Flip (formerly Flipgrid)
Round 1 · Privacy Triage · VettED Privacy Triage (Avenues-derived) — Round 1 · assessed
🟠 Insufficient Evidence — Round 2 required
Privacy score 68.9% · band Average
3 mandatory gates are unaddressed in the privacy policy (Q1 (Data Collection); Q5 (Data Sharing); Q6 (Data Sharing)) — more than we tolerate at triage. No violation found, but silence can't earn a pass; escalate these specific items to Round 2.
Unaddressed gate(s): Q1, Q5, Q6 — not covered by the public policy. Confirm before relying on this.
Dimension scorecard
| Dimension | Score | |
|---|
| Data Collection GATE ⚠ |
| 35.0% |
| Data Sharing GATE ⚠ |
| 0.0% |
| Data Sold GATE |
| 100.0% |
| Data Rights GATE |
| 100.0% |
| Data Safety GATE |
| 100.0% |
| Ads & Tracking GATE |
| 100.0% |
| Parental Consent |
| 100.0% |
| School Purpose |
| 100.0% |
| AI & Model-Training GATE |
| 50.0% |
| Jurisdiction & Residency |
| 100.0% |
Findings — 18 questions, every answer cited
Data Collection
Q1Does the vendor limit collection/use of information to only data required for the product? GATE
? Not addressed
T0
Answer: Unclear
Policy does not explicitly state whether collection is limited to data required for the product.
Q2Does the vendor collect PII beyond what's necessary for the stated educational purpose?
✓ Good
T3
Answer: No
“We will not knowingly require any Child to disclose more information than is reasonably needed to participate in the Service.”
Statement applies specifically to children; no explicit statement for all users, but this indicates a principle of necessity.
Q3Is any image of the user collected?
✗ Concern
T3
Answer: Yes
“We collect information from Users when you post content on the Service, such as Topics, text, videos, and other material. This information may include first name, last name, date of birth, email address, geographic location, and audio and image included within a video.”
Images are explicitly collected as part of video content.
Q4Does the vendor collect precise geolocation data?
✗ Concern
T3
Answer: Yes
“This information may include first name, last name, date of birth, email address, geographic location, and audio and image included within a video.”
Geographic location is explicitly listed as collected information.
Data Sharing
Q5Does the vendor limit data sharing with third parties to the purpose for which it was collected? GATE
? Not addressed
T0
Answer: Unclear
Policy does not explicitly state whether third-party sharing is limited to the original purpose of collection.
Q6Does the vendor impose contractual limits on how third parties use shared personal information? GATE
? Not addressed
T0
Answer: Unclear
Policy does not explicitly describe contractual limits imposed on third parties regarding use of shared personal information.
Data Sold
Q7Does the vendor sell or rent users' personal information to third parties? GATE
✓ Good
T3
Answer: No
“Flip does not sell User personal information.”
Explicit statement that personal information is not sold.
Data Rights
Q8Do the student / educator / parent / school retain ownership of data and IP of uploaded content? GATE
✓ Good
T3
Answer: Yes
“Students can create and manage their own videos and text within a Group or Topic.”
Students retain ability to manage their own content; ownership language not explicit but management rights are stated.
Q9Can the user delete all of their PII and personal information from the vendor?
✓ Good
T3
Answer: Yes
“Users (and their parents, if applicable) may also request deletion of their personal information, including content, by going to Flip Help or, in some cases, contacting the relevant Group/Topic Educator.”
Users can request deletion of personal information and content.
Q10Does the vendor auto-delete data after a defined period of inactivity (data sunset)?
✓ Good
T3
Answer: Yes
“We store the information we collect for as long as you have an account (if you are an Educator), or for up to 30 days in our archives when you ask for data to be deleted.”
Data is retained for 30 days after deletion request, then removed.
Data Safety
Q11Can students contact or interact with UNKNOWN users (strangers / the general public) in environments NOT supervised by a teacher or school? (Teacher-managed or within-class interaction, and content-only sharing, do NOT count.) GATE
✓ Good
T3
Answer: No
“A Guest is invited to participate in Topics via a join code and guest password provided by an Educator. Guests can create and manage their own videos and text within a Topic.”
Guests are invited by educators and participate via controlled join codes; students interact within teacher-managed groups and topics, not with unknown public users.
Ads & Tracking
Q12Does the vendor display behavioral or targeted advertising to students inside the product? (Sending product/marketing emails to account holders does NOT count.) GATE
✓ Good
T3
Answer: No
“When you use the Service, Flip does not use your personal information to market or advertise non-Microsoft products or services to you.”
Explicit statement that behavioral/targeted advertising is not displayed to users inside the product.
Q13Does the vendor share students' personal information with third parties for third-party advertising or ad-targeting? GATE
✓ Good
T3
Answer: No
“As with other Users, we do not sell Children's personal information or use Children's personal information to market or advertise to Children, nor do we permit third-parties to do so.”
Policy explicitly states that student personal information is not shared with third parties for advertising or ad-targeting.
Parental Consent
Q14Does the vendor limit collection for children aged 13 or under, or require parental/school consent?
✓ Good
T3
Answer: Yes
“Under the United States Children's Online Privacy Protection Act ("COPPA"), verifiable Parental consent is needed to collect, use, or disclose personal information (e.g., full name and email address) from each User under 13 years old.”
Policy requires parental/school consent for children under 13.
School Purpose
Q15Does the vendor state the product is intended for students in preschool or preK-12?
✓ Good
T3
Answer: Yes
“This Privacy Policy governs how Flipgrid, Inc., a Microsoft subsidiary, ("Flip," "we," "our," or "us") collects, uses, and shares personal information about Educators, Students, and Guests”
Product is explicitly designed for students; service is described as educational with student roles.
AI & Model-Training
Q16Does the vendor use student/user data — including uploaded content — to train, fine-tune, or improve AI/ML models? GATE
✓ Good
T3
Answer: No
“Extracted Data is used for the sole purpose of providing Flip Lenses to you. Extracted Data is processed for the duration of the session on your device only then deleted. The Extracted Data is not sent to Flip or any third party.”
Policy explicitly states that extracted data from lenses is not used for model training and is deleted after session. No mention of using student content to train AI/ML models elsewhere.
Q17Does the vendor disclose which AI sub-processors/models power its features and any automated decisions affecting students?
? Not addressed
T0
Answer: Unclear
Policy does not disclose which specific AI sub-processors or models power features, though Flip Lenses are mentioned.
Jurisdiction & Residency
Q18Does the vendor disclose where data is stored and which privacy regimes it complies with?
✓ Good
T3
Answer: Yes
“Personal information collected by Flip may be stored and processed in your region, in the United States, and in any other country where Flip or our affiliates, or service providers operate facilities. We take steps to ensure that the personal information we collect under this privacy policy is processed according to the provisions of this policy and the requirements of applicable law wherever the data is located.”
Storage locations mentioned; compliance with COPPA, GDPR, CCPA, and UK/Swiss data protection laws referenced throughout.
Jurisdiction & residency — Nord Anglia footprint
Vendor named 1 of 11 Nord Anglia countries. Shown alongside the verdict, not folded into the score —
a vendor can be strong on privacy yet leave residency gaps for specific countries.
“Personal information collected by Flip may be stored and processed in your region, in the United States, and in any other country where Flip or our affiliates, or service providers operate facilities. We take steps to ensure that the personal information we collect under this privacy policy is processed according to the provisions of this policy and the requirements of applicable law wherever the data is located.”
| Country | Privacy law | Coverage |
|---|
| MexicoLatAm | LFPDPPP | ⚠ Gap |
| Costa RicaLatAm | Law 8968 | ⚠ Gap |
| PanamaLatAm | Law 81/2019 | ⚠ Gap |
| Dominican RepublicLatAm | Law 172-13 | ⚠ Gap |
| BrazilLatAm | LGPD | ⚠ Gap |
| ColombiaLatAm | Ley 1581/2012 | ⚠ Gap |
| EcuadorLatAm | LOPDP (2021) | ⚠ Gap |
| PeruLatAm | Law 29733 | ⚠ Gap |
| ChileLatAm | Law 21.719 | ⚠ Gap |
| UruguayLatAm | Law 18.331 | ⚠ Gap |
| United States | FERPA / COPPA | ✓ Named |
| GDPR (overlay) | Nord Anglia is UK-headquartered, global | ✓ Named |