped access controls so staff see only their own school's data
- No raw IP storage — only coarse location and a one-way hash
- PII kept out of notification emails — staff notifications carry only a first name and a secure link
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal information, to opt out of certain processing, and to not be discriminated against for exercising these rights.
- For information you gave us as a business (e.g., a demo request): contact us at the address below.
- For information collected through a school's website: contact the school, which controls that data.
To exercise a right, email privacy@ebbyk12.com. We may need to verify your identity before acting on a request.
California residents (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you certain rights regarding your personal information. In the past 12 months, we may have collected: identifiers (name, email, IP address); commercial information (demo and inquiry requests); internet or other electronic activity; geolocation data (coarse, city-level); and professional information (role and school affiliation).
Our use of advertising technologies (such as the Meta Pixel) may be considered "sharing" of identifiers and internet-activity data for cross-context behavioral advertising under California law. You have the right to opt out — email privacy@ebbyk12.com or use the controls in Cookies & Advertising.
Your California rights include: Know/Access, Delete, Correct, Opt out of sale or sharing, and Non-discrimination. To exercise these rights, email privacy@ebbyk12.com.
International users
We operate in the United States, and your information will be processed and stored in the United States, which may have different data-protection laws than your country. By using the Services, you understand your information may be transferred to and processed in the United States.
Third-party links
Our website and the assistant may link to third-party sites or pages we don't control. This policy doesn't apply to those sites; please review their privacy policies.
Changes to this policy
We may update this policy from time to time. When we do, we'll revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised policy.
Contact us
Nudge K12, Inc.
Email: privacy@ebbyk12.com
3029 Berkeley Ave, Los Angeles, CA 90026
This policy is governed by the laws of the State of California, without regard to conflict-of-law principles.