1. Legislative Compliance

StudyPug Inc. acknowledges its obligations as a service provider processing personal information on behalf of publicly funded educational institutions and will comply with all applicable legislation governing each Institutional Customer.

2. Data Categories

In addition to Contact Data, Financial Data, and Demographic Data described in the general Privacy Policy, StudyPug collects:

Learning Activity Data: course progress and completion, quiz and assessment scores, topic mastery levels, time-on-task, diagnostic assessment results, and adaptive practice performance.

Institutional Administration Data: institution name, programme or class identifiers, administrator and teacher contact details, seat allocation records.

StudyPug does not collect biometric data, social media identifiers, health information, or data beyond what is necessary to deliver and administer the contracted educational services.

AI training exclusion: Student Learning Activity Data is not used to train, develop, or improve StudyPug's AI models or any third-party AI systems. AI features operate on the individual student's data within their session only.

3. Data Residency and Storage

All personal information and Learning Activity Data for Canadian Institutional Customers is stored exclusively within the Canada (Central) region of Amazon Web Services (ca-central-1), located in Montréal, Québec. No personally identifiable information belonging to learners of Canadian Institutional Customers is transferred to, stored in, or processed in any jurisdiction outside of Canada. This commitment applies to data at rest and data in transit.

Google Analytics and all third-party tracking and analytics services are excluded from sessions involving Institutional Customer learners. No learner data is transmitted to third-party analytics providers.

4. Sub-Processors

StudyPug will notify Institutional Customers in writing at least thirty (30) days before engaging any new sub-processor with access to learner personal information. Institutional Customers may object within that notice period.

5. Data Retention and Deletion

Active Accounts

Learning Activity Data and personal information are retained for the duration of the institutional subscription. Data is maintained to support educational use, progress reporting, and programme administration.

Rotating Seats

For continuous-intake programmes, StudyPug can accommodate the Institutional Customer's preferred data handling procedure: (a) retain prior learner data until deletion is requested; (b) automatic purging upon seat reassignment; or (c) a custom retention schedule agreed in the service agreement.

Post-Subscription Deletion

Upon expiry or termination, data is retained for ninety (90) days to allow renewal, data export, or transition. After this period, all personally identifiable information and Learning Activity Data are permanently deleted. Immediate deletion may be requested at any time. StudyPug will process deletion requests within thirty (30) calendar days and provide written confirmation.

6. Data Breach Notification

In the event of a security incident, StudyPug will:

• Notify the Institutional Customer's designated privacy contact within five (5) business days, and in any event no later than seven (7) calendar days of becoming aware of the breach;

• Provide a written incident report: nature and scope; data categories; estimated number of affected learners; measures taken or proposed; recommendations to mitigate harm;

• Report to the applicable provincial privacy commissioner (e.g., IPC Ontario, IPC Alberta, or equivalent) as required by law;

• Co-operate with the Institutional Customer's breach response procedures;

• Take all reasonable steps to contain the breach and prevent recurrence.

7. Accessibility

StudyPug is working toward WCAG 2.1 Level AA conformance. An accessibility conformance report (VPAT) is available on request.

• Ontario: StudyPug acknowledges obligations under AODA 2005 and the Integrated Accessibility Standards Regulation (O. Reg. 191/11).

• Manitoba: StudyPug acknowledges obligations under the Accessibility for Manitobans Act.

The detailed Accessibility Statement is available at studypug.com/support/accessibility/.

8. Institutional Customer Rights

Institutional Customers have the right to:

• Request a copy of all personal information and Learning Activity Data for their learners, in a commonly used electronic format, within thirty (30) days;

• Request correction of inaccurate personal information;

• Request deletion of learner data at any time, subject to Section 5 timelines;

• Receive written confirmation of any data deletion;

• Receive thirty (30) days' written notice before material changes to this Supplement take effect;

• Designate a privacy contact to receive all notifications, breach reports, and data-related communications from StudyPug;

9. Contact

For all privacy inquiries related to institutional accounts:

Privacy and Data Protection Officer, StudyPug Inc.
Email: privacynotification@studypug.com

We will acknowledge all privacy inquiries within five (5) business days.

This document is issued by StudyPug Inc. and is effective as of the date stated above.
© 2015–2026 StudyPug Inc. All rights reserved.