Chorus Privacy Policy

Effective date: 23.06.2026
Last updated: 23.06.2026
Product: Chorus
Provider: Natural User Interface Technologies AB
Website: https://chorus.nuiteq.com
Privacy contact: privacy@nuiteq.com
Data Protection Officer / EU or UK representative: Edward Tse

1. Introduction

This Privacy Policy explains how Natural User Interface Technologies AB, together with its affiliates, including Clear Touch Interactive, Inc., where applicable, collects, uses, discloses, stores, and protects personal data when customers, administrators, teachers, students, parents, guardians, and other users access or use Chorus.

The Product is designed to support education, collaboration, content creation, interactive learning, classroom management, assessment, support, and related product functionality. The Product may be used by schools, school districts, universities, companies, public authorities, resellers, partners, and individual users.

This Privacy Policy is intended to support compliance with applicable privacy and student data protection laws, including, where applicable:

• the EU General Data Protection Regulation (GDPR);
• the Swedish Data Protection Act and Swedish rules implementing the e-Privacy Directive;
• the UK GDPR, the UK Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and the Data (Use and Access) Act 2025;
• the Family Educational Rights and Privacy Act (FERPA);
• the Children’s Online Privacy Protection Act and Rule (COPPA);
• the Protection of Pupil Rights Amendment (PPRA);
• the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA);
• applicable U.S. state student privacy laws, including laws similar to SOPIPA, SOPPA, and state education data protection rules;
• applicable accessibility, cybersecurity, consumer protection, and AI transparency rules.

Where a customer contract, data processing agreement, student data privacy agreement, or similar agreement applies, that agreement will govern if it conflicts with this Privacy Policy.

2. Who is responsible for personal data?

The roles depend on how the Product is used.

2.1 Institutional use

When a school, school district, educational authority, company, or other organization provides access to the Product, that organization is normally the controller under the GDPR/UK GDPR, the educational agency or institution under FERPA, and the entity responsible for determining why and how its users’ personal data is processed.

In that situation, Natural User Interface Technologies AB normally acts as:

• a processor under the GDPR/UK GDPR;
• a service provider or contractor under the CCPA/CPRA;
• a school official or vendor acting for a school under FERPA, where the school has determined that the legal conditions for that relationship are met;
• an operator that may rely on school consent under COPPA for the collection and use of children’s personal information solely for authorized educational purposes, where permitted by law.

2.2 Direct users, trial accounts, administrators, and support contacts

Where an individual signs up directly, requests a trial, purchases a license, contacts support, uses a public product page, subscribes to product communications, or otherwise interacts with us outside an institutional customer account, NUITEQ may act as an independent controller for account administration, support, security, billing, product communications, compliance, and related purposes.

2.3 Clear Touch Interactive, Inc., NUITEQ, and group companies

NUITEQ is part of the Clear Touch Interactive, Inc. group. Depending on the relevant contract and data flow, Clear Touch Interactive, Inc. and other group companies may act as:

• parent company and group service provider;
• reseller, distributor, or commercial contact;
• processor or subprocessor;
• independent controller for their own websites, events, sales, marketing, billing, or customer relationship management activities.

Product pages hosted on a Clear Touch Interactive, Inc. website may be covered by Clear Touch Interactive, Inc.’s general website privacy and cookie notices for website browsing, analytics, and marketing activities. This Privacy Policy focuses on the use of the Product itself.

3. Summary of our privacy commitments

For Product use, we follow these core principles:

1. Educational use first. Student Data is used only to provide, support, secure, and improve the Product for authorized educational purposes, or as otherwise instructed by the customer.
2. No sale of Student Data. We do not sell Student Data.
3. No targeted advertising to students. We do not use Student Data for behavioral advertising or targeted advertising.
4. No unrelated profiling of students. We do not create student profiles for non-educational commercial purposes.
5. Customer control. Institutional customers control their accounts, users, classes, content, retention settings, integrations, and instructions.
6. High privacy by default for children. Child and student accounts are configured to support restricted sharing, limited visibility, age-appropriate settings, and school-controlled access.
7. Transparent AI. Where the Product includes AI features, we explain how prompts, files, content, and outputs are processed, and we do not use Customer Data or Student Data to train third-party general-purpose AI models unless expressly agreed and legally permitted.
8. Security by design. We use technical and organizational measures designed to protect personal data, including access controls, encryption, logging, secure development practices, and incident response procedures.
9. International transfer safeguards. Where personal data is transferred internationally, we use appropriate safeguards such as adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, Standard Contractual Clauses, the UK Addendum or IDTA, transfer risk assessments, and supplementary measures.
10. Rights support. We support customers, users, parents, and guardians in exercising applicable privacy rights.

