Three privacy policies gave three different training answers

The classroom note

A department head told to check the privacy policy before a new AI tool goes live discovers there is rarely one document to check. Reading the privacy pages of three tools schools use, as retrieved on 16 September 2026, gives three different answers to one question: does using this tool train the company's AI. MagicSchool's privacy policy states plainly that it does not; Turnitin's services privacy policy states the opposite for its own detection models; and OpenAI's US privacy policy turns out not to be the document that governs the classroom product at all.

What the evidence says

MagicSchool's policy states it will not use Student Data "to train, fine-tune, or improve" AI or machine learning models, and that data sent through its AI features is "deleted within thirty (30) days"; its separate student data policy repeats that promise for children's information, effective 9 March 2026. Turnitin's policy states the opposite design choice: it may use submitted writing "to develop, refine, and improve" its own machine learning and AI models for writing, citation and plagiarism detection, retaining personal information only "for the period necessary" before deletion. OpenAI's US privacy policy, updated 10 September 2026, states it "does not apply to content" it processes for business customers such as API users, whose use is "governed by our customer agreements" instead - so a school using ChatGPT Edu is not covered by the document most searches return first.

The implementation question

None of this ranks the vendors; it is a lesson in which document to ask for. A district needs the policy covering the product a class will use, not a company's general consumer terms, and needs to know whether "does not train models" applies to all data, since Turnitin's own policy still permits training use for its detection systems. A stated 30-day deletion window is a specific, checkable number; a policy that only promises retention "as necessary" is not something a procurement officer can verify without asking.

What holds and what fails

What holds: a vendor's published policy is a genuine, checkable statement of intent, and the differences between vendors here are real and worth comparing. What fails: assuming any single page, especially a homepage-linked "Privacy Policy," necessarily covers the contract a school signs. This is an editorial checklist, not a compliance audit: a school's actual protections depend on its signed data processing agreement, not the marketing page, and nothing here is legal advice about whether a given policy satisfies FERPA or a state student-data law.

• Does this privacy policy explicitly cover the school or district product, or only the public website and consumer app?
• Does the policy state whether student inputs are used to train or improve AI models, and does that promise apply to all data or a subset?
• Does the policy give a specific retention period, or only a vague "as necessary" standard?

A privacy policy read alone answers less than it appears to. Read three side by side, on the same day, and the differences between tools, not their marketing language, start to show.