LilyPD Beta
Get Started
Learn Teach Connect
Get Started

lilyPD Privacy Policy

Effective Date: March 24th, 2026

William & Mary — Strategic Cultural Partnerships 

1. Introduction

This Privacy Policy explains how William & Mary (“William & Mary,” “we,” “us,” or “our”), through its division of Strategic Cultural Partnerships, collects, uses, protects, and shares information about you when you use the lilyPD platform at https://lilypd.wm.edu/.

We are committed to protecting your privacy and handling your personal information responsibly, in accordance with applicable law and William & Mary’s institutional data policies. Please read this policy carefully before registering for or using the platform.

By creating an account and using lilyPD, you confirm that you have read and understood this Privacy Policy and consent to the collection and use of your information as described here.

2. Who We Are

lilyPD is an educational platform owned and operated by William & Mary, a public university chartered by the Commonwealth of Virginia, through its division of Strategic Cultural Partnerships.

For the purposes of data protection law, William & Mary is the data controller responsible for your personal information collected through lilyPD.

Contact details: lilyPD — Strategic Cultural Partnerships, William & Mary P.O. Box 8795, Williamsburg, VA 23187-8795 Email: lilypd@wm.edu Website: https://lilypd.wm.edu/

3. Information We Collect

When you register for a lilyPD account, we collect the following personal information:

  • First name and last name
  • Email address
  • Password (stored in encrypted form — we do not have access to your plain-text password)
  • Teaching level
  • Country, state, and zip code

Where you complete a microcourse that includes a Narrative Assessment, we also collect and process the work you submit for assessment purposes. This includes your written responses, reflections, or other submitted materials, which are processed by our AI-based Narrative Assessment tool to generate an accreditation outcome. The assessment output — including your result and any evaluative feedback generated — is retained as part of your course record.

When you enroll in a paid microcourse, payment is processed securely through Authorize.net. We do not collect or store your credit or debit card details on our servers. Payment card information is transmitted directly to and handled by Authorize.net in accordance with Payment Card Industry Data Security Standards (PCI DSS).

When you use the lilyPD platform, we also collect certain non-personal information automatically, including:

  • Log data (such as your IP address, browser type, and pages visited)
  • Cookie data and usage analytics collected through Google Analytics (see Section 6)

We do not knowingly collect personal information from anyone under the age of 18. If you believe a minor has registered for an account, please contact us at lilypd@wm.edu.

4. How We Use Your Information

We use the information we collect to:

  • Create and manage your lilyPD account
  • Provide access to microcourses and resources
  • Process payments for paid microcourses through Authorize.net
  • Send administrative communications relating to your account, enrollment, or access
  • Send marketing and promotional emails about new courses, resources, and platform updates, where you have opted in to receive these (see Section 7)
  • Assess submitted assignments and course completion for the purposes of issuing certificates
  • Assess your submitted work using our AI-based Narrative Assessment tool and determine accreditation outcomes upon completion of eligible microcourses
  • Improve the platform, its content, and the quality of our courses
  • Ensure the security and integrity of the platform
  • Comply with our legal obligations as a public university 

We collect and use your personal information only as necessary to fulfill these purposes. In accordance with William & Mary’s Data Classification and Protection Policy, your registration data is treated as sensitive personally identifiable information and handled accordingly.

5. Legal Bases for Processing Your Information

Depending on where you are located, different legal frameworks govern how we process your personal information.

5a. For users in the United States

We collect and use your information on the following bases:

  • To perform our contract with you — that is, to provide you with access to the lilyPD platform and its courses and resources
  • To comply with our legal obligations as a public university under Virginia law
  • Where you have given your consent, such as opting in to marketing emails

5b. For users in the European Union or United Kingdom (GDPR)

If you are located in the EU or UK, we process your personal information under the General Data Protection Regulation (GDPR) or UK GDPR. Our legal bases for processing are:

  • Contract: Processing is necessary to provide you with access to lilyPD and its services, including the assessment of your work for accreditation purposes where this forms part of the course you have enrolled in
  • Legitimate interests: We process certain data (such as usage analytics) to improve and secure the platform, where this does not override your rights and interests
  • Consent: Where we rely on consent — such as for marketing emails or optional analytics cookies — you may withdraw your consent at any time without affecting the lawfulness of prior processing
  • Legal obligation: We may process data where required to comply with applicable law

5c. For users in California (CCPA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA). Please see Section 11 for details of your rights and how to exercise them.

5d. FERPA

William & Mary is subject to the Family Educational Rights and Privacy Act (FERPA). Information for students William & Mary’s FERPA policies and practices are available here: FERPA Policy | University Registrar | William & Mary. 

Users should be mindful that lilyPD is intended for use by adult education professionals. Where users reference identifiable student information in discussion boards or submitted assignments — for example, when describing a specific student’s learning needs or circumstances — they do so as data controllers in their own right and are responsible for ensuring their use of student information complies with applicable law, including FERPA. Users should avoid sharing personally identifiable student information on the platform wherever possible.

