Faces to Names — Privacy Policy

Last updated: October 7, 2026

A plain-language policy for educators, students, families, and other users.

Faces to Names ("FTN", "we", "us") is a Canadian registered charity. Students use FTN to research a person whose name is inscribed on a war memorial, and to record what they find.

This policy explains what personal information we collect, why, who else handles it, how long we keep it, and what you can ask us to do with it.

1. Who is accountable

Our Privacy Officer is responsible for how FTN handles personal information, including information handled by the service providers we use.

Privacy Officer, Faces to Names

2. Whose rules apply, and when

FTN's role changes depending on how you came to use it.

When a school board or school adopts FTN, student personal information is handled under that board's authority and its provincial access and privacy legislation — in Ontario the Municipal Freedom of Information and Protection of Privacy Act, in British Columbia the Freedom of Information and Protection of Privacy Act, in Alberta the Freedom of Information and Protection of Privacy Act, and in Quebec the Act respecting Access to documents held by public bodies. In that relationship the board decides what is collected and for what purpose. We act as its service provider and follow its instructions. Where a board directs the purposes for which student personal information is handled, those directions govern that handling.

When you deal with us directly — a teacher who signs up, a member of the public reading the remembrance archive, anyone who emails us — we handle your information under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), and under provincial private-sector law where it applies: Quebec's Act respecting the protection of personal information in the private sector as amended by Law 25, and the Personal Information Protection Act in British Columbia and Alberta.

3. What we collect

3.1 From teachers

A name, a display name and an email address for the account. For each class you create: the class name, the two-letter school initials used to build invitation codes, and an optional project deadline. Any documents you add to a class library, and anything you send us in a message.

3.2 From students

A student creates their own account using an invitation code from their teacher. That account holds a display name and an email address, handled by our authentication provider.

For participating school boards, Microsoft Entra ID may also provide the identity, tenant, and group or role claims needed for school-managed single sign-on.

We also hold the student's worksheet answers, which include research notes, writing, citations and the student's own reflections; uploaded files and photos submitted as research evidence; and the memorial name assigned to the project.

3.3 Entered by teachers when inviting students

A display name so the teacher can identify the student in their own roster, the class, and the memorial name reserved for that invitation. The invitation carries a single-use code and expires.

We do not ask teachers for student email addresses or phone numbers in order to create an invitation. We ask for as little about a student as the platform can work with, and we ask students not to write personal information about themselves or others into their research.

3.4 Collected automatically

IP address, browser and device type, operating system, pages visited and time spent, general geographic region, and similar technical information. We use PostHog for this.

3.5 Entered into the research map

The platform includes a map so a student can locate where the person they are researching was born, lived or served. The map's search text, which may come from worksheet fields, and map coordinates are sent to our mapping provider, Esri, which returns candidate locations and the map imagery itself. Because the map runs in the browser, Esri also receives the user's IP address. It does not receive other worksheet answers, uploaded files, or the student's name. Unlike the research sites in section 14, the map is not routed through our own servers.

4. Why we collect it

To run the platform: to sign people in, to connect a student to their teacher's class and assignment, to save research as it is written, and to show a map of the places connected to the person being researched.

To improve the platform: to understand how it is used, to diagnose faults, and to develop new features and teaching tools.

To build the remembrance archive: approved contributions may become part of a public record of research and tributes. Research is not made public solely because a student submits it — it is published only through the applicable educator and FTN review process, and it is published without a student's name. We do not currently offer public student attribution, badges, leaderboards or any other feature that identifies a student publicly. Section 5 of our Terms of Use explains what would have to be true before we did. Non-identifying historical facts supported by source evidence and reviewed by an educator may remain after a student's writing is removed, subject to the participating organisation's agreement.

The Terms of Use explain permission to use original contributions, including drafts, for educational, historical, remembrance, and fundraising purposes, including authorised partner reuse. Public sharing and external reuse require the applicable review and permission checks.

To protect people: to enforce our Terms of Use, to meet legal obligations, and to prevent fraud, misuse and security incidents.

We do not use personal information for advertising, and we do not sell or rent it.

Classroom information and unpublished student work are available only to authorised users and are used to operate the classroom project.

5. Consent

FTN operates on a teacher-managed consent model, which is the usual arrangement in Canadian education. A teacher confirms they have authority under their board's privacy rules to use FTN with their class. We do not knowingly collect personal information directly from a child without that authority in place.

