Privacy Policy

Lecon is a curriculum management platform designed for colleges, universities, and other educational institutions. It helps institutions manage programs, courses, learning outcomes, syllabi, approval processes, assessment evidence, and accreditation records.

Providing this service involves handling some personal information about the people who use Lecon, as well as information submitted through our website and communications with us.

This Privacy Policy explains what information we collect, why we collect it, how it is used, who may access it, where it is stored, and how long we keep it.

We take institutional confidentiality and personal information seriously. We do not sell personal information, use institutional curriculum content to train artificial intelligence models, or use institutional records for advertising.

1. Who Is Responsible for Your Information

The responsibilities for personal information depend on how you interact with Lecon.

Information managed on behalf of an institution

When an educational institution subscribes to Lecon, it determines what information about its employees, faculty members, and other users is entered into the platform and how that information is used for its academic and administrative purposes.

In these circumstances, the institution generally determines the purposes and means of processing that information, while Lecon processes it to provide and support the service, in accordance with the institution's instructions and our contractual obligations.

Depending on the applicable privacy law, the institution may be referred to as the data controller or responsible organization, and Lecon may act as its data processor or service provider.

If you have a Lecon account and want to access, correct, or delete personal information associated with your institutional account, please contact your institution first. Its administrators can manage most account information directly, and we will assist where necessary.

Information we collect directly

For information collected through our public website, demonstration requests, business communications, and direct interactions with Lecon, we are responsible for determining how that information is used.

Lecon is operated by:

LECON EDUCATION TECHNOLOGY INC.

A company incorporated in British Columbia, Canada.

Website: https://lecon.app

Privacy contact: info@lecon.app

2. What Information We Collect

The information we handle depends on how you use Lecon.

A. People who use Lecon

When an institution provides access to Lecon, we may collect and process the following information:

Account information

• Full name.

• Work email address.

• Job title or position.

• Telephone number, if provided.

• Profile picture, if uploaded.

• Institutional role and assigned permissions.

• Department, faculty, or organizational affiliation, where provided.

• Approval responsibilities and authorization levels.

This information is used to create accounts, manage permissions, identify users, and support institutional workflows.

Activity and approval records

Lecon maintains an activity log that records actions performed within the platform, including:

• Curriculum submissions.

• Program and course approvals.

• Requests for revisions or send-backs.

• Edits and corrections.

• Comments and review activities.

• Changes to institutional records.

• The identity of the person performing the action and the time it occurred.

These records form an institutional audit trail that helps demonstrate how curriculum decisions were made and approved.

Activity records are not ordinarily editable by users. They are retained for as long as the associated institutional records are maintained, subject to applicable retention requirements and deletion procedures.

Sign-in and session information

When you sign in, Lecon processes certain technical information necessary to authenticate your account and maintain your session.

This may include:

• Session cookies.

• Hashed session tokens.

• Browser type and user agent information.

• Sign-in timestamps.

• Authentication and security events.

Passwords are stored as Argon2id hashes. We do not store passwords in readable form.

Documents and uploaded files

Your institution may upload documents and files associated with programs, courses, and academic processes, including:

• Course outlines and syllabi.

• Curriculum documents.

• Assessment rubrics.

• Committee papers.

• Accreditation evidence.

• Supporting academic documentation.

These files are treated as institutional content and are handled in accordance with Section 5 of this policy.

Email and notification records

Lecon may send emails on behalf of an institution, including:

• Account invitations.

• Approval notifications.

• Workflow reminders.

• Submission and revision notifications.

• Other institutional system notifications.

We maintain records of these communications in the platform's notification outbox so that authorized institutional administrators can review which notifications were sent.

B. Information received from connected systems

Lecon can connect with institutional systems to support authentication, academic workflows, and curriculum data exchange.

The information received depends on the integration enabled by the institution.

Learning management systems (LMS)

When an instructor accesses Lecon through a course in an integrated LMS, the LMS may provide:

• The instructor's name.

• Email address.

• The LMS platform's user identifier.

• Relevant course or integration context.

This information allows Lecon to identify the instructor and attribute their academic work to the correct person.

Single sign-on (SSO)

When an institution enables single sign-on, its identity provider may provide information through an authentication assertion, including:

• Email address.

• Name.

• Employee or institutional identifier.

• Department.

• Organizational affiliation.

The specific information depends on the institution's identity provider and configuration.

Lecon uses this information to authenticate users and assign access to the appropriate institutional workspace.

Student information systems (SIS)

Where an institution connects its student information system to Lecon, the platform may send approved curriculum information to that system.

Depending on the integration, this may include:

• Approved program and course information.

• Curriculum descriptions.

• Approved learning outcomes.

• Effective dates and applicable academic periods.

Drafts, internal comments, and personal information about reviewers are not included in these exports unless specifically required and authorized through an agreed integration.

C. Assessment evidence and student information

Lecon supports the collection and reporting of program-level learning outcome assessment evidence.

There are two main ways assessment information may enter the platform.

Assessment data received from an LMS

When faculty assess program outcomes against a rubric in an integrated LMS, Lecon may receive aggregated assessment information.

This information includes:

• The number of students assessed.

• The number of students achieving each rubric performance level.

• Results grouped by assessment criterion.

The standard aggregated assessment data received by Lecon does not include student names, student identifiers, or individual assessment results.

Lecon uses these aggregated counts to generate program-level outcome attainment reports.

Assessment evidence entered manually

An institution may also record assessment evidence manually, such as:

• Portfolio reviews.

• Capstone project assessments.

• Licensure examination results.

• External examination results.

• Other program-level assessment activities.

In some cases, an institution may choose to include student names or student identifiers to maintain a traceable record of individual assessment evidence.

Providing these identifiers is optional, depending on the institution's assessment process.

Where included, student names and identifiers are personal information. They are stored as part of the institution's records and are accessible only to authorized users with appropriate permissions.

Student names and identifiers are not included in standard program-level attainment reports. Reports use aggregated assessment counts rather than displaying individual student identities.

The institution is responsible for ensuring that it has the appropriate authority and legal basis to collect and store student information through Lecon.

D. People who request a demonstration or contact us

If you request a demonstration, contact us through our website, or communicate directly with our team, we may collect:

• Name.

• Job title or position.

• Institution or organization.

• Work email address.

• Telephone number, if provided.

• Information included in your message.

• Details of your communication with our team.

We use this information to:

• Respond to your inquiry.

• Arrange product demonstrations.

• Provide information about Lecon.

• Follow up on institutional requirements.

• Prepare subscription or implementation arrangements where appropriate.

We do not use demonstration requests to create unrelated marketing profiles or sell personal information to third parties.

3. How We Use Information

We use personal information only for purposes related to providing and operating Lecon, communicating with institutions, and managing our business.

These purposes include:

• Creating and managing user accounts.

• Authenticating users and controlling access.

• Supporting curriculum management and approval workflows.

• Maintaining institutional activity logs and audit trails.

• Processing assessment evidence and generating reports.

• Supporting LMS, SSO, and SIS integrations.

• Sending institutional notifications and service communications.

• Providing customer support and troubleshooting.

• Maintaining platform security and reliability.

• Monitoring technical performance and resolving errors.

• Responding to demonstration requests and business inquiries.

• Meeting applicable legal and regulatory obligations.

We do not sell personal information.

We do not use institutional curriculum content, uploaded documents, approval records, or assessment evidence to train artificial intelligence or machine learning models.

We do not use institutional records for advertising.

4. Cookies and Similar Technologies

Lecon uses cookies and similar technologies to support authentication, maintain sessions, and improve the experience of visitors to our public website.

Essential cookies

When you sign in to Lecon, the platform sets a session cookie necessary to maintain your authenticated session.

During single sign-on, temporary cookies may also be used to complete the authentication process. These are removed when the authentication process finishes, subject to the browser's normal cookie handling.

These cookies are necessary for the service to function.

Lecon also remembers certain interface preferences, such as whether the navigation menu was collapsed. These preferences are stored locally in your browser and are not transmitted to our servers as part of the preference itself.

Cookies on public website pages

Our public website includes pages such as:

• Home.

• Pricing.

• Blog.

• Frequently Asked Questions.

• Documentation.

• Other informational pages.

These pages may use third-party services to support website functionality and understand how visitors use the website.

Google Analytics

We use Google Analytics on our public website to understand how visitors interact with our pages.

Google Analytics may collect information such as:

• Pages visited.

• Approximate geographic location.

• Browser and device information.

• Referral sources.

• General website interaction information.

This information helps us understand which public pages are useful and improve our website.

