Edcafe

GDPR overview

GDPR compliance is claimed in writing. The homepage states that Edcafe follows GDPR, FERPA and COPPA standards and is SOC 2 certified, and Inknoe's public Trust Center marks GDPR, SOC 2, ST4S, US FERPA and US COPPA as compliant. The privacy policy names the controller, Inknoe Pte. Ltd., 11 Woodlands Close, #10-33, Woodlands 11, Singapore, UEN 201526061D, gives security@inknoe.com as the privacy contact, and lists data subject rights: information, access, rectification, erasure, restriction of processing, withdrawal of consent and complaint to a supervisory authority. It also promises breach notification to users and authorities. Two gaps are worth noting: no Article 27 EU representative is designated even though the publisher is established outside the EU, and no data protection officer is named.

Who owns the data?

The terms of service state that users keep full ownership of the content they submit, post, generate or display on the platform, text, images and video included. Inknoe Pte. Ltd. acts as data controller or processor for the activities described in its privacy policy. Information a teacher collects about a class or an individual student belongs to the school relationship, not to the vendor: Edcafe says it uses it only to deliver the service to that teacher, that it never sells it, and that its collection, use and sharing are governed by the agreements signed with schools and districts together with FERPA and COPPA. Access, correction and deletion requests for student data go through the school, not directly to Inknoe.

Reuse rights

Because ownership of generated and uploaded content stays with the user, teaching material produced on Edcafe can be reused, edited, exported and shared without asking the vendor for permission: slide decks export to PowerPoint and Google Slides, and paid plans add export to a range of other file formats. On the vendor side the commitment is unusually explicit: prompts, text inputs, uploaded files, generated outputs, account information and usage data are never used to train or improve any AI model. Content is processed only to deliver the features in use and keep the service running, with OpenAI listed as the subprocessor handling user content for AI features. Personal data may be shared with service providers, affiliates, in a business transfer, or when the law requires it, and usage data is kept for internal analysis.

Data retention & training

Hosting summary

Inknoe publishes a subprocessor table in the Edcafe privacy policy, and every entry in it is located in the United States. Application data is hosted on Microsoft Azure, the database on MongoDB Atlas, uploaded files on DigitalOcean. Transactional email goes through Resend and customer messaging through Customer.io, payments through Stripe, support tickets through Zoho Desk, usage analytics through Zoho Analytics, error tracking through Sentry, support calls through Zoom, internal messaging through Slack and sales contacts through Pipedrive. User content processed for AI features goes to OpenAI, also in the United States. Nothing is hosted in the European Union or in Asia, and no data residency option is offered, even though the publisher is established in Singapore and the service is governed by Singapore law. Inknoe states that it performs diligence on each subprocessor's privacy, security and confidentiality practices and signs an agreement passing on its obligations. Its Trust Center counts nineteen subprocessors in total, so the thirteen named in the privacy policy may not be the complete list.