Privacy policy

Lecon holds an institution’s curriculum: its programs, courses, outcomes and the record of who approved what. Running that service means holding some personal data about the staff who use it. This page says what we hold, why, who sees it and how long it stays.

Who is responsible for what

For the people who work in it, your institution decides what goes into Lecon and why. It is the controller of that data; we are its processor, acting on its instructions under our agreement with it. If you have an account and want to see, correct or remove something, ask your institution first — they can do most of it themselves, and we help them with the rest.

For our own website — the pages at lecon.app and anyone who writes to us — we are the controller. That part is ours to answer for, and the company behind it is LECON EDUCATION TECHNOLOGY INC., 5307 Victoria Drive #877, Vancouver, BC V5P 3V6, Canada.

What we hold

People who use Lecon

• Account details: name, work email, job title, telephone number if given, profile picture if uploaded, role, and the approval levels the person holds.
• What they did: the activity log records submissions, approvals, send-backs, edits, comments and corrections, with the person and the time. This is the audit trail an accreditor asks for, so it is not editable and it is kept for as long as the record it belongs to.
• Sign-in: a session cookie in the browser, with the session itself stored as a hash so the cookie cannot be reconstructed from our database, alongside the browser’s user agent. Passwords are stored only as Argon2id hashes; we never see them.
• Documents and files uploaded to a course or program, such as outlines, syllabi and committee papers.
• Email we send on the institution’s behalf — approval notices, invitations, reminders — recorded in an outbox so the institution can see what went out.

From the systems you connect

• Your learning management system: when an instructor opens Lecon from inside a course, the LMS tells us who they are — name, email and the platform’s own identifier — so their work is attributed.
• Single sign-on: the assertion from your identity provider carries the person’s email address, and optionally their employee identifier, name, department and affiliation.
• Your student information system: this runs the other way. Only approved curriculum is sent, with the dates it applies; drafts, comments and people’s names never leave Lecon in those files.

Assessment evidence, and the one place it can name a student

When faculty assess program outcomes against a rubric in your LMS, what comes back to Lecon is a count of students and how many fell at each level of the rubric, per criterion. There are no names, no student identifiers and no individual results. Attainment reports are built from those counts.

Evidence your institution records by hand — a panel's portfolio review, a licensure exam — may list the students who were judged. The name and student identifier on each row are optional, and are there so a judgement can be traced back later; the counts the reports use are worked out from the rows either way. A name never appears in a report, is shown only to the people who may already open student work, and leaves with the rest of your record when you export or close the account.

People who ask us for a demonstration

The form on our website asks for a name, position, institution, email address, telephone number and whatever message is written. We use it to reply, and to set the institution up if it becomes a customer.

Cookies

Lecon sets a session cookie when you sign in, and short-lived cookies during a single-sign-on handshake that are deleted as soon as it finishes. All of them are necessary for the service to work. The menu also remembers whether you had it collapsed, in your own browser’s storage, which never reaches us.

There are no advertising cookies and no analytics cookies, anywhere.

Our public pages — this one, the front page, pricing, the FAQ and the documentation — carry a chat widget provided by Tidio, so that someone considering Lecon can ask a question. It sets its own cookies in order to keep a conversation going across pages, and what you type in it reaches Tidio as well as us. It is not loaded inside an institution: the pages where staff work on their own curriculum carry no third-party script at all.

Who else sees it

We do not sell personal data, and we do not share it except with the suppliers who help us run the service:

• the hosting provider that runs our servers in Canada;
• an email provider, to deliver notices and invitations;
• object storage, where an institution’s uploaded files are kept, when it is configured that way;
• the chat provider on our public pages, for the conversations started there;
• and anyone the law obliges us to tell, which we will say so where we are allowed to.

Each of them is bound to use the data only to provide their service to us. The current list of suppliers, and where they operate, is available on request at info@lecon.app.

How long we keep it

• While you are a customer: the curriculum record and its activity log are kept, because the point of them is to show what was approved and when, years later.
• When a subscription ends: we keep the data for 30 days so the institution can take an archive, then delete it.
• Backups: database backups are taken regularly, kept on a rolling basis and aged out; data deleted from the service disappears from backups as those rotate.
• Demonstration requests: kept while we are in touch, and no more than two years after the last contact unless the institution becomes a customer.

How it is protected

• Everything travels over TLS; the service is served over HTTPS.
• Passwords are hashed with Argon2id; session tokens are stored as hashes, never in the clear.
• Each institution lives at its own address and every query is scoped to it, so one institution cannot read another’s records even by guessing an identifier.
• What each role may do is set by the institution, and the audit trail records who did what.
• A backup of the database is taken before every deployment.

Your rights

Depending on where you live, you may have the right to ask for a copy of your personal data, to have it corrected or deleted, to object to how it is used, or to complain to a data protection authority. If you have a Lecon account, start with your institution: it decides what is held about you there. For anything that is ours — a demonstration request, an email to us — write to info@lecon.app and we will answer within 30 days.

Institutions in Canada, the European Union, the United Kingdom and elsewhere have their own rules about student and staff records — FIPPA, PIPEDA, FERPA, the GDPR and others. We will sign the data processing terms your institution needs; ask us.

Where the data lives

Lecon is a Canadian company, and the service runs on servers in Canada, in our hosting provider’s data centre in Quebec. Institutions’ records — the database, uploaded files and their backups — are stored there and are not copied outside Canada. Your browser connects to those servers directly: no content network in another country decrypts or caches the traffic on the way. Where a supplier on the list above operates outside Canada, such as an email provider delivering a notice, the transfer is covered by the protections the law requires, and we will tell you which on request.

Children

Lecon is a tool for staff at a college or university. It is not meant for children, and we do not knowingly collect data about them.

Changes

If this policy changes in a way that matters, we will tell institution admins by email before it takes effect. The date at the top says when the current wording took effect.

Getting in touch

info@lecon.app. The terms of service cover the rest of the arrangement.