Everything school districts, schools and privacy teams need to see how Skye handles student data, and to complete procurement due diligence. Key facts are summarized on this page. Full documents are available to download for review.
We’ve prepared the documents your school or district’s privacy team needs to complete due diligence and move quickly. We’re ready to sign the SDPC National Data Privacy Agreement or your school, district or state DPA.
What’s included
If your privacy team has questions these documents do not answer, our contact details are in the section below.
Skye is operated in the US by Third Space Learning Inc., a subsidiary of Virtual Class Ltd. When a school or district uses Skye, Third Space Learning acts as your service provider and, under FERPA, as a “school official” with a legitimate educational interest, operating under the school or district’s direct control.
What this means for your school or district. You stay in control of student data. We process student data only to deliver the tutoring service, under a signed data privacy agreement. We can sign the SDPC National Data Privacy Agreement or your school, district or state DPA. Student data is never sold, never used for advertising, and never used to train third-party AI models.
FERPA’s school-official exception (34 CFR § 99.31(a)(1)) lets a school or district share education records with a provider that performs an institutional service under its direct control and uses the data only for the authorized purpose. Third Space Learning also complies with COPPA through school or district consent, and with applicable state student-privacy laws.
Skye is an AI tutor that delivers one-on-one math sessions by voice. During a session, the student speaks and Skye responds in real time. Voice is transcribed in the moment so Skye can understand and reply. Those transcriptions are functional only. They are not stored by the AI model used.
What Skye decides on its own. The pacing, language and explanations used within a session, based on the student’s responses. The range of responses Skye can use is created and designed by our learning insights team of qualified math specialist teachers.
What Skye does not decide. Which students receive sessions, which curriculum topics are covered, or any assessment or grading judgments that affect a student’s academic record. These all stay with school leadership and teachers.
Skye does not profile students, does not make decisions with legal or significant effect, and does not use student data to train third-party AI models. Session data is used only to deliver and improve the tutoring service.
We collect only what is needed to deliver the service. School staff enter student details using fixed fields, so there is no risk of unnecessary data being captured through free-text inputs.
Data collected. Student’s full name, school name, scores from Skye’s check-in and check-out questions, the student’s self-reported enjoyment and any confidence improvements, session audio, session transcript, and limited technical log data (IP address, device and browser). The AI tutor is not given the student’s full name or school.
Data not collected. Sensitive or special-category data (such as race, religion, health or disability status), date of birth, or any data beyond what is needed for math tutoring.
Voice is captured as a communication channel so Skye can respond in real time, because tutoring is a live service. It is not used for identity verification or voiceprint analysis, and is not treated as biometric data. Student data is never sold, never used for advertising, and never used to train third-party AI models.
Access to student data is strictly tiered. Not all data is accessible to all users.
School accounts (teachers and administrators). Can view student profile data, progress reports and session summaries. Cannot access lesson recordings or transcripts, unless requested and shared by the Third Space Learning team.
Lesson recordings and transcripts. Accessible only to a small number of privileged Third Space Learning staff for child-protection review and quality assurance. Not accessible through any school-facing account.
Student accounts. Access to the tutoring session and relevant curriculum only. No access to stored data, or to other students’ or teachers’ data.
This tiered access means a compromised school account cannot expose the most sensitive session content. It heavily protects student data, and ensures the most sensitive session data could only be breached, in theory, through Third Space Learning and not through the school.
Protecting children is central to how Skye operates. Sessions are monitored, and our trained team reviews recordings where a concern is raised.
What happens if a child discloses something during a session. Our child-protection-trained team reviews the session recording, which is accessible only to designated staff. We contact the school’s or district’s designated child-protection or safeguarding lead directly. Where there is an immediate risk to a child, we may contact the relevant authorities, consistent with applicable state mandatory-reporting laws. We notify the school or district of any action taken.
Acting quickly matters when protecting children, so our team is able to escalate a serious concern without waiting, while keeping the school or district informed at every step.
We keep student data only as long as needed to deliver the service, then delete or anonymize it after your contract ends. Schools and districts can request deletion at any time, and where a signed data privacy agreement sets a stricter deletion timeline, that agreement governs.
Third Space Learning uses a small number of vetted sub-processors to deliver Skye. Every sub-processor is bound by a written data processing agreement with privacy and security obligations no less protective than those in our customer agreements, and may use data only to provide services to us, acting as a service provider or school official under FERPA.
Full transparency on our supply chain. Our current sub-processor list sets out each sub-processor, the processing it carries out, the data involved, the hosting location, and the independent assurance it holds. Student data is never sold, never used for advertising, and never used to train third-party AI models.
Third Space Learning protects student data with encryption in transit and at rest, layered access controls, and independent security testing. Our sub-processors are held to the same standard.
SOC 2 Type II. We are actively working towards SOC 2 Type II certification, covering the security, availability and confidentiality of the platform. We can share evidence of this commitment with schools and districts on request.
Penetration testing. We carry out an independent penetration test every year. The most recent test has been completed; the attestation letter is available to download below.
Cyber Essentials. Third Space Learning also holds UK Government-backed Cyber Essentials certification. The certificate is available to download below.
Breach notification. If a security incident affects school or district data, we notify affected schools and districts without undue delay, consistent with applicable state breach-notification laws and your data privacy agreement.
Contact secretary@thirdspacelearning.com with any questions not answered here.