We record acknowledgements and consent choices. Each acceptance is stored as its own dated record naming the exact version of the document accepted, and records are added rather than edited, so the history stays intact. When a document changes, we ask you to accept it again. Everyone who creates an account records their acceptance of our Terms of Use and of this Privacy Policy, and an agreement not to upload personal information about living individuals or copyrighted material without permission. A teacher also records that their use of FTN complies with their board's digital-tool and privacy rules, and that they will review and verify student submissions. Before a student first submits a project, they acknowledge a notice that submitted work is checked by the automated research assistant described in section 6, and we record that acknowledgement in the same way.

The participating organisation administers required participation notices and authorisations. Permission to publish a student's name is separate from permission to use their writing.

A teacher or board may withdraw from FTN at any time. A student, parent or guardian acting with appropriate authority may ask the teacher, the board, or FTN to withdraw participation or remove the student's writing, identifying information, or both. We coordinate requests with the board where it controls the information. Contact to reach us directly.

Withdrawing consent may mean a student can no longer use the platform. Section 9 explains what happens to work that has already been published to the archive.

6. Automated processing and artificial intelligence

When a student submits a project, an automated research assistant checks historical claims against available authoritative sources and writes an evidence report for the teacher. Claims without sufficient evidence remain unverified.

What it sees. The system that coordinates a review never receives the worksheet — only counts of answers and the sections they fall in. The components that do the checking receive the answers in small batches, including a student's own reflections and notes. Uploaded documents are converted to text so they can be read. Searches are run to find candidate records.

Which providers are involved. Model processing runs on OpenAI, reached through Vercel AI Gateway. Document text extraction uses Mistral AI. Record searches use Tavily, which receives search terms about the historical person and returns page titles and links, not worksheet content or files. Our Subprocessor List names each of these and where they operate.

Authority for this checking. Where a school board has adopted FTN, this checking happens under the board's authority, as section 2 explains, and the teacher confirms that authority when they create their account. The board decides what notices or consents its students and families need, and administers them under its own rules. We show each student a notice about the check before their first submission and record their acknowledgement, as section 5 explains. We do not treat that acknowledgement, or a student's acceptance of this policy, as the authority for the check.

A person always decides. The report goes to the teacher, who reviews supporting evidence and unresolved findings before approving work. No decision about a student, their work or their marks is made only by automated processing. The system is built to report a conflict it can quote and to stay silent when it is unsure, because a false accusation against a student is a worse failure than a missed error.

Training and service improvement. FTN does not use student work to train a model of its own. AI providers handle submitted content under the product terms, data-processing agreements, and account settings that apply to FTN's use of their services. Participating organisations may contact our Privacy Officer for current information about provider retention and model-training settings before enabling automated review for their students.

7. Service providers

We use other companies to run FTN — to host it, store files, send email, extract text from documents, display maps, search historical locations and measure usage. They may handle personal information only to provide their service to us, under written agreements, and not for their own purposes.

Our Subprocessor List names every one of them and what they do. We publish the name of a new provider at least 30 days before it begins handling data, and we email the designated contact at each participating school board when the list changes. Section 8 covers where these providers operate.

We may provide funders and programme evaluators with aggregated or non-identifying statistics where the applicable agreement permits it. We do not provide them with student-identifying information for their own purposes.

8. Where information is processed

FTN is a Canadian organization, but our providers operate outside Canada — in the United States, and in the European Union for document text extraction. Mapping services use global cloud infrastructure, including the United States. This means personal information is stored and processed outside Canada, and while it is there it may be accessible to the courts, law enforcement and national security authorities of those countries under their laws.

Our providers handle this information under written agreements that limit them to providing their service to us. Information is encrypted in transit. Our Subprocessor List states the location for each provider. We follow any additional location requirements agreed with a participating school board.

9. How long we keep it, and how deletion works

We delete on request, not on a timer. We do not run an automatic clean-up that erases accounts, classes or student work after a set period. Information stays until someone asks us to remove it. That is a deliberate choice for a platform where a project can sit unfinished across a school year, but it means the request matters: if you want something gone, tell us.

Who can ask. A teacher or a school board can ask us to delete a class, a student's account, or a student's project and worksheet. A student or parent can ask too, though where a board holds the information under its own authority we will work through the board, as section 10 explains.