Google may process this information under its own privacy policies and applicable service terms.

Tidio chat

We use Tidio to provide a chat feature on our public website.

When you interact with the chat, information you submit, such as your name, email address, and message, may be processed by Tidio and made available to our team.

Tidio may use cookies or similar technologies to maintain conversations and support the chat service.

Please avoid submitting sensitive personal information or confidential institutional documents through the website chat.

No third-party analytics inside institutional workspaces

Google Analytics and Tidio are not loaded within the institutional working environment.

Pages where institutional staff manage curriculum, programs, courses, approvals, assessment evidence, and other institutional records do not use these third-party scripts.

This includes the institutional administration environment, LMS tools, and embedded curriculum catalogues.

We do not provide institutional curriculum information, course names, program names, or individual user activity from these working environments to Google Analytics or Tidio through those scripts.

Managing cookies

You can manage or delete cookies through your browser settings.

Blocking essential cookies may prevent you from signing in or using certain Lecon features.

Where applicable privacy laws require consent for non-essential cookies or tracking technologies, we will obtain that consent before activating them.

5. Who Has Access to Your Information

We do not sell, rent, or commercially distribute personal information.

We may share information with service providers who help us operate Lecon and provide our services.

These providers may include:

Hosting provider

Our hosting provider operates the infrastructure on which Lecon runs and stores institutional database records.

Email service provider

Our email provider helps deliver account invitations, notifications, reminders, and other service communications.

Object storage provider

Uploaded documents and files may be stored in object storage, depending on the institution's configuration.

Google Analytics

Google receives information collected through analytics on our public website only, as described in Section 4.

Tidio

Tidio receives information submitted through the chat feature on our public website.

Legal and regulatory authorities

We may disclose information where required by applicable law, a valid legal order, or a lawful request from an authorized authority.

Where legally permitted, we will notify the affected institution or individual before making such a disclosure.

Access by Lecon personnel

Our authorized personnel may access an institution's workspace when necessary to:

• Set up a new institutional environment.

• Provide technical support.

• Investigate reported problems.

• Maintain or troubleshoot the platform.

• Restore institutional records at the institution's request.

• Address security incidents.

Access is restricted to legitimate operational purposes.

Our personnel use their own named accounts when accessing institutional environments. Their actions are recorded in the relevant institutional activity log, consistent with the platform's audit procedures.

We do not routinely access institutional curriculum records for unrelated business or marketing purposes.

Service provider obligations

We take reasonable steps to ensure that service providers handling personal information on our behalf are subject to appropriate confidentiality, security, and data protection obligations.

The current list of our principal service providers and their operating locations is available upon request at info@lecon.app.

6. How Long We Keep Information

We retain information only for as long as reasonably necessary to provide our services, meet contractual obligations, maintain institutional records, and comply with applicable legal requirements.

Our retention practices include the following.

Institutional curriculum records

While an institution maintains an active subscription, its curriculum records and associated activity logs are retained to support ongoing academic management, governance, and accreditation processes.

The institution determines its academic record retention requirements, subject to our contractual and technical retention arrangements.

Activity and approval logs

Activity logs are maintained with their associated institutional records because they provide evidence of submissions, reviews, approvals, and changes over time.

They are not ordinarily editable by users.

Account information

User account information is retained while the account remains active.

When an institution removes a user or disables an account, the account's access is revoked. Certain historical activity records may remain as part of the institution's audit trail.

Uploaded documents and files

Uploaded files are retained as part of the institution's curriculum records while the subscription remains active, unless the institution deletes them or another retention requirement applies.

When a subscription ends

Following termination or expiry of an institution's subscription, we retain its institutional data for 30 days to allow the institution to request and download an archive.

After this period, we delete or anonymize institutional data from active systems, except where retention is required by law or for legitimate legal, accounting, or security purposes.

Data remaining in routine backups is removed in accordance with the applicable backup rotation schedule.

Demonstration requests and business inquiries

We retain information submitted through demonstration requests and direct business inquiries while we are communicating with the individual or institution.

Unless the institution becomes a customer or another legitimate retention requirement applies, we generally retain these records for no longer than two years after the last meaningful contact.

Legal and security records

Certain information may be retained for longer where necessary to meet legal obligations, resolve disputes, maintain financial records, or investigate security incidents.

7. Data Storage and Location

LECON EDUCATION TECHNOLOGY INC. is incorporated in British Columbia, Canada.

Lecon's production infrastructure is hosted in Canada, in our hosting provider's data centre in Quebec.

Our intended data storage arrangement is as follows:

• Institutional database records are stored in Canada.

• Uploaded institutional documents are stored in Canadian object storage.

• Database backups are stored in separate Canadian storage.

• Uploaded file backups are maintained in separate Canadian storage.

• Institution-specific archives and recovery copies are maintained in Canada.

We aim to keep institutional curriculum records, uploaded files, and their backups within Canada.

However, certain third-party services used for communications, website analytics, or customer support may process limited information outside Canada.

For example, an email provider may process recipient addresses and message delivery information, while Google Analytics and Tidio may process information collected through our public website.

Where information is processed outside Canada, it may be subject to the laws of the country where the relevant service provider operates.

We take reasonable steps to ensure that third-party providers are subject to appropriate contractual and data protection safeguards.

Institutions requiring specific data residency, access, or international transfer arrangements may contact us to discuss their requirements before subscribing.

8. Security and Protection Measures

We use administrative, technical, and organizational safeguards designed to protect personal information and institutional records.

Our security measures include the following.

Encrypted connections

Lecon is served over HTTPS, and information transmitted between your browser and the platform is protected using TLS encryption.

Password protection

Passwords are stored as Argon2id hashes rather than readable passwords.

Session security

Session tokens are stored as hashes rather than in their original readable form.

Institutional data separation

Each institution operates within its own designated workspace.

Application queries are scoped to the relevant institution, and access controls are designed to prevent one institution from accessing another institution's records.

Role-based permissions

Institutional administrators manage user roles and permissions to control access to curriculum records and administrative functions.

Activity monitoring

The platform records user actions through institutional activity logs, supporting accountability and traceability.

Backup protection

We maintain backup procedures designed to support recovery in the event of data loss, infrastructure failure, or an unsuccessful deployment.

Restricted operational access

Access by Lecon personnel is limited to authorized individuals who require it to perform their responsibilities.

No internet-based service can guarantee absolute security. Although we take reasonable measures to protect information, we cannot guarantee that unauthorized access, cyberattacks, or data loss will never occur.

9. Security Incidents

If we become aware of a security incident involving unauthorized access to, disclosure of, or loss of personal information, we will take reasonable steps to investigate and address the incident.

Where institutional data is affected, we will notify the relevant institution without undue delay and provide reasonable assistance with:

• Understanding the nature of the incident.

• Identifying the information potentially affected.

• Investigating the cause and scope.

• Taking steps to contain and address the incident.

• Supporting any required notifications.

Where applicable law requires notification to individuals or regulatory authorities, the legally responsible organization will determine and carry out the required notifications, with our reasonable assistance where we are acting as its service provider.

We will also take reasonable steps to prevent similar incidents from occurring again.

10. Backups and Data Recovery

We maintain backups to support the recovery of Lecon's production environment and institutional records.

Our backup arrangements include the following.

Database backups

The production database is backed up daily through a nightly database dump.

These backups are:

• Retained for fourteen days on a rolling basis.

• Copied off the production server to separate storage.

• Maintained in Canada.

• Used to support recovery, migration, and infrastructure upgrades.

A separate database backup is also taken before each production deployment.

Uploaded file backups

Uploaded institutional files are stored in object storage.

Where the backup configuration applies, files are copied nightly to a separate storage bucket.

Deleted files may remain in backup storage for up to thirty days before being permanently removed through the backup retention process.

Institution-specific backups

Each institution also has its own weekly backup of its curriculum records.

The four most recent institution-specific backups are retained, providing approximately one month of recovery history.

Institutional administrators can download available backups through:

Settings → Data and Audit

These backups allow an institution's records to be restored independently without reverting the entire Lecon platform or affecting other institutions.

An institution-specific restoration is performed at the institution's request and is recorded as part of the relevant operational activity.

Backup limitations

Backups are designed to support data recovery but do not guarantee recovery in every situation.

The actual restoration point and recovery time depend on the nature of the incident and the available backup.

We periodically use restoration activities as part of service maintenance and infrastructure operations to help verify that backup procedures remain functional.

For questions about backup retention, recovery procedures, or institution-specific security information, contact support@lecon.app.

We can provide additional information to support institutional procurement and security reviews.

