Privacy Policy

Effective date: Draft, September 2026
Last updated: Draft, September 2026

EasyExchange is a product of CommonSky Group Inc., a Delaware corporation ("CommonSky," "we," "us"). This policy explains what information we collect, how we use it, and the choices you have. We wrote it in plain language because teachers, school administrators, and parents should be able to read it without a lawyer.

If anything here is unclear, email us at hello@easy-exchange.app.

1. What this policy covers

This policy applies to:

• The EasyExchange website at easy-exchange.app
• The EasyExchange platform, where teachers connect their classrooms with classrooms in other schools for structured written and audio exchanges

It does not cover other CommonSky Group products, which have their own policies.

2. Who uses EasyExchange

Teachers create accounts using a school-affiliated email address. We verify every teacher account before it goes live.

Students do not sign up on their own. A student joins EasyExchange only through a class link or code provided by their teacher. EasyExchange is built for high school students. We do not knowingly allow students under 13 to use the platform, and where local law sets a higher age for a student to consent on their own, the school or teacher is responsible for obtaining parental consent before adding that student.

Schools and districts may enter into a separate written agreement with us. Where a school agreement or data processing agreement exists, it takes precedence over this policy for that school's data.

3. Information we collect

From teachers

• Name, school email address, and password (passwords are handled by our authentication provider and are never visible to us)
• School name and location
• Subject and grade levels taught
• Classes you create, students you enroll, and partner classrooms you pair with
• Task templates, prompts, and other content you create
• Messages you send on the platform

From students

• Name and email address (an email address is required to log in)
• Class membership
• Written messages, audio recordings, and comments posted in exchanges
• Responses to teacher-assigned tasks

We collect only what is needed to run the exchange. We do not ask students for their home address, phone number, date of birth, or any other personal details beyond name and email.

From website visitors

• Information you submit through our forms (pilot application, partner school inquiry, contact form): name, email, school, and the content of your message
• Basic, non-identifying usage information about how the website is used (see Section 9)

Collected automatically

When you use the platform, our systems record technical information such as IP address, browser type, device type, pages visited, and timestamps. We use this to keep the service running, secure, and reliable.

4. How we use information

We use information to:

• Provide the EasyExchange service, including connecting paired classrooms
• Verify that teacher accounts belong to real educators at real schools
• Let teachers see and manage everything that happens in their classes
• Respond to your questions and requests
• Keep the platform secure and prevent misuse
• Improve the service, using aggregated or de-identified information where possible
• Meet our legal obligations

We do not:

• Sell personal information, ever
• Use student information for advertising or marketing of any kind
• Build profiles of students for any purpose other than delivering the service to their class
• Share student information with anyone outside the exchange except as described in Section 6

5. How student data works inside an exchange

EasyExchange is teacher-controlled from start to finish.

• A student's messages are visible to the student's own teacher, the partner classroom's teacher, and the students in the paired classes participating in that exchange.
• Teachers can see every message, recording, and comment in their classes. Nothing happens outside a teacher's view.
• Only teachers can create classes, pair classrooms, assign tasks, and add or remove students.
• Students cannot search for or contact users outside their assigned exchange.

6. When we share information

We share information only in these situations:

With the partner classroom. An exchange is, by design, a connection between two classrooms. Content a student posts in an exchange is shared with the paired class and its teacher. That partner classroom may be in another country (see Section 7).

With service providers. We use trusted companies to host and run EasyExchange. They process data only on our instructions and are bound by contracts that protect your information. Our current providers are:

• Google Cloud and Firebase (hosting, database, and authentication)
• Vercel (website hosting)
• Google Workspace (email and internal documents)

With schools. Where a school or district has an agreement with us, we share information about its own teachers and students with that school on request.

When required by law. We may disclose information if required by a valid legal process, or to protect the safety of a student or other person.

