Last updated: July 4, 2026
Schools trust Canopy with sensitive information, sometimes including information about students and minors. We take that seriously. This page explains our commitments and how we handle student data. It supplements our Privacy Policy and controls over it in the event of any conflict regarding student data. Canopy is operated by Global Cloudr, Inc.
Our core commitments
- Student data belongs to the school. We act as a service provider processing student data on the school’s behalf and under its direction. We do not own it and do not use it for our own purposes.
- No selling. No advertising. We do not sell student data and do not use it for targeted advertising or to build profiles for any purpose other than providing the service.
- No training on student data. We do not permit our AI subprocessors to use student or school content to train their models beyond what is necessary to provide the service.
- Access is limited. Access to student data is restricted to authorized personnel and scoped to what is needed to provide and support the service, with role-based and workspace-scoped controls and audit logging.
- Deletion on request. Schools may request export or deletion of their data, and we delete data in the ordinary course after a school’s account ends, subject to legal retention obligations.
FERPA
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. When a school uses Canopy to process education records, Canopy acts as a “school official” with a legitimate educational interest, performing a service the school would otherwise perform itself, under the school’s direct control. Consistent with FERPA, we:
- use education records only to provide the service to the school;
- do not re-disclose education records except as directed by the school or as permitted by law; and
- support the school in meeting its FERPA obligations, including access and deletion requests.
COPPA
The Children’s Online Privacy Protection Act (COPPA) applies to the online collection of personal information from children under 13. Canopy is a service provided to and directed by schools, not marketed to children. For students under 13, the school provides consent on behalf of parents for the school’s use of Canopy for legitimate educational purposes, consistent with FTC guidance. We collect children’s information only as needed to provide the service to the school and handle it under the protections described here.
Photos and media
Canopy PhotoVault stores school photos, which may include images of students. Images are stored in access-controlled, workspace-scoped storage; sharing is done through school-controlled, expiring, revocable share links. Schools are responsible for obtaining any photo/media consents required by their policies and applicable law.
Security measures
- Encryption of data in transit and encryption at rest for stored third-party credentials.
- Role-based and workspace-scoped access controls that prevent one school from accessing another’s data.
- Audit logging of sensitive actions.
- Error monitoring and rate limiting to detect and limit abuse.
- A documented process for responding to security incidents, and a commitment to notify affected school clients without undue delay after we confirm a security breach affecting their data.
Data location and providers
Canopy runs on established cloud infrastructure and a limited set of vetted subprocessors. A current subprocessor list, including hosting locations, is available to school clients on request.
Your school’s rights
Schools may, at any time: request a copy or export of their data; request correction or deletion; ask questions about our practices; and receive reasonable assistance responding to parent/student requests. To exercise these rights, contact us below or your Canopy account contact.
Contact
Student-data questions or requests: robert@globalcloudr.com, or Global Cloudr, Inc., 131 Wilton Dr., #1, Campbell, CA 95008.