Effective Date: March 1, 2026
This is a single combined Privacy Policy for EdisonOS. It is organised into two parts:
Both parts are binding. If you are a school or tutoring company using EdisonOS with students, both parts apply to your use.
This Part A applies to all visitors to edisonos.com and to all business users - tutors, tutoring companies, community-based organizations (CBOs), and school & district administrators who create an account or purchase an EdisonOS subscription.
EdisonOS is an assessment software operated by Kalvi Software, Inc., a C-Corporation registered in Delaware, USA (the "Company," "we," "us," or "our").
Platform development and engineering support are provided by TeachEdison Solutions Pvt Ltd, a private limited company incorporated in India. It acts as an authorized sub-processor under a Data Processing Agreement with Kalvi Software, Inc. and is not the data controller for any user data.
Data Controller: Kalvi Software, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, United States
Privacy Contact: privacy@edisonos.com
A2.1 Account and Identity Data
When you register for an EdisonOS account or book a demo, we collect:
A2.2 Billing and Payment Data
EdisonOS uses Stripe, Inc. as its payment processor. When you enter payment details:
A2.3 Usage and Engagement Data
When you use the EdisonOS platform, we automatically collect:
A2.4 Communications Data
This data is used to operate the platform, diagnose issues, and improve functionality.
A2.5 Cookies and Tracking Technologies
EdisonOS uses the following types of cookies:
We do not use advertising cookies or sell data to ad networks. You can manage non-essential cookies through your browser settings. Note that disabling essential cookies will prevent you from logging in.
EdisonOS integrates Stripe to process all subscription payments. By purchasing an EdisonOS subscription, you acknowledge that:
Your Stripe data is not used for any advertising or marketing purpose by EdisonOS.
A5.1 Subscription terms
EdisonOS subscriptions are billed monthly or annually as selected at checkout. Subscriptions renew automatically at the end of each billing period unless cancelled.EdisonOS integrates Stripe to process all subscription payments. By purchasing an EdisonOS subscription, you acknowledge that:
A5.2 Cancellation
You may cancel your subscription at any time by contacting support@edisonos.com or through your account settings. Cancellation takes effect at the end of the current billing period. You will retain access to the platform until that date.EdisonOS integrates Stripe to process all subscription payments. By purchasing an EdisonOS subscription, you acknowledge that:
A5.3 Refunds
Annual subscriptions: Refund requests submitted within 14 days of the initial purchase will be honoured in full. Requests after 14 days are handled on a case-by-case basis.
Monthly subscriptions: No refunds are issued for the current billing period upon cancellation. Access continues until the period ends.
To request a refund, email support@edisonos.com with your account email and reason.
A5.4 Data after cancellation
Upon cancellation, your account data and student data are retained for 60 days to allow export, after which they are securely deleted. See Part B, Section 8 for student data retention details.
We do not sell your personal data. We share business user data only in the following circumstances:
All third-party sub-processors are bound by contracts that prohibit them from using your data for any purpose other than providing services to EdisonOS.
You may request deletion of your account data at any time by emailing privacy@edisonos.com. Requests will be fulfilled within 30 calendar days, subject to legal retention requirements.
A8.1 Rights for all users
Regardless of where you are located, you have the right to:
A8.2 CCPA (California residents)
California residents may request disclosure of personal information collected, sold, or disclosed for a business purpose. We do not sell personal information. To exercise your rights under CCPA, email privacy@edisonos.com.
Kalvi Software, Inc. is based in the United States. Our platform infrastructure (Railway, Vercel, AWS, Sentry) is operated in the US. If you are accessing EdisonOS from outside the United States, your data will be transferred to and processed in the United States.
Data processed by TeachEdison Solutions Pvt Ltd, in India is subject to a Data Processing Agreement with Kalvi Software, Inc. that provides equivalent protections and ensures compliance with US federal and applicable state privacy laws.
EdisonOS implements industry-standard technical and organizational security measures to protect business user data, including:
No method of transmission or storage is 100% secure. If you believe your account has been compromised, contact security@edisonos.com immediately.
For any privacy-related questions, data access or deletion requests, or to exercise your rights:
We acknowledge all inquiries within 48 hours and provide a substantive response within 7 business days.
This Part A is governed by the laws of the State of Delaware, without regard to conflict of law principles. Any disputes arising under this Part A shall be subject to the exclusive jurisdiction of the state and federal courts located in New Castle County, Delaware, and both parties consent to personal jurisdiction in such courts.
This Part B is issued by EdisonOS, a product of Kalvi Software, Inc., a registered C-Corp in Delaware, USA. EdisonOS is an assessment software serving schools & districts, tutoring companies, and community-based organizations (CBOs) to run, scale, and deliver high-quality test prep programs.
This Policy governs how EdisonOS collects, uses, stores, discloses, and disposes Student Personally Identifiable Information ("Student PII") when providing services to Schools and their students. EdisonOS is committed to the responsible stewardship of student data and to full compliance with applicable federal and state student privacy laws.
When EdisonOS enters into a contract with a School, it operates as a "School Official" with a "legitimate educational interest" as defined under the Family Educational Rights and Privacy Act (FERPA). In this capacity, EdisonOS acts under the direct control of the School with respect to all Student PII and may not use such data for any purpose beyond those specified in the executed agreement.
Data Controller & Contracting Entity:
Kalvi Software, Inc. (Delaware C-Corp), the entity that enters into service agreements and Data Privacy Agreements with Schools and is legally responsible for Student PII under FERPA and applicable state law.
Authorized Sub-Processor:
TeachEdison Solutions Pvt Ltd, incorporated in India, provides platform engineering and technical support under a DPA with Kalvi Software, Inc. and is contractually required to comply with FERPA, COPPA, and applicable U.S. state student privacy laws. TeachEdison Solutions Pvt Ltd, does not control Student PII and may not use it for any purpose beyond supporting EdisonOS platform operations.
Student PII / Student Data – Personally identifiable information from the education records of a student, as defined under FERPA and applicable state law.
Education Records – Records, files, documents, and other materials that contain information directly related to a student and are maintained by an educational agency or institution, or by a party acting for or on its behalf.
FERPA – The Family Educational Rights and Privacy Act, and implementing regulations at 34 CFR Part 99.
COPPA – The Children's Online Privacy Protection Act, and implementing regulations at 16 CFR Part 312.
School / Educational Agency / LEA – Any school, school district, charter school, tutoring organization, or Local Education Agency that has entered into a service agreement with EdisonOS.
Parent – A parent, legal guardian, or person in parental relation to a student. Rights transfer to the student upon reaching age 18 or attending a postsecondary institution ("Eligible Student").
Breach – Any unauthorized acquisition, access, use, or disclosure of Student PII not authorized by law, this Policy, or the applicable service agreement.
De-identified Data – Data from which all direct and indirect personally identifiable elements have been permanently removed so the information cannot reasonably be linked to a specific individual.
This Policy applies to:
This Policy applies to all Schools, including public school districts, charter school networks, private schools, and tutoring organizations, that use EdisonOS services with students under the age of 18 or that share Student PII with EdisonOS.
B3.1 Categories of Data Collected
EdisonOS collects only the minimum data necessary to provide its educational services.
B3.2 Data EdisonOS Does NOT Collect
EdisonOS expressly does not collect or request:
EdisonOS uses Student PII exclusively for the following authorized purposes:
B4.1 Prohibited Uses
EdisonOS will NEVER use Student PII for any of the following:
B5.1 Authorized Disclosures
EdisonOS may disclose Student PII only to the following categories of authorized recipients:
B5.2 Sub-Processors
EdisonOS engages a limited number of Sub-Processors to operate the Platform. Each Sub-Processor is bound by contractual obligations that provide the same level of data protection as this Policy.
B5.3 Conditions for Data Sharing
Student Data is shared with Sub-Processors only when:
EdisonOS aligns its information security program with the NIST Cybersecurity Framework (Version 2.0) and maintains the following safeguards:
B6.1 Technical Safeguards
EdisonOS is committed to supporting Schools in upholding all parental and student rights under FERPA, COPPA, and applicable state law. The School serves as the primary point of contact for parents and students exercising these rights. EdisonOS will fully cooperate with and assist Schools in fulfilling all such requests in a timely manner.
B7.1 Right to Inspect and Review
Parents (or Eligible Students age 18 and over) have the right to inspect and review their child's education records held by EdisonOS. Requests should be directed to the School, which will facilitate access in accordance with its procedures. EdisonOS will provide the School with access to all relevant Student PII within a reasonable time, not to exceed 30 calendar days of a properly submitted request.
B7.2 Right to Correct Inaccurate Data
Parents and Eligible Students may request correction of inaccurate or misleading data in the student's records. Requests should be submitted to the School. EdisonOS will cooperate to make corrections within 30 calendar days of the School's notification.