4. Personal data we collect and process

The categories of personal data depend on the Product features enabled by the customer and used by the user.

We do not intentionally collect special categories of personal data under the GDPR, biometric identifiers, health data, financial account data, government identifiers, or highly sensitive personal data unless this is specifically enabled by the customer, included by users in their content, required for accessibility or support, or otherwise permitted by law and contract.

Users should not upload unnecessary sensitive personal data into the Product.

5. How we collect personal data

We collect personal data from the following sources:

• directly from users when they create accounts, update profiles, use the Product, create content, complete assignments, submit feedback, or contact support;
• from institutional customers, administrators, teachers, and authorized staff;
• from students when they use accounts assigned or authorized by their school or organization;
• from parents or guardians who contact us or the customer;
• from SSO, LMS, rostering, cloud storage, content, and identity integrations enabled by the customer or user;
• automatically from the Product, devices, browsers, logs, cookies, and similar technologies;
• from resellers, distributors, partners, and group companies, where relevant to the customer relationship.

6. How we use personal data

We process personal data for the following purposes:

6.1 Product delivery

To provide, operate and maintain the Product, including account creation, authentication, classroom tools, content creation, collaboration, assignments, assessments, feedback, dashboards, whiteboards, AI-assisted functions, offline or desktop functions, imports, exports, downloads, and integrations.

6.2 Customer administration

To manage licenses, subscriptions, renewals, billing, customer support, account configuration, administrator permissions, customer success, product training and contractual obligations.

6.3 Education and classroom functionality

To allow teachers, students, and authorized users to create, upload, edit, share, assign, complete, grade, review and comment on educational content and activities.

6.4 Student progress and feedback

To enable teachers and institutions to review assignment completion, responses, scores, progress, feedback, class metrics, exported results and related educational records.

6.5 AI-assisted features

To generate or assist with educational materials, lesson plans, polls, quizzes, reading materials, podcasts, images, creative tasks, translations, scaffolding, difficulty adjustments, fact-checking, standards alignment and other AI-supported outputs where enabled.

6.6 Security and integrity

To secure accounts, prevent unauthorized access, detect abuse, monitor system performance, investigate errors, maintain audit logs, protect the Product, enforce terms, and respond to security incidents.

6.7 Support and improvement

To respond to support requests, troubleshoot issues, improve reliability, analyze product performance, develop new features, improve usability and accessibility, and maintain quality.

For Student Data, product improvement is limited to purposes permitted by the customer contract and applicable student privacy laws. We do not use Student Data to build unrelated commercial profiles or for targeted advertising.

6.8 Legal and compliance

To comply with legal obligations, respond to lawful requests, protect rights, enforce agreements, maintain compliance records, conduct audits, manage disputes and meet regulatory requirements.

6.9 Communications

To send service messages, security notices, assignment notifications, product updates, administrative communications and support responses.

We only send marketing communications where permitted by law and, where required, with consent. Students do not receive marketing communications based on Student Data.

7. Legal bases under the GDPR and UK GDPR

Where we act as a controller, we rely on the following legal bases:

Where we act as a processor, the customer is responsible for determining the applicable legal basis and for providing required notices to its users, students, parents and staff.

8. Student Data, FERPA and school-controlled use

For U.S. educational customers, the Product may process information that is part of a student’s education record under FERPA.

Where FERPA applies and the customer authorizes us to receive Student Data, we process that data only for authorized educational purposes and in accordance with the customer’s instructions. We do not use Student Data for our own unrelated purposes.

We may act as a “school official” with a legitimate educational interest where the customer has determined that FERPA’s requirements are met. In that role, we:

• use Student Data only to provide and support the Product and related educational services;
• do not disclose Student Data except as authorized by the customer, this Privacy Policy, the applicable contract, or law;
• support the customer’s management of access, correction, deletion and retention requests;
• protect Student Data using reasonable administrative, technical and physical safeguards;
• require service providers and subprocessors to protect Student Data and use it only for authorized purposes.

Parents, guardians and eligible students should submit FERPA access, amendment or deletion requests to the relevant school, district or educational institution. We will assist the customer in responding to such requests where required by contract and law.

9. Children’s privacy and COPPA

The Product may be used by children, including children under 13, only where authorized by a school, parent, guardian or other legally responsible adult.