In a business transfer. If CommonSky is acquired or merges with another company, information may transfer as part of that transaction. We would notify affected schools before student data changes hands.

7. International transfers

EasyExchange connects classrooms across borders. When a class in one country pairs with a class in another, exchange content is shared between the two, and this cross-border sharing is inherent to the service.

Our servers are located in the United States. For users in the European Union, United Kingdom, and other regions with data transfer rules, we rely on the EU–U.S. Data Privacy Framework (our providers are certified participants) and on Standard Contractual Clauses as a backup mechanism. Schools in the EU may request a copy of our transfer safeguards.

We are aware that some countries and regions have additional expectations for educational tools, and we are working toward hosting options that meet them. Schools with specific residency requirements should contact us before onboarding.

8. How long we keep information

• Student records and exchange content are deleted within 90 days after a teacher or school asks us to delete them, or automatically 12 months after the class's last activity, whichever comes first.
• Teacher accounts and teacher-created content (task templates, prompts) are kept while the account is active and deleted within 90 days after the account is closed, unless the teacher chooses to keep templates in the shared library.
• Website form submissions are kept for up to 24 months so we can follow up, then deleted.
• Technical logs are kept for up to 90 days for security and troubleshooting.

We may keep de-identified or aggregated information, which cannot be linked back to any person, for longer.

9. Cookies and analytics

The platform uses cookies that are necessary to keep you logged in and to keep the service secure. It does not use advertising cookies or third-party trackers.

Our public website may use a basic analytics tool to understand overall traffic (pages viewed, general location by country, referring site). We configure it so that IP addresses are anonymized and no personal information is collected. We do not use analytics inside the platform where students are present.

10. Security

We protect information with measures including encryption in transit and at rest, access controls that limit who at CommonSky can see personal data, verified teacher accounts, and regular review of our providers' security practices. No system is perfectly secure, and if we learn of a breach affecting your information we will notify affected schools and users promptly and as required by law.

11. Your rights and choices

Teachers can view and update their account information at any time, and can delete their account by contacting us.

Students and parents can ask to see, correct, or delete a student's information. Because schools control student enrollment, we will usually route these requests through the student's teacher or school, and we will honor a school's instruction to delete.

Under FERPA (United States): when a school uses EasyExchange, we act as a "school official" with a legitimate educational interest, under the school's direct control regarding the use of education records. The school retains ownership of its student data. We use it only for the purposes the school authorizes.

Under GDPR (European Union): schools are typically the controller of student data and CommonSky acts as processor on the school's instructions. Individuals have the right to access, correct, delete, restrict, or port their data, and to object to certain processing. You can exercise these rights by contacting us or your school. You also have the right to lodge a complaint with your national data protection authority.

Under U.S. state student privacy laws (including California, Colorado, Connecticut, Illinois, New York, and others): we comply with applicable requirements regarding the use, protection, and deletion of student data, and we do not use student data for targeted advertising or to build commercial profiles.

To make any request, email hello@easy-exchange.app. We will respond within 30 days.

12. Parental consent

In some countries, students below a certain age (for example, 16 in Germany, 15 in France, 14 in Spain) cannot consent to data processing on their own. Where this applies, the school or teacher is responsible for obtaining the required consent before adding a student to EasyExchange. We are building a consent tool to make this easier for teachers; until it launches, schools should use their own consent process.

13. Children under 13

EasyExchange is not directed to children under 13 and we do not knowingly collect their information. If you believe a child under 13 has been added to the platform, contact us and we will remove the account and its data.

14. Changes to this policy

We may update this policy as the service grows or laws change. We will post the updated version here with a new effective date, and we will notify schools by email of any material changes at least 30 days before they take effect.

15. Contact us

CommonSky Group Inc.
c/o Northwest Registered Agent Service, Inc.
8 The Green, STE B
Dover, DE 19901
United States
hello@easy-exchange.app

For schools in the EU that need a data processing agreement or transfer documentation, use the same address.