Privacy Notice for the Moodle Plugin

1. Scope

This notice covers Process Feedback for Moodle, which is made of two open-source plugins that an institution installs on its own Moodle site:

• Local plugin (local_processfeedback): records the writing process in the student's browser on assignment and forum pages, and opens writing process reports.
• Assignment submission plugin (assignsubmission_processfeedback): stores a student's process data with their assignment submission in the institution's Moodle, and shows it to teachers in the grading view.

It also covers the Process Feedback report page at app.processfeedback.org when it is opened from Moodle.

Our other tools (browser extensions, other plugins, online document editor, online compiler, etc.) are covered by our general Privacy Policy, and Process Feedback LTI has its own Privacy Notice for LTI Users.

Process Feedback, LLC publishes the plugins and operates the report page. Privacy questions: contact@processfeedback.org.

2. Our role

The plugins are software that runs on the institution's Moodle site and in the user's browser. Process Feedback operates no server, database, or API that receives writing or writing-process data from the plugins. We cannot see, access, or retrieve data held in an institution's Moodle or in a student's browser.

Practically, this means:

• The institution controls installation, configuration, updates, and which courses use the plugins.
• The institution is the controller of the data the plugins create, and its own privacy, assessment, and retention policies apply to it.
• Students and teachers exercise their privacy rights through their institution, using Moodle's standard privacy tools (see Section 9).

The only personal data we process is what reaches us through support email and billing (see Section 7). Where a signed Data Privacy Agreement (DPA) exists with an institution, that agreement governs and prevails over this notice for the data it covers.

3. What the plugins record

The plugins run only in courses the site administrator has enabled, and only for users with the required Moodle capability. A panel on the page tells students that their edits are being tracked, and a notice tells teachers that Process Feedback is active.

What the plugins do not collect: biometric data, geolocation, device fingerprints, browsing history outside the enabled Moodle pages, or data from courses where Process Feedback is not enabled.

4. Data in the student's browser

The local plugin is local-first. As a student writes, their process data is saved in the browser's local storage (IndexedDB) on the device in use. Nothing is sent to Moodle or anywhere else while they write.

Several things follow:

• Data does not follow the student between devices. Writing done on another computer, in another browser, or in a private window is not included.
• Clearing browser data permanently deletes any process data that has not been downloaded or submitted.
• On a shared or public computer, process data stays in that browser until it is cleared. Students should submit or download their data and then clear the browser before leaving a shared device.
• Local data has the security of the device it is on. We cannot protect data on a device we do not control.

5. When data leaves the browser

Process data leaves the student's browser in only three ways, each started by a user:

• Download. The student saves their process data as a ZIP file to their own device.
• Open a report. The plugin opens the Process Feedback report page in a new browser tab and hands the process data to that tab inside the browser. The report is built on the user's device. The data is not uploaded to Process Feedback.
• Submit an assignment. When both plugins are installed and Auto submit on assignment submission is ticked for the assignment, the process data is uploaded to the institution's Moodle with the submission, through Moodle's standard file upload. The setting is ticked by default on new assignments in enabled courses, and the submission form tells the student their writing process data will be included. Teachers can untick it for any assignment.

When a teacher opens a report from the grading view, their browser fetches the submitted ZIP from the institution's Moodle and hands it to the report page in the same way.

6. The report page

The report page at app.processfeedback.org is a static web application served by Cloudflare. Loading it sends standard web request information, such as the IP address, to Cloudflare. It does not send document or student data, and we have not enabled request logging.

The report page has a Share this Report feature, which uploads a report to Process Feedback so it can be shared by link. It runs only when a user chooses it. Under a Tier 1 institutional subscription, Share this Report is disabled for the institution's email domains, so no report data from those accounts can reach Process Feedback. Where it is not disabled, a shared report is handled under our general Privacy Policy.

For the Open report button to open reports automatically, the institution's Moodle domain must be added to Process Feedback's list of recognized domains. Until then, users can download the ZIP and load it into the report page manually.