B7.3 Right to Request Deletion
Upon written request from a School, EdisonOS will delete specified Student PII within 30 calendar days, unless retention is required by law or would prevent the student from receiving contracted services. Deletion requests from parents should be directed to the School, which will determine eligibility and instruct EdisonOS accordingly.
B7.4 COPPA Protections for Students Under 13
EdisonOS does not knowingly collect personal information from students under age 13 without verifiable parental consent. When a School creates accounts for students under 13, EdisonOS relies on the School's certification that it has obtained appropriate parental consent in accordance with COPPA and applicable state law.
For students under 13 who attempt to register independently, EdisonOS will collect the parent or guardian's email address, deliver a COPPA-compliant notice, and will not activate the account until required consent is confirmed.
EdisonOS retains Student PII only for as long as necessary to fulfill the purposes for which it was collected, to comply with applicable legal obligations, or as directed by the School.
Upon expiration or termination of a service agreement, EdisonOS will: (a) provide the School with a complete export of Student PII in a mutually agreed format; (b) securely delete all remaining copies of Student PII within 60 calendar days; and (c) provide written certification of deletion to the School upon request.
B9.1 Incident Response Program
EdisonOS maintains a written Incident Response Plan covering detection, containment, eradication, recovery, and notification for security incidents involving Student PII. The plan is reviewed and tested at least annually.
B9.2 Notification to Schools
In the event of a confirmed or reasonably suspected breach or unauthorized release of Student PII, EdisonOS will notify the School's designated contact:
EdisonOS will cooperate fully with the School's investigation and provide complete transparency regarding the incident and all remediation steps.
B9.3 Parent and Regulatory Notification
EdisonOS acknowledges that the School is responsible for notifying affected parents, Eligible Students, and applicable state regulatory authorities in accordance with law. EdisonOS will provide the School with all information necessary to fulfill such notifications within required timeframes and will cover reasonable notification costs where the breach is attributable to EdisonOS's actions or omissions.
B9.4 Remediation and Post-Incident Report
Following a breach, EdisonOS will immediately contain and remediate the incident, including patching vulnerabilities, rotating credentials, and implementing additional security controls as appropriate. A final written post-incident report including root cause analysis and permanent remediation measures will be provided to the School within 30 calendar days of the breach's discovery.
EdisonOS is committed to complying with all applicable federal and state student privacy laws, including:
EdisonOS recognizes that more than 40 states have enacted student privacy laws imposing additional obligations on edtech vendors, and commits to complying with all applicable state-specific requirements in the jurisdictions it serves.
Upon request, EdisonOS will execute a state-specific or district-specific Data Privacy Agreement (DPA) to confirm compliance with local requirements.
EdisonOS is prepared to enter into a formal Data Sharing Agreement (DSA) or Data Privacy Agreement (DPA) with any School that requires one. Such agreements will specify at minimum:
To request a Data Sharing Agreement, contact EdisonOS at privacy@edisonos.com. EdisonOS will acknowledge the request within 2 business days and provide a draft agreement within 10 business days
EdisonOS uses automated processing to generate analytics, performance classifications, and progress insights from Student Data. Specific metrics, categories, and thresholds are configured in agreement with the School/CBO/Tutoring company during implementation and are used solely to support educators and school administrators in identifying students who may need additional attention. These classifications are not used for any non-educational purpose, not shared with third parties outside the scope of the service agreement, and not used to make automated decisions that have legal or significant effects on students without human review.
EdisonOS does not use Student Data to train general-purpose artificial intelligence or machine learning models. Any AI-assisted tools within the platform operate on anonymized or non-student-PII data only and are not trained on individual student performance records.
All EdisonOS employees and contractors with access to Student PII are required to:
EdisonOS will provide written confirmation of employee training compliance to any School upon request.
EdisonOS reviews this Policy at least annually and updates it as needed to reflect changes in law, regulation, technology, or business practices. When material changes are made:
This Part B is governed by the laws of the State of Delaware, without regard to conflict of law principles. Any disputes arising under this Part B between EdisonOS and a School shall be subject to the exclusive jurisdiction of the state and federal courts located in New Castle County, Delaware, unless a separately executed Data Sharing Agreement specifies a different jurisdiction to accommodate state-specific legal requirements. Nothing in this section limits a School's rights under applicable federal or state student privacy laws.
Schools & Districts, Tutoring businesses, Parents, and Students who have questions about this Policy or wish to exercise their privacy rights may contact EdisonOS:
Response Commitment: EdisonOS acknowledges all privacy inquiries within 48 hours and provides a substantive response within 7 business days.