Privacy Policy

1. Information We Collect

Cognitano collects information you provide directly, such as your name, email address, and role (student, parent, or admin). We also collect learning activity data including item attempts, scores, mastery levels, and lesson progress to deliver personalized learning experiences.

2. How We Use Your Information

We use your information to provide and improve our adaptive learning platform, including calculating skill mastery, generating personalized recommendations, and enabling parent oversight of student progress. AI-assisted features use your learning data to generate hints, explanations, and feedback; AI never makes authoritative scoring or progression decisions.

3. Data Security

All data is stored securely using Supabase Cloud with PostgreSQL, protected by Row Level Security (RLS) policies that ensure users can only access data they are authorized to see. All communications are encrypted in transit using TLS, and we follow industry-standard security practices.

4. Data Sharing

We do not sell your personal information. We share student learning data only with linked parent accounts (upon student approval) and platform administrators. AI providers receive anonymized prompts for generating educational assistance; they do not receive personally identifiable information.

5. Children's Privacy (COPPA & FERPA)

Cognitano takes the privacy of minor students with the utmost seriousness. Our platform is built from the ground up to comply with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. 6501–6506; 16 CFR Part 312 & 2026 FTC amendments) and theFamily Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g; 34 CFR Part 99).

5.1 Direct Notice to Parents & Guardians (16 CFR § 312.4)

Before collecting any personal information from a child under 13, Cognitano provides direct notice to parents and guardians regarding our data practices:

• Information Collected: Student first and last name, date of birth (for age verification and grade placement), learning responses, accuracy records, response latency, capability progress, and visual presentation skin preferences.
• Strictly Prohibited Data: Cognitano strictly prohibits the collection of biometric identifiers, facial recognition data, geolocation tracking, racial/ethnic origin, religious affiliation, or financial information from minor students.
• Zero Advertising & Commercialization: We never sell student data, never build behavioral ad profiles, and never serve commercial advertisements to learners.
• Anonymized AI Isolation (Layer 5): Generative AI features operate strictly as pedagogical scaffolding assistants. Prompts dispatched to AI providers are stripped of all student PII. AI never makes binding scoring, mastery, or progression decisions.

5.2 Verifiable Parental Consent (VPC, 16 CFR § 312.5)

Students under 13 cannot access learning modules, assessments, or save progress until a parent or guardian provides Verifiable Parental Consent through our secure Parental Consent Portal. Parents can choose granular preferences, including whether to enable or disable Layer 5 AI-assisted scaffolding for their child.

5.3 Parental Rights to Inspect, Export, and Delete (16 CFR § 312.6)

Parents and legal guardians retain continuous, enforceable rights over their child's records:

• Right to Review & Inspect: Parents can view all student activity, attempts, and mastery scores in real time via the Parent Dashboard.
• Machine-Readable Data Portability: Parents can download a full, structured JSON archive of their child's complete learning history at any time.
• Right to Revoke & Delete: Parents can revoke consent or request hard cascade erasure of all personal records with zero orphaned data.

5.4 Institutional FERPA Compliance (School Official Exception, 34 CFR § 99.31)

When Cognitano is utilized in schools, school districts, or educational institutions:

• Cognitano acts as an authorized "School Official" performing institutional educational services under the direct control of the school regarding student education records.
• Student education records are accessed and maintained strictly for authorized educational purposes and are never redisclosed or commercialized.
• We support institutional Student Data Privacy Agreements (DPAs) adhering to Student Data Privacy Consortium (SDPC) national standards.

For complete direct notice schedules, model DPAs, and parental verification instructions, visit our dedicated COPPA & FERPA Compliance Center or contact FORNITO at info@fornito.com.

6. Automated Decision-Making (ADM) Transparency

Under the Privacy Act 1988 (Cth) (incorporating the Privacy and Other Legislation Amendment Act 2024), organisations must provide clear and transparent disclosures regarding automated decision-making (ADM) processes that significantly affect an individual's rights or interests. Cognitano is fully committed to total transparency, deterministic accountability, and human oversight.

6.1 Personal Information Used in Automated Decisions

Cognitano uses only directly relevant, minimal learning interaction data for automated decisions:

• Assessment Responses: Answers submitted to diagnostic, practice, and milestone questions.
• Scoring and Accuracy Records: Historical performance, attempt counts, and timestamped response latencies.
• Prerequisite Fulfillment Status: Verification of completed cognitive building blocks in the capability graph.
• Presentation Preferences: Selected skin profiles, reading level adjustments, and accessibility settings.

Strict Exclusion: Cognitano strictly prohibits the collection or use of sensitive biometrics, facial recognition, racial or ethnic origin, religious beliefs, political opinions, health records, or socio-economic indicators in any automated decisions.

6.2 Kinds of Automated Decisions Made

6.3 Architectural Guarantee: Non-Authoritative AI

Cognitano enforces a strict Five-Layer Architecture. All authoritative scoring, capability mastery, progression gating, and readiness determinations are made exclusively by deterministic, rule-based algorithms in Layers 1–3. Generative AI models operate strictly in Layer 5 (scaffolding hints, concept explanations, and reading simplification). AI models are strictly prohibited from scoring answers, granting mastery, or making decisions that affect student progression.

6.4 Meaningful Human Oversight & Right to Request Human Review

Automated decisions never operate in isolation from human educators. Teachers and linked parents retain real-time visibility, granular reporting, and administrative override authority over any automated placement or progression milestone.

Under Australian Privacy Principles, students, parents, and guardians have the explicit legal right to:

• Request a plain-language explanation of any automated scoring, mastery, or gating decision.
• Request formal human review or appeal of an automated decision by a qualified human educator or administrator.
• Request manual correction of underlying assessment responses or mastery history if data is inaccurate.

7. Your Rights

You have the right to access, correct, or delete your personal information. You can also request a copy of your data, restrict certain processing activities, or request human review of automated decisions. To exercise these rights, please contact our Privacy & Governance Officer at info@fornito.com or submit an appeal directly through our ADM Transparency Portal.

8. Contact Us & Governance Inquiries

If you have questions about this Privacy Policy, our automated decision-making transparency disclosures, or your rights under the Australian Privacy Act, please contact: