LightLeapAI^® Privacy Policy

Applies to: LightLeapAI® web and mobile applications

For how we handle information on our marketing website, see the Website Privacy Policy at lightleapai.com/privacy-policy/.

Age requirement. LightLeapAI® is intended for users 18 and older. By using the Services you represent that you are at least 18. If we learn that a user is under 18, we will promptly close the account and delete the associated data.

1. Who We Are

LightLeapAI® is an AI-powered platform for higher education operated by N2N Services, Inc. ("N2N," "we," "us"), 3063 Peachtree Industrial Blvd., Duluth, GA 30097, USA. This Policy explains how we collect, use, share, and protect personal information when you use the LightLeapAI® web and mobile applications (the "Services").

Contact our Privacy Officer at privacy@n2nservices.com or by mail at the address above, Attn: Privacy Officer. We acknowledge requests within five (5) business days.

2. Scope and Your Institution's Role

This Policy applies to students, applicants, faculty, staff, and administrators who use the Services ("Users").

Institutional deployment. Your college or university (your "Institution") provides your access under its agreements with N2N, including a Master Subscription Agreement and a Data Sharing Agreement. Your Institution controls your education records and institutional data, and N2N processes that data on your Institution's behalf and under its direction. Where this Policy and your Institution's agreements with N2N differ on how institutional data is handled, those agreements control. Please also review your Institution's own privacy notice.

No payment collection. The Services do not collect payment card information from Users.

3. Information We Collect

3.1 Information you provide

• Account information: name, email address, role, and profile details.
• Identity verification information (only when your Institution requires verification): full name, date of birth, government-issued ID number or image, a facial photograph used to match you to your ID, and address.
• Content you submit: prompts, questions, messages, and files you submit to the Services.
• Support communications you send to us.

3.2 Information collected automatically

• Device and connection data: device type, operating system, browser, and IP address.
• Usage data: features used, pages viewed, timestamps, and interaction logs.
• Cookies and similar technologies: session and preference cookies needed to operate the Services.
• Log and error data used for security and reliability.

3.3 Information from others

• Your Institution: enrollment, application, role, and other data from your Institution's student information system or other systems, as authorized in its Data Sharing Agreement with N2N.
• Identity verification sources: when verification is performed, our identity verification service providers and, where used, authoritative record sources (such as government records verification services) return a verification result. Current providers are listed on our Subprocessor List at lightleap.ai/legal/subprocessors/.
• App stores (mobile): an age-category signal used only to confirm you are 18 or older (see Section 10).

4. How We Use Information

No training on your content. We do not use your content or your Institution's data to train, fine-tune, or benchmark AI models for any other institution or customer, and we do not permit our AI infrastructure providers to train on it. Improvement within your own Institution's instance happens only as your Institution's agreements permit; for student education records, that requires your Institution's express opt-in.

We do not use personal information for targeted advertising, and we do not sell it.

5. How We Share Information

We do not sell personal information or share it for cross-context behavioral advertising. We share it only:

• With your Institution: results, outputs, logs, and fraud signals, as provided in your Institution's agreements with N2N.
• With subprocessors: cloud hosting, AI infrastructure, identity verification, email, and support providers, under written agreements that limit them to performing services for us. Our current subprocessors are listed at lightleap.ai/legal/subprocessors/.
• With systems your Institution designates: where your Institution directs us to send results to another system it uses.
• As required by law: to comply with law or valid legal process. Where we receive a request for institutional data, we notify your Institution first unless the law prohibits it.
• In a corporate transaction: to a successor that agrees to protections at least as strong as these.
• With your consent.

6. AI Context Governance (ICCP)

LightLeapAI® controls how data reaches AI systems through the Integrated Context Control Protocol (ICCP). AI systems receive only the context needed for a specific, authorized request, limited by your role and your Institution's policies, scoped in time and resources, and logged for audit. Specification: lightleapai.com/iccp/.

7. Retention

If no agreement specifies a period, the default in this table applies. When your Institution's agreement with N2N ends, institutional data is returned or destroyed within 30 days of the end date of the agreement. Backups containing data will age out per the stated retention cycle.

8. Security

We protect personal information with encryption in transit and at rest, role-based access controls, multi-factor authentication for administrative access, monitoring, and incident response procedures. Our program is aligned with the NIST Cybersecurity Framework and NIST SP 800-171, is independently assessed through a SOC 2 Type II report, and holds TX-RAMP Level 2 certification. Identity verification workflows align with NIST SP 800-63 (IAL2). No system is completely secure. If you believe your account has been compromised, contact security@n2nservices.com.

9. Your Privacy Rights

9.1 Institutional data. If your request concerns education records or other data held for your Institution, we will refer it to your Institution or handle it at your Institution's direction. Students seeking access to or correction of education records under FERPA should contact their Institution.

9.2 All Users. You may request access to, correction of, or deletion of personal information we hold about you, subject to legal and institutional retention requirements. Email privacy@n2nservices.com. We respond within the time required by law, generally 30–45 days, and we will not discriminate against you for making a request.

9.3 California. Where the California Consumer Privacy Act applies to N2N, you have the rights to know, delete, and correct personal information, and to limit the use of sensitive personal information. We use government ID and facial images only for identity verification. We do not sell or share personal information. To make a request, email privacy@n2nservices.com with the subject line "CCPA Request."

9.4 Canada. N2N handles personal information in accordance with PIPEDA and applicable provincial law, including Québec's Law 25. You have rights of access, correction, and withdrawal of consent; Québec residents also have rights of portability and de-indexing. Where your Institution is subject to provincial public-sector privacy law, such as Ontario's FIPPA or British Columbia's FIPPA, your Institution handles your request and N2N supports it. Unresolved complaints may be referred to the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d'accès à l'information.

10. Age Requirement and App Store Age Signals

Users must be 18 or older. In jurisdictions with app store age verification laws (including Texas, Utah, and Louisiana), the Google Play or Apple App Store may provide an age-category signal. We use it only to confirm eligibility and delete it immediately afterward. If you believe a minor has accessed the Services, contact privacy@n2nservices.com.

11. Student Records and FERPA

When the Services process student education records for an Institution, N2N acts as a school official with a legitimate educational interest under FERPA (20 U.S.C. § 1232g; 34 C.F.R. Part 99), under the Institution's direct control. We do not re-disclose education records except as FERPA permits or the Institution directs.

12. Where Information Is Processed

The Services are hosted in the United States. If your Institution has elected Canadian hosting, your information is hosted in Canada. Support personnel located outside the United States may access information to resolve support requests, under the safeguards described in your Institution's Data Sharing Agreement. If you are located outside the United States and your Institution has not elected Canadian hosting, your information is transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction. For Canadian Institutions, these transfers are governed by written agreements with the Institution, and N2N supports the Institution's privacy impact assessments, including any required under Québec's Law 25.

13. Changes to This Policy

We will post updates here with a new version number and effective date and keep prior versions at lightleap.ai/legal/privacy/archive/. For material changes, we will notify Institutions in advance and notify Users through the Services. Changes affecting how institutional data is handled apply to an Institution as its agreements with N2N provide.

14. Related Documents

• LightLeapAI® Terms of Service and Acceptable Use Policy: lightleap.ai/legal/terms/
• Subprocessor List: lightleap.ai/legal/subprocessors/
• Security Exhibit: lightleap.ai/legal/security/
• ICCP Specification: lightleapai.com/iccp/
• Website Privacy Policy: lightleapai.com/privacy-policy/

Revision history