ABOUT US

1EdTech is the leading member-led non-profit edtech partnership accelerating the digital transformation of learning

The 1EdTech community is guided by a set of educational leadership strategies essential to improving learning experiences and outcomes in K-12, higher education, and lifelong learning

1EdTech community-led workstreams help create a secure, scalable, and best-in-class digital learning ecosystem to serve the needs of all learners

1EdTech standards support seamless interoperability, lower TCO, and greater choice.

The TrustEd Apps Directory is the official listing of products and applications reviewed, vetted, or certified by 1EdTech

1EdTech hosts the annual Learning Impact Conference and other engagement opportunities throughout the year to advance the leadership and ideas that shape the future of digital learning

TrustEd Apps Profile for ChatGPT

Product: ChatGPT
Vetted by 1EdTech PrivacyTeam, Data Privacy Team at 1EdTech on 2023-04-05
App Vetting Capability: Expert (Self Rated)

Privacy Rubric Results

  • N/A
  • UNMET
  • PARTIAL
  • MEETS
Data Collection
Security
3rd Party Data
Advertising
Certified
Rubric Area Expectations
General Meets Partially Meets Doesn't Meet
User Notes GEN1 - How are changes to key policies managed?
ANSWER: Notification is provided to the user in advance of a change
User Notes:
"We may change this Privacy Policy at any time. When we do, we will post an updated version on this page, unless another type of notice is required by applicable law. By continuing to use our Service or providing us with Personal Information after we have posted an updated Privacy Policy, or notified you by other means, you consent to the revised Privacy Policy.

"
"We may change this Privacy Policy at any time. When we do, we will post an updated version on this page, unless another type of notice is required by applicable law. By continuing to use our Service or providing us with Personal Information after we have posted an updated Privacy Policy, or notified you by other means, you consent to the revised Privacy Policy. "
Unselected Option: Answer Partially Meets Expectations Unselected Option:
Data Collected Meets Partially Meets Doesn't Meet
User Notes DCQ1 - Do the policies list all data collected?
ANSWER: Policies list the data collected OR policies state no data is collected
User Notes:
Account Information: When you create an account with us, we will collect information associated with your account, including your name, contact information, account credentials, payment card information, and transaction history, (collectively, “Account Information”).
Account Information: When you create an account with us, we will collect information associated with your account, including your name, contact information, account credentials, payment card information, and transaction history, (collectively, “Account Information”).
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes DCQ2 - Do the policies indicate how data is collected?
ANSWER: Policies state specifically how data is collected OR policies state no data collected
User Notes:
"User Content: When you use our Services, we may collect Personal Information that is included in the input, file uploads, or feedback that you provide to our Services (“Content”).
Communication Information: If you communicate with us, we may collect your name, contact information, and the contents of any messages you send (“Communication Information”).
Social Media Information: We have pages on social media sites like Instagram, Facebook, Medium, Twitter, YouTube and LinkedIn. When you interact with our social media pages, we will collect Personal Information that you elect to provide to us, such as your contact details (collectively, “Social Information”). In addition, the companies that host our social media pages may provide us with aggregate information and analytics about our social media activity."
"User Content: When you use our Services, we may collect Personal Information that is included in the input, file uploads, or feedback that you provide to our Services (“Content”). Communication Information: If you communicate with us, we may collect your name, contact information, and the contents of any messages you send (“Communication Information”). Social Media Information: We have pages on social media sites like Instagram, Facebook, Medium, Twitter, YouTube and LinkedIn. When you interact with our social media pages, we will collect Personal Information that you elect to provide to us, such as your contact details (collectively, “Social Information”). In addition, the companies that host our social media pages may provide us with aggregate information and analytics about our social media activity."
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes DCQ3 - Do the policies state who owns the data?
ANSWER: Policies state the user owns the data alone OR policies state no data collected
User Notes:
Ownership of content. As between you and OpenAI, and to the extent permitted by applicable law, you (a) retain your ownership rights in Input and (b) own the Output. We hereby assign to you all our right, title, and interest, if any, in and to Output.
Ownership of content. As between you and OpenAI, and to the extent permitted by applicable law, you (a) retain your ownership rights in Input and (b) own the Output. We hereby assign to you all our right, title, and interest, if any, in and to Output.
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes DCQ4 - Do the policies allow users to delete their data entirely?
ANSWER: Policies allow users to delete data entirely after a period of time OR policies state no data collected
User Notes:
"Depending on location, individuals in the EEA, the UK, and across the globe may have certain statutory rights in relation to their Personal Information. For example, you may have the right to:

