Lumina Learn
Round 1 · Privacy Triage · Privacy Triage — Round 1 · assessed
🟢 Approved
Privacy score 91.1% · band Best
All 9 mandatory gates clean; privacy score 91.1% (Best). Confident to use on the strength of the public privacy policy — Round 2 not required. Scope note: 1 question(s) in the current rubric were not assessed in this run — Q19 (Data Security). The evidence predates them, so they are excluded from the 91.1% rather than scored as silence. Re-run the extractor to close the gap.
Quote check: not run on this record. It was read before the check existed. Re-vet the vendor to run it.
Dimension scorecard
| Dimension | Score | |
|---|
| Data Collection GATE |
| 100.0% |
| Data Sharing GATE |
| 100.0% |
| Data Sold GATE |
| 100.0% |
| Data Rights GATE |
| 73.3% |
| Data Safety GATE |
| 100.0% |
| Data Security | n/a | — |
| Ads & Tracking GATE |
| 100.0% |
| Parental Consent |
| 20.0% |
| School Purpose |
| 100.0% |
| AI & Model-Training GATE |
| 100.0% |
| Jurisdiction & Residency |
| 100.0% |
Findings — 19 questions, every answer cited
Data Collection
Q1Does the vendor limit collection/use of information to only data required for the product? GATE
✓ Good
T3
Answer: Yes
“Simulated policy statement (demo vendor) answering Q1.”
Q2Does the vendor collect PII beyond what's necessary for the stated educational purpose?
✓ Good
T3
Answer: No
“Simulated policy statement (demo vendor) answering Q2.”
Q3Does the vendor collect a user's photo or any other visual likeness?
✓ Good
T3
Answer: No
“Simulated policy statement (demo vendor) answering Q3.”
Q4Does the vendor track a user's exact physical location (GPS-precision geolocation)?
✓ Good
T3
Answer: No
“Simulated policy statement (demo vendor) answering Q4.”
Data Sharing
Q5Does the vendor limit data sharing with third parties to the purpose for which it was collected? GATE
✓ Good
T3
Answer: Yes
“Simulated policy statement (demo vendor) answering Q5.”
Q6Does the vendor impose contractual limits on how third parties use shared personal information? GATE
✓ Good
T3
Answer: Yes
“Simulated policy statement (demo vendor) answering Q6.”
Data Sold
Q7Is users' personal information ever sold or rented to any outside party? GATE
✓ Good
T3
Answer: No
“Simulated policy statement (demo vendor) answering Q7.”
Data Rights
Q8Do the student / educator / parent / school retain ownership of data and IP of uploaded content? GATE
✓ Good
T3
Answer: Yes
“Simulated policy statement (demo vendor) answering Q8.”
Q9Can the user delete all of their PII and personal information from the vendor?
✗ Concern
T3
Answer: No
“Simulated policy statement (demo vendor) answering Q9.”
Q10Does the vendor auto-delete data after a defined period of inactivity (data sunset)?
✓ Good
T3
Answer: Yes
“Simulated policy statement (demo vendor) answering Q10.”
Data Safety
Q11Can students contact or interact with UNKNOWN users (strangers / the general public) in environments NOT supervised by a teacher or school? (Teacher-managed or within-class interaction, and content-only sharing, do NOT count.) GATE
✓ Good
T3
Answer: No
“Simulated policy statement (demo vendor) answering Q11.”
Ads & Tracking
Q12Does the vendor display behavioral or targeted advertising to students inside the product? (Sending product/marketing emails to account holders does NOT count.) GATE
✓ Good
T3
Answer: No
“Simulated policy statement (demo vendor) answering Q12.”
Q13Does the vendor pass student personal information to outside companies for those companies' advertising or ad-targeting purposes? GATE
✓ Good
T3
Answer: No
“Simulated policy statement (demo vendor) answering Q13.”
Parental Consent
Q14For children 13 and under, does the vendor either restrict personal-information collection or first obtain parental/school consent?
✗ Concern
T3
Answer: No
“Simulated policy statement (demo vendor) answering Q14.”
School Purpose
Q15Does the vendor state the product is intended for students in preschool or preK-12?
✓ Good
T3
Answer: Yes
“Simulated policy statement (demo vendor) answering Q15.”
AI & Model-Training
Q16Does the vendor use student/user data — including uploaded content — to train, fine-tune, or improve AI/ML models? GATE
✓ Good
T3
Answer: No
“Lumina Learn does not use customer or student content to train AI or machine-learning models.”
Q17Does the vendor disclose which AI sub-processors/models power its features and any automated decisions affecting students?
✓ Good
T3
Answer: Yes
“Simulated policy statement (demo vendor) answering Q17.”
Jurisdiction & Residency
Q18Does the vendor disclose where data is stored and which privacy regimes it complies with?
✓ Good
T3
Answer: Yes
“Simulated policy statement (demo vendor) answering Q18.”
Data Security
Q19Does the vendor disclose baseline security safeguards — encryption of data in transit and at rest — and commit to notifying the school of a data breach?
? Not addressed
T0
Answer: not assessed
Jurisdiction & residency — your footprint
Vendor named 1 of 4 countries in your footprint. Shown alongside the verdict, not folded into the score —
a vendor can be strong on privacy yet leave residency gaps for specific countries.
“Data is stored in the United States; Lumina Learn complies with FERPA, COPPA and GDPR.”
| Country | Privacy law | Coverage |
|---|
| United States (federal) | FERPA / COPPA / PPRA | ✓ Named |
| Illinois | SOPPA | ⚠ Gap |
| Texas | Texas Education Code ch. 32 (student data privacy) | ⚠ Gap |
| California | SOPIPA / CCPA | ⚠ Gap |
| GDPR (overlay) | Applies when a school holds data on EU or UK students, families or staff | ✓ Named |