For school use, we rely on the customer to provide any required notices and obtain any required consents, including school consent under COPPA where the Product is used solely for authorized educational purposes and where COPPA permits the school to consent on behalf of parents.

We do not knowingly collect children’s personal information for behavioral advertising, sale, or unrelated commercial profiling.

If we learn that we have collected personal information from a child without required authorization, we will take appropriate steps to delete or de-identify the information unless retention is legally required or authorized by the relevant customer.

Parents and guardians may contact the school or institution to review, correct or request deletion of their child’s information. Where a parent contacts us directly, we may refer the request to the relevant customer unless the account is a direct consumer account.

10. High privacy defaults for child and student users

For student and child users, the Product is designed to support high privacy and school-controlled use. Depending on Product configuration, this may include:

• restricted sharing settings;
• private or unlisted content options;
• teacher-controlled classes and groups;
• limited student sharing to approved groups rather than public communities;
• account and role-based access controls;
• controls for assignments, grades, progress and feedback;
• age-appropriate content filtering and metadata;
• limited visibility of student results;
• options for anonymous or pseudonymous classroom participation;
• no behavioral advertising to students;
• no public display of student personal data unless configured or authorized by the customer.

Customers are responsible for configuring Product settings appropriately for their users, jurisdiction, age group and educational context.

11. AI-assisted features

Some Products may include AI-assisted features that help users create, translate, adapt, assess, summarise, scaffold or enhance educational content.

11.1 Data processed by AI features

AI features may process:

• prompts and instructions entered by users;
• attached files, links, images, audio, video or other materials;
• voice input converted to text;
• selected age group, subject, language, curriculum standard, difficulty level and similar settings;
• Product content selected by the user, such as whiteboards, lessons, polls, assignments or creative tasks;
• AI-generated outputs and user edits to those outputs.

11.2 No training on Student Data without permission

Unless expressly agreed in writing with the customer and permitted by applicable law, we do not use Student Data or Customer Data to train third-party general-purpose AI models.

We may process prompts, files and outputs through AI service providers solely to provide the requested AI feature, subject to contractual safeguards, confidentiality, security and data processing restrictions.

11.3 Human review

We do not routinely review AI prompts or outputs. Limited human review may occur where necessary for support, troubleshooting, security, abuse prevention, legal compliance, or where the user or customer asks us to assist.

11.4 Educator responsibility and AI limitations

AI outputs may be inaccurate, incomplete, biased, unsuitable for a specific age group, or otherwise require review. Teachers, administrators and other authorized adults are responsible for reviewing AI-generated content before using it with students or relying on it for educational purposes.

AI features are not intended to make legally or similarly significant decisions about students or users without human review.

11.5 AI transparency

Where required by law, the Product will support appropriate transparency for AI-generated or AI-assisted content. Customers and users should disclose AI use to students, parents, staff and other users where required by their policies or applicable law.

12. Cookies, local storage and similar technologies

The Product uses cookies, local storage, SDKs and similar technologies to provide secure and functional services.

12.1 Strictly necessary technologies

We use strictly necessary technologies for:

• login and authentication;
• account security;
• session management;
• load balancing;
• fraud and abuse prevention;
• remembering essential settings;
• enabling Product functionality requested by the user.

These technologies are necessary for the Product and generally cannot be disabled without affecting functionality.

12.2 Preference and functionality technologies

We may use preference technologies to remember language, accessibility settings, display options, region, curriculum preferences, dashboard preferences and similar user choices.

12.3 Analytics

We may use limited analytics to understand Product performance, reliability, feature usage, errors and system health.

For student accounts, analytics are limited to educational, operational, security and Product improvement purposes permitted by the customer contract and applicable law.

12.4 Marketing cookies

Marketing cookies, retargeting pixels and similar advertising technologies are not used in student Product accounts.

Public product pages, marketing websites or general Clear Touch Interactive, Inc./NUITEQ websites may use marketing cookies only where permitted by law and subject to the applicable website cookie notice and consent settings.

13. Sharing and disclosure

We disclose personal data only as described below.

13.1 Customers and authorized users

We disclose Product data to the relevant customer and its authorized users, such as administrators, teachers, students and support staff, according to their roles and permissions.

13.2 Other users through Product features

Users may share content with other users through Product features such as classes, groups, communities, assignments, shared whiteboards, unlisted links, comments, lists, downloads or public publishing.

Customers and users are responsible for choosing appropriate sharing settings.