What happens when we delete a project. We remove the worksheet, the automated check and its report, and the teacher's feedback. Uploaded research files are removed separately, so tell us if you want those gone as well. Copies inside our providers' routine backups are not picked out individually; they age out with the backup they sit in. We do not restore deleted work from a backup.

One thing to know. Removing a student from a class ends their membership in that class. It does not by itself delete their project or worksheet. If you want the work removed as well, ask for that specifically.

How to ask, and how long we take. Write to the Privacy Officer at . We will acknowledge within 5 business days and finish within 30 days, or tell you why we need longer.

Removing student writing, including published work. You, a parent or guardian acting with appropriate authority, or the participating organisation may request removal of your original work, identifying information, or both. This applies to drafts and published work, even if the writing contains no personal information. We verify the request, coordinate with the organisation where it controls the information, and remove the requested work from publication and further reuse and delete the relevant copies. We also instruct our service providers and authorised partners to remove affected copies.

We may retain historical facts supported by identified source evidence and reviewed by an educator, and their source references, where the participating organisation's agreement permits it. We may also retain independently written FTN accounts based on those facts. Retained material must not identify the student or reproduce protected expression from the removed work. Material that cannot meet these conditions must be removed. Third-party source rights still apply.

If you ask to remove only your public attribution, your writing may remain under its applicable permission. Account closure and organisational withdrawal follow the agreed retention and deletion process, including for published student work.

We explain the applicable deletion and backup-expiry periods when handling a request. Copies retained because the law requires it, and backups awaiting secure expiry, are restricted to those purposes. Copies independently obtained by members of the public may be outside our control.

10. Your rights

Depending on which law applies to you, you may ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, delete it, tell you how it has been used and who it has been shared with, or stop relying on your consent.

Write to the Privacy Officer at . We will respond within 30 days, or tell you why we need longer. We may need to confirm who you are before we act.

Requests to remove original writing are also covered by section 9 and the Terms of Use.

If a school board holds the information under its own authority, we will direct you to the board, because it decides. We will tell you when that is the case rather than leaving you to work it out.

11. Keeping information accurate

We keep personal information accurate and current as far as it is used to make decisions about a person. A teacher can correct class and roster details. Anyone can ask us to correct their own information under section 10.

12. Safeguards, and what happens after a breach

We protect personal information with encrypted connections, access controls limited to the people who need them, hosting on established infrastructure providers, system monitoring and content moderation. No system is completely secure, and we do not claim otherwise.

If a breach creates a real risk of significant harm, we will notify the affected people and the appropriate privacy commissioner as the law requires, and we will notify the school board where student information is involved. We keep records of breaches whether or not they are reportable.

13. Cookies

We use cookies to keep you signed in, to measure usage, and to detect misuse. You can block cookies in your browser, but signing in will not work without them.

14. Links to research sites

FTN links to and displays public historical archives, including the Canadian Virtual War Memorial, the Commonwealth War Graves Commission and Library and Archives Canada. We route these requests through our own servers, so those sites receive our server's address rather than the student's.

The research map is the exception. It loads directly in the browser from our mapping provider, Esri, which therefore sees the user's IP address and the map search text. Section 3.5 covers what Esri receives.

We are not responsible for the privacy practices of any of these sites.

15. Raising a concern

Write to the Privacy Officer at . We will acknowledge your concern and tell you how we intend to deal with it.

If you are not satisfied, you can complain to the privacy regulator for your situation: the Office of the Privacy Commissioner of Canada, the Information and Privacy Commissioner of Ontario, the Commission d'accès à l'information du Québec, or the Office of the Information and Privacy Commissioner in British Columbia or Alberta. If a school board holds the information, its own complaint process applies first.

16. Changes

We may update this policy. If a change materially affects how we handle personal information, we will post a notice on the platform and email participating school boards before it takes effect. The last-updated date is at the top of this page. Revised contribution terms do not expand permission for earlier work without valid permission covering the additional uses.

Appendix — where each PIPEDA principle is addressed

Principle	Section
1. Accountability	1, 7
2. Identifying purposes	4
3. Consent	5
4. Limiting collection	3
5. Limiting use, disclosure, and retention	4, 7, 9
6. Accuracy	11
7. Safeguards	12
8. Openness	7, 8, and the Subprocessor List
9. Individual access	10
10. Challenging compliance	15