7. Data Process Feedback holds

We hold no student writing or writing-process data from the plugins. The personal data we do hold is limited to:

• Support correspondence that users or the institution choose to send us, which may include names, email addresses, and screenshots. It is kept for 12 months after the query is resolved and then deleted. Screenshots and attachments are deleted 90 days after resolution.
• Billing contact details for the institution's purchasing staff, kept for 7 years after the end of the relevant tax year, as required by US tax law. Billing records contain no student data.

We use three service providers, none of which receives student writing or writing-process data:

• Cloudflare serves the report page and receives standard web request information.
• Google Workspace holds support email, in the United States.
• Stripe processes payments, in the United States.

Each one is under a contract that limits it to processing data on our instructions. We notify institutional contacts at least 30 days before adding or replacing a provider that will process the institution's personal data.

8. No AI

The plugins and the report page contain no AI features. Student work is never sent to any AI or machine learning system, and no institutional data is used to train a model. Reports give no score, grade, or misconduct verdict.

9. Data in the institution's Moodle

Submitted process data is part of the assignment submission and follows its lifecycle:

• Access follows Moodle roles. Students who can submit can view their own submitted process data. Users with grading permission can view process summaries, download ZIP files, and open reports. The local plugin adds two capabilities: local/processfeedback:use and local/processfeedback:viewreports.
• Retention follows the institution's retention of the submission. Process data is removed when the submission is deleted.
• Backup and restore include process data along with its submission.
• Privacy requests are supported through Moodle's privacy API, which can find, export, and delete a user's process data along with their submission.
• Uninstalling the assignment submission plugin permanently deletes all submitted process data and summaries, in every course. Institutions that need to keep this data should export it first.

10. Choices and rights

Students, directly in Moodle:

• See the tracking panel whenever Process Feedback is active
• Download their own process data as a ZIP file at any time
• Open their own writing process report
• Clear unsubmitted process data from their browser

Anyone, through their institution:

• Request a copy of their records
• Request correction or deletion of their records
• Ask questions about how the institution uses the plugins

Because the data is held in the institution's Moodle and in users' browsers, most requests can be handled by the institution directly. If an institution needs our help, we respond within 5 business days.

11. Sensitive information in student writing

Student writing is free text and may contain information we never ask for, such as health details or information about other people. The plugins do not scan, classify, or analyze content to detect sensitive categories, and all content is handled the same way regardless of what it contains.

Writing-process timing describes how a document was written. It is not used to identify or authenticate anyone, and it is not biometric data.

12. Browser storage and tracking

The local plugin uses IndexedDB to hold the student's process data, as described in Section 4, and local storage to remember small interface preferences, such as whether the student has already opened the panel. Neither is used for tracking.

The plugins set no cookies of their own; Moodle's own session cookies apply as usual. There are no analytics scripts, tracking pixels, advertising tags, or third-party trackers in the plugins or the report page. Our public informational website uses analytics; the plugins and report page do not.

13. Security

• The report page is served over HTTPS and requires TLS 1.2 or higher. The plugins communicate only with the institution's Moodle, under its own TLS configuration.
• Process data is uploaded through Moodle's standard file upload, so Moodle's upload size limits and antivirus scanning apply.
• The plugins are open source (GPL v3), so institutions can review exactly what they do: local plugin and assignment submission plugin.
• Every code change is reviewed by someone other than its author and passes automated tests, static analysis, dependency checks, and secret scanning before release.
• We notify institutional contacts of security releases so they can install them.

14. Children

The plugins are provided to institutions for use by their students. Institutions are responsible for obtaining any consents required by law before students use them. We do not use student data for marketing or promotional purposes.

15. Data breaches

If a security incident affects the plugins, the report page, or data we hold, we investigate and contain it, assess its scope, and notify affected institutions without undue delay and within the timeframe set by the applicable institutional agreement.

16. Accessibility

An Accessibility Conformance Report (VPAT) for the Moodle plugin is available at processfeedback.org/vpat.

17. Changes to this notice

We review this notice at least annually and update it whenever the plugins' data handling or our service providers change materially. The effective date above reflects the most recent update. We notify institutional contacts in advance of any change that would send data off the user's device.

18. Contact

For privacy, security, accessibility, or general questions, reach us at contact@processfeedback.org. Students and teachers should contact their institution first, as the institution holds the records.