AI Data Handling

This page explains how Pearl Education handles Customer Content and Student Data when AI-enabled features in the Products process that data. These commitments apply to all AI features described in Pearl’s AI Use Disclosure and are grounded in Pearl’s customer agreements.

Core Data Commitments

Pearl does not use identifiable Student Data, curriculum content, session recordings, or other Customer Content to train AI models.

Pearl does not sell Student Data.

Pearl does not use Student Data for targeted or behavioral advertising directed at students or their families (MSA §5.7; DPA §4.2).

These are absolute limits — they apply regardless of the AI feature, the model vendor, or the configuration used.

How AI Features Are Authorized to Process Customer Content

When AI-enabled features operate on Customer Content — including Student Data — they do so under the limited license the Customer grants Pearl to host and process Customer Content to provide the Services (MSA §4.2). AI processing of Customer Content is:

  • Solely on Customer’s behalf (MSA §7.1)
  • For the purpose of providing the Services to that Customer
  • Subject to the same purpose-limitation and prohibited-use restrictions as all other processing (DPA §4.1–4.2)

AI feature outputs are provided for Customer’s use. Pearl does not use AI-generated insights or outputs from one customer’s data to benefit another customer.

De-identified and Aggregated Data

Pearl may create and use De-identified Data and Statistical Data (data in aggregated or de-identified form, from which all personally identifiable information has been removed) for service improvement, benchmarking, and educational research. This use is expressly permitted by and described in MSA §6 and DPA Article V, and is supported by Customer’s authorization under MSA §5.6.

Pearl applies a documented de-identification methodology — using either expert determination or identifier-removal with a reasonable-basis determination — consistent with FERPA, 34 C.F.R. §§ 99.3 and 99.31(b), before any such use (MSA §6.3). Third parties who receive Research Data (de-identified data shared for educational research) must sign data use agreements that prohibit re-identification (MSA §6.4).

This is not the same as using identifiable Student Data to train AI models, and Pearl does not do the latter.

AI Subprocessors and Model Providers

Pearl may engage third-party AI model providers or other technology vendors as subprocessors to power AI features in the Products. All subprocessors that process Customer Content are bound by written confidentiality and data-protection obligations no less protective than Pearl’s customer agreements (MSA §4.4; DPA §2.5). Pearl remains responsible for its subprocessors’ performance.

Pearl’s subprocessor list is published on the Subprocessors page and may also be requested directly (MSA §4.4; DPA §2.5).

Data Retention by AI Providers

Pearl configures its AI model usage for zero data retention (ZDR): prompts and inputs sent for inference are not stored or logged by the model service, and no Customer Content is used to train or improve any model (MSA §4.4; DPA §2.5). This is consistent with Pearl’s commitment above that identifiable Student Data is not used for AI model training. Amazon Bedrock does not retain inference inputs or outputs and does not share them with the company that created the underlying AI model.

Same Protections as Core Product Data

Customer Content processed by AI features receives the same contractual data protections as all other Customer Content in the Products:

  • Encryption in transit and at rest (MSA §4.3; DPA §6.2)
  • Least-privilege access controls (MSA §4.3; DPA §6.2)
  • Security incident notification within 72 hours of confirming a breach of unencrypted Customer Content, with a 5-business-day supplemental notice (MSA §4.5; DPA Art. VII)
  • Export and deletion: Customer Content available for export for 30 days after termination; deleted no later than 60 days after that export period; written deletion certification available on request (MSA §4.6; DPA Art. VIII)
  • Subprocessor flow-down: AI model providers and other subprocessors are bound by obligations no less protective than the customer agreements (MSA §4.4; DPA §2.5)
  • No sale, no behavioral advertising, no commercial student profiles (MSA §5.7; DPA §4.2)

What Pearl Does Not Do With AI and Student Data

What Pearl will not do Source
Use identifiable Student Data, curriculum content, or session recordings to train AI models MSA §5.7; DPA §4.2
Sell Student Data MSA §5.7; DPA §4.2
Use Student Data for targeted or behavioral advertising MSA §5.7; DPA §4.2
Build or sell commercial profiles of students MSA §5.7; DPA §4.2
Use identifiable Student Data to develop unrelated commercial products MSA §5.7(d); DPA §4.2(d)
Process Customer Content for Pearl’s own benefit outside of what the agreements permit MSA §4.2; §7.1

Contact

Questions about how AI features handle data can be sent to: