PRIVACY POLICY

Last updated December 12, 2025

This Privacy & Cookies Policy for Boston Academic Publishing Inc d.b.a FlatWorld (“we,” “us,” or “our”) describes how and why we might collect, store, use, and/or share (“process”) your information when you use our products or services (“Services”), such as when you:

Visit our website at https://discover.flatworld.com, https://catalog.flatworldknowledge.com flatworld.com, and fwk.com or any website of ours that links to this privacy notice
Engage with us in other related ways, including any sales, marketing, or events

Questions or concerns? Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at support@flatworld.com.

SUMMARY OF KEY POINTS

What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with us and the Services, the choices you make, and the products and features you use.

Do we process any sensitive personal information? We may process sensitive personal information when necessary with your consent or as otherwise permitted by applicable law, including student education records.

Do we collect any information from third parties? We may collect information from public databases, marketing partners, social media platforms, educational institutions, and other outside sources.

How do we process your information? We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

In what situations and with which parties do we share personal information? We may share information in specific situations and with specific third parties as described in this policy.

Do we handle student education records? Yes. If we process student education records on behalf of educational institutions, additional protections under FERPA may apply. See our FERPA section below.

What are your rights? Depending on where you are located geographically, the applicable privacy law may mean you have certain rights regarding your personal information.

How do you exercise your rights? The easiest way to exercise your rights is by submitting a data subject access request or by contacting us at support@flatworld.com.

FERPA Compliance and Educational Records
What Information Do We Collect?
How Do We Process Your Information?
When and With Whom Do We Share Your Information?
Cookies and Tracking Technologies
How Long Do We Keep Your Information?
How Do We Keep Your Information Safe?
Information From Minors
Your Privacy Rights
US State-Specific Privacy Rights
International Data Transfers
Updates to This Notice
Contact Us

1. FERPA COMPLIANCE AND EDUCATIONAL RECORDS

FlatWorld recognizes that information collected from students through educational institutions may constitute “education records” as defined under the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. When we provide services to educational institutions, we act as a service provider performing institutional functions on behalf of the school, consistent with FERPA’s “school official” exception (34 CFR § 99.31(a)(1)).

Our Commitments

We commit to:

Using student education records only for legitimate educational purposes
Not disclosing education records without proper consent or a valid FERPA exception
Maintaining the confidentiality and security of education records
Complying with all applicable FERPA requirements

Our Commitment: No Marketing to Students

We do not market to students. This is a firm commitment, not just a policy detail. Specifically, we do not:

Send marketing or promotional emails to students
Use student education records to build marketing profiles
Deliver targeted advertising to students based on their educational data
Sell or share student information with marketers
Allow third parties to market to students using data we hold
Pursue any commercial purposes unrelated to the educational services requested by their institution

This applies to all students whose information we receive through educational institutions, regardless of age.

Your FERPA Rights

Students and parents (for students under 18 not in postsecondary education) have the following rights under FERPA:

Right to Inspect and Review: You may request to inspect and review education records we maintain. Contact your educational institution or email ferpa@flatworld.com.

Right to Request Amendment: You may request correction of education records you believe are inaccurate or misleading.

Right to Consent to Disclosures: Generally, we will not disclose education records without your consent, except as permitted by FERPA.

Right to File a Complaint: You may file a complaint with:

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202

Transfer of Rights: FERPA rights transfer from parents to the student at age 18 or upon attending a postsecondary institution, whichever occurs first.

Directory Information

Certain information may be designated as “directory information” by your educational institution under FERPA. Directory information typically includes name, email address, and enrollment status that may be disclosed without consent unless you have opted out with your institution. We follow your institution’s directory information policies. To opt out, contact your educational institution directly.

Agreements With Educational Institutions

Our relationship with educational institutions is governed by separate written agreements that may provide additional privacy protections beyond this Privacy Policy. Where institutional agreements and this Privacy Policy differ, the institutional agreement controls with respect to that institution’s students and education records.

2. WHAT INFORMATION DO WE COLLECT?

Information You Provide Directly

Account Information: When you create an account, we collect your name, email address, institutional affiliation, and phone number.

Purchase Information: When you make a purchase, we collect your name, address, and payment information. Note: FlatWorld does not collect or store credit card information—our payment processors collect that directly.

Usage Information: When you use our Products, we collect user-generated content including notes and highlights in books, and information you share with others through the Products.