11. Institutional Single Sign-On

Lecon supports institutional single sign-on (SSO).

When an institution enables SSO, its identity provider handles the authentication process and applies the institution's own sign-in policies.

These policies may include:

• Multi-factor authentication.

• Password requirements.

• Account access restrictions.

• Employee account management.

• Account suspension or termination.

Lecon receives the authentication information necessary to identify the user and grant access to the appropriate institutional workspace.

Lecon does not receive or store the user's institutional password through the SSO process.

Where an institution disables a user's account through its identity provider, access to Lecon may also be revoked through the integration, subject to the institution's configuration and synchronization arrangements.

The institution remains responsible for configuring and managing its identity provider and its authentication policies.

12. Your Privacy Rights

Depending on your location and the privacy laws that apply, you may have rights relating to your personal information.

These rights may include:

• Requesting access to personal information held about you.

• Requesting correction of inaccurate or incomplete information.

• Requesting deletion where legally permitted.

• Withdrawing consent where processing is based on consent.

• Objecting to certain uses of personal information.

• Requesting information about how your data is collected, used, and disclosed.

• Filing a complaint with the relevant privacy regulator.

If you have a Lecon institutional account

If your personal information is maintained within an institution's Lecon workspace, please contact your institution first.

The institution generally determines the purposes for which that information is used and can manage most account-related requests directly.

We will assist the institution with requests that require our involvement.

If you contacted Lecon directly

If you submitted a demonstration request, contacted our team, or provided information directly through our public website, you may contact us at:

info@lecon.app

We will review and respond to privacy requests within the time required by applicable law.

Where a specific response period does not apply, we aim to respond within 30 days.

Privacy complaints

If you believe that we have handled your personal information improperly, please contact us first so that we can investigate your concern.

You may also have the right to submit a complaint to the privacy regulator responsible for your jurisdiction.

13. Educational Institutions and Applicable Privacy Laws

Lecon serves educational institutions in Canada and may also serve institutions in other countries.

Different privacy laws may apply depending on the institution, the individuals involved, the nature of the information, and where the information is processed.

Examples include:

• British Columbia: Personal Information Protection Act (PIPA) and, where applicable, the Freedom of Information and Protection of Privacy Act (FIPPA).

• Canada: Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable.

• United States: Family Educational Rights and Privacy Act (FERPA), where applicable.

• European Union: General Data Protection Regulation (GDPR).

• United Kingdom: UK General Data Protection Regulation and applicable UK data protection legislation.

The institution is responsible for determining the legal requirements that apply to its collection and use of personal information.

We will work with institutions to establish appropriate contractual arrangements and data processing terms where required.

Where necessary, we can enter into a separate Data Processing Agreement (DPA) or other institutional privacy and security agreement.

14. Children

Lecon is designed for use by educational institutions, including colleges, universities, and other post-secondary organizations.

The platform is intended primarily for faculty members, administrators, staff, and other authorized institutional users.

Lecon is not designed or marketed as a service for children, and we do not knowingly collect personal information directly from children through our public website.

If an institution uses Lecon in a context involving student information, the institution is responsible for ensuring that the collection and processing of that information comply with applicable privacy laws and institutional policies.

If we become aware that personal information has been collected inappropriately, we will take reasonable steps to address the matter.

15. Third-Party Websites and Services

Lecon may contain links to third-party websites or integrate with external services.

These services may include learning management systems, identity providers, student information systems, payment services, and other institutional applications.

Third-party websites and services are governed by their own privacy policies and terms of service.

We are not responsible for the privacy practices of third parties operating independently of Lecon.

We encourage institutions and users to review the privacy policies of external services before enabling integrations or submitting personal information to them.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, data processing practices, security measures, legal requirements, or business operations.

If we make a material change that affects how institutional or personal information is handled, we will provide advance notice to institution administrators by email where appropriate.

The date at the top of this page indicates when the current version of this Privacy Policy took effect.

We encourage institutions and users to review this page periodically.

17. Contact Us

If you have questions about this Privacy Policy, how Lecon handles personal information, or your privacy rights, please contact us.

LECON EDUCATION TECHNOLOGY INC.

Email: info@lecon.app

Support: support@lecon.app

Website: https://lecon.app

For institutional privacy requests, data processing agreements, security reviews, or questions about data residency, please contact us by email.

We will work with your institution to address reasonable privacy and data protection requirements.