Brisk Teaching stores user input (e.g., a rubric that a teacher uploads, a curriculum or IEP prompt that a teacher writes) and Brisk-generated responses (e.g., a lesson plan, an IEP, feedback on a student essay). Brisk Teaching does not store data that it processes (e.g., student essay). If a teacher input includes a student name, then Brisk Teaching would store that student’s name on its servers. If Brisk Teaching generated content includes a student’s name, then Brisk Teaching would store that student's name on its servers.

1. Let’s take a “create” example:  if a teacher includes student information in a prompt like “Create a letter of recommendation for ‘Student Name’”, Brisk Teaching will store that prompt, and the letter of recommendation that Brisk Teaching generates. Both the prompt and the letter of recommendation would include the student’s name. 
2. Now let’s look at the feedback tool: a teacher prompts Brisk Teaching to provide targeted feedback on a student’s essay, which includes their name. Brisk Teaching will store the feedback prompt that the teacher writes, and the feedback that Brisk Teaching generates, but not the content of the student’s essay. The feedback could include the student’s name, because their name is typed in their essay.

1. Brisk Teaching accesses the minimum data necessary in order to provide Brisk products to teachers and students. Brisk does not have access to teachers’ entire Google Drives. Rather, it has permission to "create" / "save" certain items within your Google Drive. This permission allows Brisk to produce teacher-requested content in Google Docs, Google Slides, and Google Forms.
2. Brisk cannot see any information in Google Drive files or create anything in Google Drive unless a teacher explicitly asks Brisk to give feedback on a file or create a resource through the Chrome Extension.

Protecting student privacy is a top priority. We are signers of the Student Data Privacy Pledge, and comply with all student data privacy laws, including FERPA and COPPA. We have signed the National Data Privacy Agreement with California, Illinois, Massachusetts, Maine, Missouri, New Hampshire, Ohio, Rhode Island, Virginia, Vermont, Washington, and Wisconsin, and are open to signing district-level agreements when state-level Data Privacy Agreements are not possible. 

We have established robust physical, technical, and administrative safeguards designed to protect the information in Brisk Teaching. These safeguards prevent unauthorized access, disclosure, or improper use of information. Below is a summary of some of the steps Brisk Teaching takes to protect student information:some text

1. We restrict access to personal information to authorized Brisk Teaching employees, agents, service providers, or independent contractors who reasonably need to know that information in order to process it for us, and who are subject to confidentiality obligations.  Employees and contractors (“Staff”) are subject to discipline if they fail to meet these obligations;
2. We require our service providers with which we share Student User personal information to employ industry standard data protection and security protocols;
3. We use identification and authentication methods such as multi-factor authentication;
4. We employ administrative, physical, and technical safeguards designed to protect personal information from unauthorized access, disclosure, and use or acquisition by an unauthorized person, including when transmitting and storing such information;
5. We employ encryption technologies to securely transmit personal information, including data-in-transit encryption, and we encrypt personal information that is stored;
6. We maintain a data backup and recovery capability designed to ensure a timely and accurate restoration of personal information;
7. We maintain a secure software development lifecycle with industry standard security practices designed to establish secure application(s), network, and infrastructure architectures;
8. We maintain event monitoring and response procedures for events which could impact functionality, security and/or availability of Brisk Teaching;
9. We regularly provide Staff training for security incidents and maintain incident response policies, plans and procedures focused on timely and effective incident response.