Assessment and Homework Data: When you participate in assessments, surveys, and homework-related Products, we collect grades, completion information, time spent, and other participation data. This data constitutes education records under FERPA when collected in an educational context. We collect only the minimum data necessary to provide the educational services requested by your institution.

Communications: When you contact us, we collect the information you provide in your communications, including through email and chat support.

Information We Collect Automatically

We automatically collect certain information when you visit, use, or navigate the Services, including:

- Log and Usage Data: IP address, browser type, device information, pages viewed, searches, date/time stamps, and other activity information
- Device Data: Hardware model, operating system, unique device identifiers, and system configuration
- Location Data: General location based on IP address (you can disable precise location tracking in your device settings)

Google API Our use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Information From Third Parties

We may receive information from:

Educational institutions (class rosters, enrollment information)
Instructors (performance and engagement data)
Public databases and marketing partners (for non-education record purposes only)

Important: We do not acquire student education records from third-party marketing services or public websites. Information received from educational institutions is used solely for educational purposes and in compliance with FERPA.

Cookies

We use cookies to store preferences and collect usage information. See Section 5 for details.

3. HOW DO WE PROCESS YOUR INFORMATION?

Use of Education Records

When we receive education records from educational institutions, we use them solely for legitimate educational purposes:

Providing the educational Products and services requested by the institution
Supporting teaching, learning, and assessment activities
Communicating with students and educators about educational content and progress
Improving the educational effectiveness of our Products
Maintaining the security and integrity of our platform

General Use of Information

We process your information to:

Facilitate account creation, authentication, and management
Deliver and improve our Services
Respond to inquiries and provide support
Send administrative information and service updates
Fulfill and manage orders and payments
Request feedback about our Services
Send marketing communications (with your consent; you may opt out at any time). Note: We do not send marketing communications to students accessing our services through educational institutions.
Protect our Services through fraud monitoring and prevention
Analyze usage trends and improve user experience
Comply with legal obligations

Analytics

We conduct analytics using our own tools and third-party services such as Google Analytics. For education records, we implement additional safeguards to ensure analytics providers cannot use student data for marketing or advertising purposes. To opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout.

4. WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION?

With Educational Institutions and Instructors

We may share any information we collect with academic institutions and their employees (including instructors), and we may permit instructors or institutions to integrate such data with their learning management systems. Information we may share includes whether you own a certain Product, information on your engagement with our Products (e.g., how long you spent using the Product and which parts you accessed), information regarding your engagement and performance on homework or assessments, personally identifiable information, and the like.

This sharing is conducted pursuant to FERPA’s “school official” exception, as we perform institutional services and functions on behalf of the educational institution. We share only information necessary for legitimate educational purposes as directed by the institution.

With Content Owners

We may share a variety of information with content owners (including the authors and those who have rights in the books, homework assignments, assessments and other content we offer through FlatWorld). FlatWorld may also share de-identified or aggregate data about you and your use of the Product with Content Owners. Content Owners will use this data for their own research and tracking purposes, to evaluate Product use and access, to improve Products and related analysis.

We share only de-identified or aggregated data with content owners that cannot be used to identify individual students. We do not share student education records with content owners without explicit consent from the student (or parent, if applicable) or a valid FERPA exception. Any de-identified data is processed to ensure it cannot be re-identified.

With Third-Party Service Providers

We use other companies, agents, contractors, and/or FlatWorld affiliates to perform services on our behalf or to assist us with providing the Products to you. For example, we may engage such service providers to provide marketing (including telemarketing, email and direct mail marketing), communications, website hosting infrastructure and IT services, personalize and optimize the Service, process credit card transactions, provide customer service, collect debts, and analyze and enhance data. In the course of providing such services to us, these other companies may have access to your information, or may share with us information they collect in the course of providing their services. We do not authorize these companies to use or disclose your personal information, except in connection with providing the services we request from them.

When service providers have access to education records, we require written agreements that:

Limit use to providing the specific services requested
Prohibit use for marketing or product development
Require FERPA-compliant security safeguards
Prohibit re-disclosure without authorization
Require destruction or return of records when services are completed

We maintain the right to audit service providers’ compliance.

For Marketing

We do not share student education records with third parties for marketing purposes. We may share de-identified, aggregated institutional-level data (not personally identifiable to students) with marketing partners to help educational institutions learn about our Products. Any such sharing is conducted in compliance with FERPA and does not include individual student information.