Access your Personal Information.
Delete your Personal Information."
"Depending on location, individuals in the EEA, the UK, and across the globe may have certain statutory rights in relation to their Personal Information. For example, you may have the right to: Access your Personal Information. Delete your Personal Information."
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes DCQ5 - Do the policies state the retention of data?
ANSWER: Policies state a 90-day (or greater) retention policy OR policies give a general statement of data retention with no time period specified
User Notes:
We’ll retain your Personal Information for only as long as we need in order to provide our Service to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Information will depend on a number of factors, such as the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, our purpose for processing the information, and any legal requirements.
We’ll retain your Personal Information for only as long as we need in order to provide our Service to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain Personal Information will depend on a number of factors, such as the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, our purpose for processing the information, and any legal requirements.
Unselected Option: Answer Partially Meets Expectations Unselected Option:
Security Meets Partially Meets Doesn't Meet
User Notes SECQ1 - Do the policies state how data is protected?
ANSWER: Policies list the steps taken to protect data or OR policies state no data collected
User Notes:
We implement commercially reasonable technical, administrative, and organizational measures to protect Personal Information both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or email transmission is ever fully secure or error free. In particular, email sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us via the Service or email. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third party websites.
We implement commercially reasonable technical, administrative, and organizational measures to protect Personal Information both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or email transmission is ever fully secure or error free. In particular, email sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us via the Service or email. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Service, or third party websites.
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes SECQ2 - Do the policies state all confidential & sensitive information is encrypted throughout?
ANSWER: Data encrypted throughout OR passes an encryption test with no vulnerabilities OR policies state no data collected
User Notes:
SSL Labs report shows an overall rating of A
SSL Labs report shows an overall rating of A
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes SECQ3 - Do the policies state whether or not it enforces strong password creation?
ANSWER: Supplier enforces strong password creation OR supplier user base exempt from password requirements or OR no account creation required
User Notes:
Supplier enforces strong password creation
Supplier enforces strong password creation
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes SECQ4 - Do the policies indicate whether or not it leverages 2 step (or other forms of multifactor) authentication?
ANSWER: Supplier uses SSO or an LTI launch OR no account creation is required OR supplier user base exempt from 2-step authentication requirements
User Notes:
SSO via Google & Microsoft accounts
SSO via Google & Microsoft accounts
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes SECQ5 - Do the policies state the use of cookies?
ANSWER: Policies list all cookies used and each cookie's purpose OR policies state that it only uses cookies that are crucial for app functionality
User Notes:
We use cookies to operate and administer our Services, and improve your experience on it. A “cookie” is a piece of information sent to your browser by a website you visit. You can set your browser to accept all cookies, to reject all cookies, or to notify you whenever a cookie is offered so that you can decide each time whether to accept it. However, refusing a cookie may in some cases preclude you from using, or negatively affect the display or function of, a website or certain areas or features of a website.
We use cookies to operate and administer our Services, and improve your experience on it. A “cookie” is a piece of information sent to your browser by a website you visit. You can set your browser to accept all cookies, to reject all cookies, or to notify you whenever a cookie is offered so that you can decide each time whether to accept it. However, refusing a cookie may in some cases preclude you from using, or negatively affect the display or function of, a website or certain areas or features of a website.
Answer Meets Expectations Unselected Option: Unselected Option:
Third Party Data Meets Partially Meets Doesn't Meet
User Notes SHRQ1 - Do the policies state the use of third parties?
ANSWER: Policies list each third party separately OR policies state third party use strictly for app functionality OR policies state that they do not use third parties
User Notes:
"In certain circumstances we may provide your Personal Information to third parties without further notice to you, unless required by the law:

Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may provide Personal Information to vendors and service providers, including providers of hosting services, cloud services, and other information technology services providers, event management services, email communication software and email newsletter services, and web analytics services. Pursuant to our instructions, these parties will access, process, or store Personal Information only in the course of performing their duties to us.
Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively a “Transaction”), your Personal Information and other information may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Services, or the public, or (v) protect against legal liability.
Affiliates: We may disclose Personal Information to our affiliates, meaning an entity that controls, is controlled by, or is under common control with OpenAI. Our affiliates may use the Personal Information we share in a manner consistent with this Privacy Policy."
"In certain circumstances we may provide your Personal Information to third parties without further notice to you, unless required by the law: Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may provide Personal Information to vendors and service providers, including providers of hosting services, cloud services, and other information technology services providers, event management services, email communication software and email newsletter services, and web analytics services. Pursuant to our instructions, these parties will access, process, or store Personal Information only in the course of performing their duties to us. Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively a “Transaction”), your Personal Information and other information may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets. Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Services, or the public, or (v) protect against legal liability. Affiliates: We may disclose Personal Information to our affiliates, meaning an entity that controls, is controlled by, or is under common control with OpenAI. Our affiliates may use the Personal Information we share in a manner consistent with this Privacy Policy."
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes SHRQ2 - Do the policies state what information is shared with each 3rd party?
ANSWER: Policies list the data it shares with each third party separately OR policies state that it does not share any data with any third party
User Notes:
"In certain circumstances we may provide your Personal Information to third parties without further notice to you, unless required by the law:

Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may provide Personal Information to vendors and service providers, including providers of hosting services, cloud services, and other information technology services providers, event management services, email communication software and email newsletter services, and web analytics services. Pursuant to our instructions, these parties will access, process, or store Personal Information only in the course of performing their duties to us.
Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively a “Transaction”), your Personal Information and other information may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Services, or the public, or (v) protect against legal liability.
Affiliates: We may disclose Personal Information to our affiliates, meaning an entity that controls, is controlled by, or is under common control with OpenAI. Our affiliates may use the Personal Information we share in a manner consistent with this Privacy Policy."
"In certain circumstances we may provide your Personal Information to third parties without further notice to you, unless required by the law: Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may provide Personal Information to vendors and service providers, including providers of hosting services, cloud services, and other information technology services providers, event management services, email communication software and email newsletter services, and web analytics services. Pursuant to our instructions, these parties will access, process, or store Personal Information only in the course of performing their duties to us. Business Transfers: If we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively a “Transaction”), your Personal Information and other information may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets. Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Services, or the public, or (v) protect against legal liability. Affiliates: We may disclose Personal Information to our affiliates, meaning an entity that controls, is controlled by, or is under common control with OpenAI. Our affiliates may use the Personal Information we share in a manner consistent with this Privacy Policy."
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes SHRQ3 - Do the policies state whether or not users can opt out of 3rd party data sharing?
ANSWER: Policies include an easy opt out process for users OR policies state that it does not share any data with any third party
User Notes:
You can opt out of training through our privacy portal by clicking on “do not train on my content,” or to turn off training for your ChatGPT conversations, follow the instructions in our Data Controls FAQ. Once you opt out, new conversations will not be used to train our models."
You can opt out of training through our privacy portal by clicking on “do not train on my content,” or to turn off training for your ChatGPT conversations, follow the instructions in our Data Controls FAQ. Once you opt out, new conversations will not be used to train our models."
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes SHRQ4 - Do the policies state if the supplier requires 3rd parties to adhere to the terms of the vendor/customer agreement?
ANSWER: Supplier claims responsibility for third party privacy practices OR policies state that it does not share any data with any third party
User Notes:
Pursuant to our instructions, these parties will access, process, or store Personal Information only in the course of performing their duties to us.
Pursuant to our instructions, these parties will access, process, or store Personal Information only in the course of performing their duties to us.
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes SHRQ5 - Do the policies state whether or not user is notified of a change in third parties?
ANSWER: Supplier changes third party with no mention of terms OR policies are unclear on data sharing terms with the new third parties
User Notes:
"We may change this Privacy Policy at any time. When we do, we will post an updated version on this page, unless another type of notice is required by applicable law. By continuing to use our Service or providing us with Personal Information after we have posted an updated Privacy Policy, or notified you by other means, you consent to the revised Privacy Policy.

"
"We may change this Privacy Policy at any time. When we do, we will post an updated version on this page, unless another type of notice is required by applicable law. By continuing to use our Service or providing us with Personal Information after we have posted an updated Privacy Policy, or notified you by other means, you consent to the revised Privacy Policy. "
Unselected Option: Answer Partially Meets Expectations Unselected Option:
Advertising Meets Partially Meets Doesn't Meet
User Notes ADVQ1 - Do the policies indicate if advertisements are displayed?
ANSWER: No ads are displayed
User Notes:
No ads displayed
No ads displayed
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes ADVQ2 - Do the policies indicate whether or not users are targeted for advertisement?
ANSWER: Policies guarantee no ad targeting OR Policies state no ads are used on its platform
User Notes:
No ads displayed
No ads displayed
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes ADVQ3 - Do the policies indicate whether or not any 3rd parties track or collect information for advertisement?
ANSWER: Policies state third parties are not used for ads or tracking
User Notes:
No ads displayed
No ads displayed
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes ADVQ4 - Do the policies indicate whether or not web beacons or other tracking methods are used for ad purposes?
ANSWER: Policies state that it only tracks interactions within its application OR policies state that it does not use any tracking technologies for ads
User Notes:
No ads displayed
No ads displayed
Answer Meets Expectations Unselected Option: Unselected Option:
User Notes ADVQ5 - Do the policies state whether or not users can opt out of sharing data with advertisers?
ANSWER: Policies state in detail how users can opt out of sharing data with advertisers OR policies state no ads are used on its platform
User Notes:
No ads displayed
No ads displayed
Answer Meets Expectations Unselected Option: Unselected Option:

Vetting Context

Policies Cited

The following urls were cited as a basis for this information.

  • The person providing this information is NOT using the product.
  • The supplier was NOT consulted about this evaluation.

Geographical Context

(Laws and regulations can vary across regions)
California
United States United States flag

Regulatory Compliance

The information below provides insight into compliance with various regulatory policies.

  • GDPR Compliant: Unknown
  • FERPA Compliant: Unknown
  • COPPA Compliant: Unknown

Use by children under the age of 13 could not be determined.

Email 1EdTech about this record

The views and opinions expressed in this information are those of the authors and do not necessarily reflect the official policy or position of 1EdTech. The information provided is intended to surface trends about the policies and procedures of systems leveraged by the educational community. It should not be considered legal advice.

Disclaimer: 1EdTech Trusted Apps provides a vetting of a product's data policy according to the 1EdTech Trusted Apps Rubric. Achieving the TrustEd Apps Certified Seal indicates adherence to a baseline level of privacy. Institutions should review an application's detailed vetting results before approving it for use.

© Copyright 2024 1EdTech Global Learning Consortium Inc. All Rights Reserved.

App Vetting Rubric Version: 2