13.3 Group companies

We may disclose personal data to NUITEQ, Clear Touch Interactive, Inc. and other group companies for Product operation, customer support, sales administration, security, legal, compliance, finance, reporting and group management purposes.

Where a group company processes personal data on behalf of another entity, it will do so under appropriate data processing terms.

13.4 Service providers and subprocessors

We use trusted service providers and subprocessors for hosting, storage, security, support, customer relationship management, email, analytics, AI features, content delivery, identity integrations, payment processing and similar services.

Subprocessors are required to protect personal data and use it only for authorized purposes.

Our current approved subprocessors are Amazon, ClassLink, Clever, Google, and Microsoft.

13.5 Customer-enabled integrations

If the customer or user enables integrations with third-party services, such as SSO providers, LMS platforms, cloud storage providers, video platforms, content libraries or AI services, personal data may be shared with those services according to the customer’s configuration and the third party’s terms.

Examples may include Google, Microsoft, ClassLink, Clever, Canvas, Google Classroom, Google Drive, OneDrive, YouTube and similar services, depending on Product configuration.

13.6 Legal and safety disclosures

We may disclose personal data where necessary to:

• comply with law, court orders or lawful government requests;
• protect the security, rights and safety of users, customers, NUITEQ, Clear Touch Interactive, Inc., group companies or others;
• investigate abuse, fraud, security incidents or policy violations;
• enforce contracts and terms;
• establish, exercise or defend legal claims.

Where legally permitted and appropriate, we will direct requests for Customer Data or Student Data to the relevant customer.

13.7 Corporate transactions

If we are involved in a merger, acquisition, restructuring, financing, sale of assets or similar transaction, personal data may be disclosed as part of that transaction, subject to appropriate confidentiality and data protection safeguards.

14. International transfers

The Product may be provided using systems, affiliates and service providers located in the European Economic Area, the United Kingdom, the United States and other countries.

Where personal data is transferred outside the EEA, Switzerland or the United Kingdom, we use appropriate safeguards, such as:

• an adequacy decision;
• the EU-U.S. Data Privacy Framework, the UK Extension and/or the Swiss-U.S. Data Privacy Framework, where the recipient is certified and the transfer is covered;
• EU Standard Contractual Clauses;
• the UK International Data Transfer Agreement or UK Addendum;
• transfer impact assessments or transfer risk assessments;
• supplementary technical, contractual and organizational measures.

Customers should review the applicable data processing agreement and subprocessor list for current hosting locations and transfer safeguards.

15. Data retention

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, the applicable contract, the customer’s instructions, and legal requirements.

Unless otherwise agreed:

• Customer account and license data is retained for the duration of the customer relationship and for a reasonable period afterward for legal, finance and audit purposes.
• Student Data is retained according to the customer contract, customer instructions and applicable law.
• User-generated content is retained until deleted by the user or customer, the account is closed, or the customer instructs deletion.
• Support data is retained for indefinitely unless longer retention is required for legal, security or quality purposes.
• Security logs are retained for 7 days.
• Backups are overwritten or deleted according to our backup cycle, normally within 7 days after deletion from active systems, unless legally required to preserve them.
• De-identified, aggregated or anonymized data may be retained for product analytics, reporting, security and improvement where it no longer identifies an individual.

Upon termination of an institutional customer agreement, we will delete or return Customer Data and Student Data as required by the applicable contract and data processing agreement.

16. Security

We maintain administrative, technical and organizational safeguards designed to protect personal data against unauthorized access, loss, misuse, alteration and disclosure.

These safeguards may include:

• encryption in transit;
• encryption at rest where appropriate;
• role-based access controls;
• authentication and SSO support;
• least-privilege access;
• audit logging and monitoring;
• secure software development practices;
• vulnerability management;
• backup and recovery procedures;
• incident response procedures;
• staff confidentiality obligations;
• vendor and subprocessor due diligence;
• security training;
• ISO/IEC 27001-aligned or certified information security management controls, as applicable to the relevant entity and scope.

No system is completely secure. Customers and users must protect their credentials, configure access appropriately, and notify us promptly of suspected unauthorized access.

17. Security incidents and breach notification

If we become aware of a security incident affecting personal data, we will investigate and take appropriate steps to contain, mitigate and remediate the incident.

Where required by law or contract, we will notify the affected customer or other relevant party without undue delay and provide information reasonably required to support notification to regulators, users, parents or guardians.

For institutional use, the customer is generally responsible for determining whether notification to affected individuals, parents, guardians, regulators or educational authorities is required, unless applicable law imposes direct obligations on us.