With Resellers and Platform Partners

When our content is available on third-party platforms, we do not transfer student education records to those platforms. We may disclose educator and institution names who have adopted Products, but this never includes student-level information.

We may disclose to third parties the names of educators and institutions who have adopted certain Products for use in their classes. This disclosure does not include any student-level information or education records.

For Legal and Safety Reasons

We reserve the right to disclose your information, including your personally identifiable information, when we have a good faith belief that access, use, preservation, or disclosure of such information

Comply with law, regulation, legal process, or governmental request
Enforce our terms of use, including investigation of potential violations of our terms of use
Detect, prevent, or address fraud, security, or technical issues
Protect against harm to our rights, property, or safety, or those of our employees, users, or the public

Disclosures of education records are made only as permitted by FERPA, including the health and safety emergency exception (34 CFR § 99.31(a)(10)) and the judicial order/subpoena exception (34 CFR § 99.31(a)(9)).

Business Transfers

We may share or transfer information in connection with any merger, sale of company assets, financing, or acquisition.

5. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies (web beacons, pixels) to gather information when you interact with our Services. These technologies help us maintain security, prevent crashes, save preferences, and assist with basic site functions.

We also permit third parties to use tracking technologies for analytics and advertising on our general marketing websites. Students accessing our educational products through institutions are not subject to advertising tracking. To the extent these constitute a “sale” or “sharing” under applicable US state laws, you can opt out as described in Section 10.

Google Analytics

We use Google Analytics to track and analyze Service usage. To opt out:

Visit https://tools.google.com/dlpage/gaoptout
Use Ads Settings for web or mobile
Visit http://optout.networkadvertising.org/

For more information, see Google’s Privacy & Terms page.

Do-Not-Track

California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

We keep personal information for as long as necessary to fulfill the purposes outlined in this notice, unless a longer retention period is required by law.

Education Records

We retain education records only as long as necessary to provide educational services or as required by law. Upon request from you or your educational institution, we will delete education records within 45 days, except where retention is required by legal obligations.

Aggregated and de-identified data that cannot be linked to individual students may be retained indefinitely for research and product improvement.

Account Information

We retain account information for as long as you have an active account. When we have no ongoing legitimate business need to process your information, we will delete or anonymize it.

7. HOW DO WE KEEP YOUR INFORMATION SAFE?

FlatWorld takes information security seriously and has taken various measures to keep your information secure from unauthorized access or disclosure, whether that information is stored physically or electronically. FlatWorld has established administrative, technical, physical, electronic and managerial procedures to help prevent unauthorized access, maintain data security and use the information collected from you in accordance with this Policy. FlatWorld has security measures in place to protect against loss, misuse, or alteration of your information. Despite these efforts, FlatWorld cannot guarantee that unauthorized access or disclosure of information will never happen. If you have concerns, do not use the Products.

Education Records Security

We implement heightened security measures for education records, including:

Encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent)
Role-based access controls limiting access to authorized personnel
Regular security audits and vulnerability assessments
Employee training on FERPA requirements and data privacy
Incident response procedures for data breaches

Breach Notification

In the event of a data breach affecting education records, we will notify affected educational institutions and, as required by law, affected individuals without unreasonable delay. We will provide information about the nature of the breach, types of information compromised, and steps being taken.

8. INFORMATION FROM MINORS

We do not knowingly collect data from or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18 or that you are the parent or guardian of a minor and consent to their use of the Services.

If we learn that we have collected personal information from users under 18, we will deactivate the account and take reasonable measures to delete such data. If you become aware of any data we may have collected from children under 18, please contact us at support@flatworld.com.

Note: Students under 18 may access our Services through educational institutions, in which case their information is protected as education records under FERPA.

9. YOUR PRIVACY RIGHTS

General Rights

Depending on your location, you may have rights to:

Request access to and obtain a copy of your personal information
Request rectification or erasure of your personal information
Restrict or object to processing of your personal information
Data portability
Not be subject to automated decision-making
Withdraw consent at any time

To exercise these rights, contact us at support@flatworld.com.

FERPA Rights

See Section 1 for your rights regarding education records under FERPA. For FERPA-specific requests, email ferpa@flatworld.com.

Account Management

You can review and change your account information in the “Account Settings” section. To delete your account, email privacy@flatworld.com.

Marketing Opt-Out

You can unsubscribe from marketing communications at any time by:

Clicking the unsubscribe link in our emails
Replying “STOP” to SMS messages
Emailing support@flatworld.com

We may still send you service-related messages necessary for account administration.

