Main Menu

Privacy Notice

Effective Date: July 7, 2026

1. Overview and Our Principles

e4usa recognizes and values the privacy of our community members and guests, and we strive to be leaders and set the standard in how we manage personal information.

In principle, e4usa strives to:

  • Collect, store, and use the minimum amount of personal information necessary for our legitimate business purposes, and to comply with legal obligations.
  • Take reasonable steps to ensure the personal information we manage is accurate and up-to-date.
  • Limit who has access to personal information in our possession to only those who need it for a legitimate, specific purpose.
  • Protect personal information through appropriate physical and technical security measures tailored to the sensitivity of the personal data we hold.
  • Communicate with our students, faculty, employees, suppliers, partners, and others about how we use personal information in our day-to-day operations, with transparency as a core principle.
  • Use personal information only for the purposes for which it was collected.
  • Provide opportunities to control personal information, as permitted by applicable United States and other laws.
  • Integrate privacy into the design of our activities whenever they involve the use of personal data.

2. Scope

This Privacy Notice applies to all of e4usa's services and offerings (collectively, the "Services"), including:

  • Our public websites, including e4usa.org;
  • The e4usa HUB;
  • MyDesign, our web-based learning management system (LMS) purpose-built to support engineering design education, which enables students and educators to collaborate on design projects through features such as project teams, virtual collaboration spaces, ePortfolios, scoring rubrics, and student–teacher communication tools, and which can operate as a standalone platform or integrate with existing district LMS platforms (such as Canvas or Blackboard) using standard protocols like LTI, JWT, and OIDC;
  • Our curriculum, professional development programs, and related program activities.

We recognize that school districts entrust us with student and educator data, and we take that responsibility seriously.

3. Data We Collect

Depending on the Services you use, e4usa may collect the following categories of information:

  • Account information: Names, email addresses, school affiliation, and role (student or educator).
  • Student work and coursework: Design projects, assignments, submissions, ePortfolio content, and related materials that students create or upload within our platforms.
  • Usage data: Information about how users interact with our Services, including pages visited, features used, and time spent on activities. This data helps us improve our Services and support teaching and learning.
  • Program and communications data: Information provided to us when registering for or participating in e4usa programs, professional development, or events, or when contacting us.
  • Website analytics data: Anonymous usage statistics about our public websites, as described in Section 10.

4. How We Use This Data

We use the personal information collected through our Services solely for the following purposes:

  • Providing and operating our Services, including MyDesign, for participating school districts and program participants.
  • Supporting instruction, coursework, and assessment within e4usa programs.
  • Improving our Services' functionality, performance, and educational effectiveness.
  • Communicating with educators, district administrators, and program participants about their accounts, programs, and our Services.
  • Evaluating student and teacher outcomes, the outcomes and efficacy of e4usa Professional Development, and the implementation of the e4usa course across geographically and demographically diverse sites, using de-identified data.
  • Complying with applicable legal obligations.

5. Our Commitments

We do not use student personal information for advertising or marketing purposes. We do not sell personal information. We do not build profiles of students for purposes unrelated to their education. We do not share your personal information without affirmative consent, except as necessary to operate our Services, as required by law, or with the explicit consent of the school district.

With specific regard to mobile phone numbers, no mobile phone number information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

6. Student Privacy: FERPA, COPPA, and State Laws

FERPA Compliance

Where our Services involve student education records, we operate in compliance with the Family Educational Rights and Privacy Act (FERPA). When a school district partners with e4usa, e4usa functions as a "school official" with a "legitimate educational interest" under FERPA, as defined in the district's annual FERPA notification or as specified in our agreement with the district.

Under this relationship:

  • Education records within our Services remain under the control of the school district.
  • e4usa accesses and uses student education records only for the purposes authorized by the district.
  • Parents and eligible students retain all rights under FERPA, including the right to inspect, review, and request amendment of education records. These requests should be directed to the student's school district, which will coordinate with e4usa as needed.

COPPA Compliance

Our Services are designed primarily for high school students and educators. To the extent that any student under the age of 13 uses our Services as part of a school program, we comply with the Children's Online Privacy Protection Act (COPPA):

  • We collect personal information from students under 13 only in the context of school-authorized educational activities, and we rely on the school or district to provide consent on behalf of parents, consistent with FTC guidance for the use of online services in schools.
  • Personal information collected from students under 13 is used solely for educational purposes authorized by the school or district — never for advertising, marketing, profiling, or any other commercial purpose.
  • We collect only the information reasonably necessary for students to participate in the educational activity, and we do not condition participation on the disclosure of more information than is necessary.
  • Parents may review the personal information collected from their child, request its deletion, and refuse to permit further collection by contacting their school district, which will coordinate with e4usa, or by contacting us directly using the information in Section 12.
  • We do not knowingly collect personal information from children under 13 outside of a school-authorized context. If we learn that we have done so, we will delete that information promptly.