18. Your rights

Depending on where you are located and how the Product is used, you may have rights to:

• access your personal data;
• correct inaccurate personal data;
• delete personal data;
• restrict processing;
• object to processing;
• withdraw consent;
• receive a copy of your data in a portable format;
• opt out of marketing;
• opt out of sale, sharing or targeted advertising where applicable;
• limit use of sensitive personal information where applicable;
• lodge a complaint with a data protection authority.

For institutional accounts, requests relating to Student Data or Customer Data should normally be directed to the relevant school, district, employer or organization. We will assist the customer in responding where required by law and contract.

For direct accounts or controller processing, requests may be sent to privacy@nuiteq.com.

We may need to verify your identity and authority before responding.

19. California privacy notice

This section applies to California residents where the CCPA/CPRA applies.

19.1 Categories of personal information collected

In the preceding 12 months, we may have collected the categories described in Section 4, including identifiers, education information, internet or electronic network activity, commercial information, audio/visual information, inference data where applicable, and sensitive personal information such as account login credentials or information from users known to be under 16 where applicable.

19.2 Sources

We collect personal information from users, customers, schools, administrators, teachers, parents or guardians, integrations, devices, browsers, service providers and Product usage.

19.3 Purposes

We use personal information for the purposes described in Section 6, including Product delivery, education, support, security, compliance, customer administration and communications.

19.4 Disclosures

We disclose personal information to the categories of recipients described in Section 13.

19.5 Sale and sharing

We do not sell Student Data. We do not share Student Data for cross-context behavioral advertising.

We do not knowingly sell or share personal information of children under 16.

Where the CCPA/CPRA applies to non-student website or marketing data, any sale or sharing will be addressed in the applicable website privacy and cookie notice, including opt-out mechanisms where required.

19.6 Sensitive personal information

We do not use or disclose sensitive personal information for purposes that would require a right to limit use under the CCPA/CPRA, unless expressly stated in a separate notice.

19.7 California rights

California residents may have the right to know, access, correct, delete, opt out of sale or sharing, limit use of sensitive personal information, and not be discriminated against for exercising privacy rights.

Requests may be submitted to privacy@nuiteq.com or https://nuiteq.com/contact.

For Student Data controlled by a school or district, requests should be directed to that school or district.

20. Marketing communications

We may send Product updates, administrative notices, renewal reminders and security communications to customer administrators and adult users.

We may send marketing communications to adult business contacts where permitted by law. Recipients may opt out at any time.

We do not send marketing communications to students using Student Data.

21. De-identified and aggregated data

We may create de-identified, anonymized, or aggregated data for lawful purposes, including Product improvement, analytics, reporting, benchmarking, research, security and business planning.

We will not attempt to re-identify de-identified or anonymized data except as permitted by law, such as to test whether de-identification is effective.

22. Third-party content and links

The Product may allow users to access, embed or link to third-party content, websites, videos, simulations, storage services, LMS platforms, identity providers, AI providers or other services.

We are not responsible for the privacy practices of third-party services that customers or users choose to use. Customers should review third-party terms and privacy notices before enabling integrations or embedding third-party content.

23. Customer responsibilities

Institutional customers are responsible for:

• providing required privacy notices to users, students, parents and guardians;
• obtaining required consents or authorizations;
• configuring Product settings appropriately;
• managing accounts, roles, permissions, classes, groups and sharing settings;
• determining the lawful basis for processing under the GDPR/UK GDPR;
• determining FERPA, COPPA, PPRA and state student privacy compliance obligations;
• responding to parent, guardian, student and employee privacy requests;
• ensuring that uploaded content is lawful and appropriate;
• entering into required data processing, student data privacy or subprocessor agreements.

24. Product-specific schedule

The following Product-specific information should be completed for each Product.

25. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Product, legal requirements, security practices, subprocessors or business operations.

If we make material changes, we will provide notice as required by law or contract, for example by posting an updated version, notifying customer administrators, or providing in-product notice.

The “Last updated” date at the top shows when this Privacy Policy was last revised.

26. Contact

For privacy questions, requests or complaints, contact:

Natural User Interface Technologies AB
Address: Laboratorgränd 11, 93177 Skellefteå
Email: privacy@nuiteq.com
Support: support@nuiteq.com

Data Protection Officer / privacy lead: None
EU representative, if applicable: None
UK representative, if applicable: None

For institutional Product accounts, students, parents and guardians should normally contact the relevant school, district or organization first.