EU/UK/Switzerland Residents, this section applies to you

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. As such, we may rely on the following legal bases to process your personal information:

Consent. We may process your information if you have given us permission (i.e., consent) to use your personal information for a specific purpose. You can withdraw your consent at any time. Learn more about withdrawing your consent.
Performance of a Contract. We may process your personal information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
Legitimate Interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, we may process your personal information for some of the purposes described in order to:

Send users information about special offers and discounts on our products and services

Develop and display personalized and relevant advertising content for our users

Analyze how our Services are used so we can improve them to engage and retain users

Support our marketing activities

Diagnose problems and/or prevent fraudulent activities

Understand how our users use our products and services so we can improve user experience

Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

If you believe we are unlawfully processing your information, you may complain to your local data protection authority.

If you are located in Canada, this section applies to you.

We may process your information if you have given us specific permission (i.e., express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e., implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
For investigations and fraud detection and prevention
For business transactions provided certain conditions are met
If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
For identifying injured, ill, or deceased persons and communicating with next of kin
If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
If the collection is solely for journalistic, artistic, or literary purposes
If the information is publicly available and is specified by the regulations

10. US STATE-SPECIFIC PRIVACY RIGHTS

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, you may have additional rights under state privacy laws.

Categories of Personal Information Collected*

Category	Examples	Collected
Identifiers	Name, email, address, phone, IP address, account name	Yes
California Customer Records	Name, contact information, financial information, education information	Yes
Protected Classifications	Gender, age, date of birth, race, ethnicity	No
Commercial Information	Transaction history, purchase history, payment information	Yes
Biometric Information	Fingerprints, voiceprints	No
Internet Activity	Browsing history, search history, online behavior	No
Geolocation	Device location	Yes
Audio/Visual	Images, audio, video recordings	Yes
Professional Information	Job title, work history, business contact details	Yes
Education Information	Student records, directory information	Yes
Inferences	Profiles based on collected information	No
Sensitive Personal Information	Account login, payment card numbers	Yes

*Education information listed above refers to data collected directly from individuals, not from educational institutions. This information is not subject to FERPA but is protected under applicable state privacy laws.

Your State Privacy Rights

Right to know whether we are processing your personal data
Right to access your personal data
Right to correct inaccuracies
Right to request deletion
Right to obtain a copy of your data
Right to non-discrimination
Right to opt out of targeted advertising, sale of personal data, or profiling

How to Exercise Your Rights

Emailing support@flatworld.com
Calling 877.257.9243
Submitting a data subject access request
Visiting https://support.flatworldknowledge.com

We honor Global Privacy Control (GPC) opt-out signals.

Verification and Appeals

We will verify your identity before processing requests. If we decline your request, you may appeal by emailing support@flatworld.com. If your appeal is denied, you may submit a complaint to your state attorney general.

California “Shine The Light” Law

California residents may request information about personal information disclosed to third parties for direct marketing purposes. Submit requests in writing using the contact information below.

Disclosure Statement

We have not disclosed, sold, or shared any personal information to third parties for business or commercial purposes in the preceding twelve months. We will not sell or share personal information in the future.

11. INTERNATIONAL DATA TRANSFERS

By using our Services, you acknowledge and consent to the transfer of your information outside your country of residence to any country where we have facilities or engage third parties (including the United States). These countries may not have the same level of data protection as your country.

When we transfer education records internationally, we ensure that receiving parties maintain privacy protections equivalent to FERPA requirements. Educational institutions may restrict international transfers of their students’ education records through our service agreements.

12. UPDATES TO THIS NOTICE

We may update this privacy notice from time to time. The updated version will be indicated by the “Last updated” date at the top. If we make material changes, we may notify you by prominently posting a notice or by directly sending you a notification.

For material changes affecting the handling of education records, we will provide notice to educational institutions at least 30 days before the changes take effect and will obtain necessary consents as required by FERPA.

13. CONTACT US

General Inquiries:
Boston Academic Publishing Inc d.b.a FlatWorld
661 Boylston St
Boston, MA 02116
United States
Email: support@flatworld.com

FERPA-Related Inquiries:
Email: ferpa@flatworld.com
(Or include “FERPA Request” in the subject line)

To Review, Update, or Delete Your Data:
Email: privacy@flatworld.com
Or submit a data subject access request through our website.

This policy does not cover the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services before sharing personal information with them.