Milo by NextClass — Privacy Notice

Who we are

Next Class Inc. (Ontario Corporation Number 1000914468) provides Milo, a software-as-a-service platform for educators. This Privacy Notice explains how we collect, use, disclose and safeguard Personal Information about teachers and other users of the Service.

Scope & relationship to other terms

This Notice applies to your use of Milo by NextClass (the "Service") and forms part of the contract between you and Next Class Inc. Capitalized terms not defined here have the meanings given in the End User Licence Agreement (EULA). If the EULA or a Data Processing Addendum with your school board conflicts with this Notice, the EULA or board agreement governs as to Student Data.

Key definitions

• Personal Information means information about an identifiable individual.
• Student Data means Personal Information about students that a teacher inputs or uploads into the Service.
• Your Content means text, prompts, files, images, audio, video and other content you submit or create in the Service.
• Service Data means technical and usage data generated by the Service (e.g., event logs, device info, diagnostics).
• De‑identified Data means data modified to remove direct identifiers and reduce re‑identification risk using technical, organizational and contractual measures.
• Aggregated Data means data combined with others' data such that it cannot reasonably be linked to an individual.

Information we collect

1. Account & profile data: name, email, role, school board, and authentication data.
2. Classroom use: prompts, lesson plans, rubrics, files and other content you upload or generate (which may contain Student Data you lawfully input).
3. Support & communications: messages to support, feedback, and incident reports.
4. Payment & subscription: billing contact details and transaction records (processed by our payment provider).
5. Service Data and cookies: device/browser information, IP address, usage telemetry, diagnostics, and cookie identifiers to keep you signed in, provide features, and perform analytics.

We use Google Analytics, Meta Pixel, and Microsoft Clarity for analytics and to understand how users interact with our Service.

Sources of information

We collect information directly from you, from your organization (e.g., if your school board provisions an account), and automatically from your device and our systems. If you connect third‑party services (e.g., cloud storage or LMS), they may share data with us per your settings.

How we use information (Purposes)

• Provide and maintain the Service, including authentication, content processing, and feature delivery.
• Safety and security, including monitoring for abuse, malware, fraud and misuse; debugging and troubleshooting.
• Customer support and service communications (transactional).
• Research and development: using De‑identified and Aggregated Data to test, evaluate and improve features, quality, and safety.
• Compliance with law, dispute resolution, accounting and record‑keeping (including incident logging).
• Marketing communications with consent (CASL). You can unsubscribe at any time.

AI training, model improvement & new purposes

We are building Milo with privacy by design. To support innovation while respecting Canadian privacy law and educators' obligations, we use layered controls for data use:

1. Service operation (required): We may process Your Content, Student Data and Service Data to operate, secure and support the Service (e.g., delivery, abuse detection, quality control).
2. De‑identified analytics & improvement (default ON): We may use De‑identified and Aggregated Data derived from Your Content, Student Data and Service Data to develop, test and improve features and models, including quality, safety and performance improvements. We contractually prohibit our subprocessors from re‑identifying De‑identified Data or using it for their own purposes.
3. Personal‑information training (default OFF; opt‑in): We will not use Personal Information to train models unless you (or your school board) provide express, informed consent via in‑product controls or a data processing agreement. Consent can be withdrawn at any time; we will cease future training on that data.
4. Student Data safeguards: By default, Student Data is excluded from model training. Where a school board executes a Data Processing Addendum authorizing specific training uses of De‑identified Student Data, we will apply robust de‑identification and contractual restrictions and honour any board‑directed opt‑outs.
5. New purposes: If we wish to use Personal Information for a materially new purpose that a reasonable person would not expect, we will first seek additional consent before proceeding.

Consent and reasonableness (Canada)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), we collect, use and disclose Personal Information for purposes a reasonable person would consider appropriate in the circumstances and with meaningful consent, except where permitted or required by law. We obtain express consent for uses beyond what's reasonably expected to deliver the Service (e.g., model training on Personal Information). You may withdraw consent for non‑essential uses at any time, subject to legal or contractual restrictions and reasonable notice.

International transfers & service providers

We may process and store information in Canada and in other countries where we or our service providers operate. When information is processed outside Canada, it may be subject to the laws of those jurisdictions. We use contractual and security safeguards and remain responsible for Personal Information transferred to third parties for processing.

How we share information

We do not sell Personal Information.

We share information with:

• Service providers (e.g., hosting, storage, analytics, support) bound by confidentiality and security obligations;
• Your organization (e.g., your school board) where applicable, consistent with its policies and our agreements;
• Legal and safety: to comply with law, respond to legal process, or protect rights, safety and security;
• Corporate transactions: as part of a merger, acquisition or asset sale, with appropriate protections.

Retention & deletion

We retain Personal Information only as long as necessary to fulfil the purposes described above or as required by law. Typical retention (subject to change): account data (life of account + 2 years), support records (2 years), audit logs (12 months), backups (rolling 35–45 days). On request, and subject to legal limits and backups, we will delete or de‑identify Your Content and Personal Information.

Security

We use administrative, technical and physical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, role‑based access, secure software development practices, vulnerability management, and incident response. No system is perfectly secure; please use strong credentials and protect your account.

Breach response

If we determine that a breach of security safeguards poses a real risk of significant harm, we will report to the Office of the Privacy Commissioner of Canada, notify affected individuals as required, and keep records of all breaches.

Your rights

You have the right to access and request correction of your Personal Information in our custody or control, and to withdraw consent for non‑essential uses. We will respond within 30 days where possible. We may request identity verification and may charge a minimal fee as permitted by law.

Student Data in Ontario schools

For publicly funded schools in Ontario, student records are governed by the Education Act, the Ontario Student Record (OSR) Guideline, and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). Where we process Student Data at the direction of a school board, the board remains the custodian/controller of that information and our processing is subject to our agreement with the board. Teachers should minimise Student Data, avoid uploading sensitive health or discipline records unless expressly authorized and necessary, and follow their board's policies.

Cookies & analytics

We use necessary cookies to provide core functionality and optional analytics cookies to understand use and improve the Service. You can control cookies in your browser and through our in‑product settings. Disabling certain cookies may affect functionality.

Marketing communications (CASL)

We send service/transactional messages about your account. We send promotional emails or messages only with appropriate consent under Canada's Anti‑Spam Legislation (CASL). Every message includes an unsubscribe mechanism; you can opt out at any time.

Children & minors

The Service is for adult educators. We do not provide student accounts. We handle Student Data only when a teacher or school board inputs it for classroom purposes, subject to this Notice and applicable board agreements.

Changes to this Notice

We may update this Notice to reflect changes in our practices. Material changes will be notified through the Service or by email and will include a new 'Last updated' date.

How to contact us