State Student Privacy Laws

e4usa is committed to complying with applicable state student privacy laws in the jurisdictions where participating school districts are located. We work with districts to meet their obligations under state-specific requirements, including entering into data privacy agreements where required by state law.

7. Data Security

e4usa has completed a SOC 2 Type 2 audit, conducted by an independent auditor, covering the security of e4usa's business processes and systems, including the environments supporting our Services. The safeguards described below apply across e4usa's operations. School districts may request a copy of our SOC 2 report by contacting us; a non-disclosure agreement is required prior to release.

We implement administrative, technical, and physical safeguards to protect personal information, including:

  • Encryption: All data is encrypted in transit and at rest.
  • Access controls: Role-based access following the principle of least privilege, with quarterly access reviews.
  • Monitoring and threat detection: Continuous monitoring of infrastructure and application security.
  • Vulnerability management: Regular vulnerability scanning with defined remediation timelines based on severity.
  • Incident response: A documented incident response plan with defined escalation procedures.
  • Personnel security: Background checks for employees with access to student data, along with annual security awareness training.
  • Risk assessments: Annual formal risk assessments to identify and address potential threats to data security.

8. Third-Party Services and Hosting

Our web application platforms are hosted on cloud infrastructure, primarily Amazon Web Services (AWS), which processes data on our behalf under a data processing agreement. Where a Service is hosted on other infrastructure, we apply the same security controls described in Section 7 and require comparable data protection commitments from our infrastructure providers. Student data is not transmitted outside the e4usa environment except over encrypted HTTPS connections.

We do not share student personal information with any other third parties except as necessary to operate our Services, as required by law, or with the explicit consent of the school district.

9. Data Retention and Deletion

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected or as required by our agreement with the school district. Data retained for research or evaluation purposes is de-identified — identifying information is replaced with a generic non-identifying number before data is input and/or aggregated into analysis files — and is retained for no longer than seven (7) years after the completion of the applicable study, then destroyed.

When a district's participation ends or upon a district's request at any time, we will delete or de-identify student personal information in accordance with our data retention policies and applicable law. School districts may request the deletion of student data at any time by contacting us using the information provided in Section 12.

10. Website Analytics, Cookies, and Tracking

e4usa uses the following tools to help us understand how visitors interact with our public websites:

  • Google Tag Manager: We use Google Tag Manager to manage and deploy tracking scripts on our website. Google Tag Manager itself does not collect or store your personal data; it simply helps us manage other tools like Plausible Analytics.
  • Plausible Analytics: We use Plausible Analytics to collect anonymous usage statistics about our website. Plausible is a privacy-friendly analytics tool that does not use cookies and does not collect any personally identifiable information. The data collected includes anonymous information such as page views, referrer sources, and general geographic location (country level only).
  • PostHog: We use PostHog to help us understand user behavior and improve our website experience. PostHog collects anonymous information about how visitors interact with our site, including page views, feature usage, and user flows. We've configured PostHog to minimize data collection and anonymize user information.

We use this anonymous information to improve our websites' content and user experience. We do not use this data to personally identify you, and we do not combine it with other personal information. All analytics data is stored securely and is only accessible to authorized e4usa personnel.

Our websites use only essential cookies necessary for the websites to function properly. We respect your "Do Not Track" browser settings. Through our consent management system, we ask for your permission before loading any non-essential scripts or cookies. You can change your preferences at any time by clicking on the "Privacy Preferences" link in the footer of our website.

11. Your Rights

School districts partnering with e4usa may:

  • Request access to student education records maintained within our Services.
  • Request correction of inaccurate student information.
  • Request deletion of student data.
  • Receive information about our data collection and privacy practices.

Parents and eligible students who wish to exercise their rights under FERPA or applicable state law should contact their school district, which will work with e4usa to fulfill those requests. Other individuals may contact us directly using the information in Section 12 to inquire about or exercise rights regarding their personal information, as permitted by applicable law.

12. Contact Us

If you have any inquiries or requests, please contact us here. Security concerns may be reported at https://e4usa.org/contact/report-a-security-concern.

In order to be able to reply to requests for the exercise of rights, and if we are not certain of your identity, we may need to ask you for further identification data, to be used only for the purposes of replying to your request.

Back to Top