6. Cookies and Analytics

6a. What are cookies?

Cookies are small files stored in your browser when you visit a website. They help the website remember information about your visit.

6b. Cookies we use

We use three types of cookies on the lilyPD platform:

Essential cookies — These are necessary for the platform to function and cannot be disabled. They include cookies that manage your login session, maintain your preferences while using the platform, and ensure the security of your account. You cannot opt out of essential cookies without affecting your ability to use the platform.

Analytics cookies — We use Google Analytics to understand how users interact with the lilyPD platform, including which pages are visited, how long users spend on the platform, and how they navigate between sections. This information is collected in aggregate and used solely to improve the platform. Google Analytics may set cookies in your browser and transfer data to Google’s servers. For more information on how Google uses this data, please visit policies.google.com/privacy. These cookies are optional and will only be set with your consent.

Marketing cookies — We may use marketing cookies to understand the effectiveness of our communications and to share information about lilyPD with you across other platforms. [PLACEHOLDER] These cookies are optional and will only be set with your consent.

6c. Managing your cookie preferences

When you first visit the lilyPD platform, you will be asked to set your cookie preferences through our cookie consent banner. You may choose to accept all cookies, accept essential cookies only, or customize your preferences to enable or disable analytics and marketing cookies separately.

You can update your cookie preferences at any time by [PLACEHOLDER].

You may also manage or disable cookies at any time through your browser settings, though please note that disabling essential cookies will affect your ability to use the platform. To opt out of Google Analytics tracking across all websites, you can install the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout.

7. Marketing Emails and Communication Preferences

Where you have opted in to receive marketing communications from lilyPD, we may send you emails about new microcourses, resources, platform updates, and other educational content we think may be of interest to you.

You may opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email, or by contacting us at lilypd@wm.edu. Please note that opting out of marketing emails will not affect administrative communications relating to your account or enrollment, which are necessary for the operation of the platform and cannot be opted out of while your account remains active.

8. How We Share Your Information

William & Mary does not sell, rent, or share your personal information with third parties for their own marketing or commercial purposes.

We may share your information in the following limited circumstances:

  • Payment processing: Your payment details are processed by Authorize.net. We share only the information necessary to complete your transaction. Authorize.net maintains its own privacy and security safeguards; we encourage you to review their privacy policy at authorize.net.
  • Analytics: Usage data is shared with Google Analytics as described in Section 6. Google maintains its own privacy policy governing this data.
  • Service providers: We may share information with third-party service providers who assist us in operating the platform, provided they are contractually required to handle your data securely and only for the purposes we specify.
  • Protection of rights: We may disclose information where necessary to protect the rights, property, or safety of William & Mary, its users, or others, or where required to do so by law.

9. AI-Based Narrative Assessment

9a. How it works

Some microcourses on the lilyPD platform include a Narrative Assessment — an AI-powered tool that evaluates your submitted work and determines whether you meet the requirements for course accreditation. The assessment is conducted by processing your written submissions against established evaluative criteria developed by William & Mary’s course content team.

Where a course carries accreditation from the William & Mary School of Education, the Narrative Assessment is the mechanism by which that accreditation outcome is determined.

9b. What this means for you

By enrolling in a microcourse that includes a Narrative Assessment, you acknowledge and agree that:

  • Your submitted work will be processed by an AI-based assessment tool for the purposes of determining your accreditation outcome;
  • The assessment outcome — including the award of professional development hours accredited by the William & Mary School of Education — is generated automatically based on your submission and the evaluative criteria for that course. The number of professional development hours associated with each course is specified on the relevant course page;
  • Your submitted work and assessment outcome will be retained as part of your course record in accordance with Section 12 (Data Retention) of this policy.

9c. Your right to request human review

William & Mary recognizes that automated assessment may not capture every aspect of your work or professional context. If you believe your accreditation outcome does not accurately reflect your submitted work, you have the right to request a human review of your assessment. To do so, please contact us at lilypd@wm.edu within 28 days of receiving your outcome, providing your name, the course in question, and the grounds for your request. We will arrange for a qualified member of the William & Mary team to review your submission and outcome and will respond within 15 working days.

William & Mary reserves the right to uphold, amend, or overturn an automated assessment outcome following human review.

9d. Data used in assessment

The Narrative Assessment tool processes only the work you submit as part of the relevant microcourse. It does not access or use any other personal information held in your account, such as your location or teaching level, in generating an assessment outcome.

9e. Improvements to the assessment tool

William & Mary may use anonymized or aggregated assessment data to evaluate and improve the performance and accuracy of the Narrative Assessment tool over time.

10. Data Security

William & Mary takes the security of your personal information seriously. In accordance with its Data Classification and Protection Policy, your registration data is classified as sensitive personally identifiable information and is subject to appropriate technical and organizational safeguards, including:

  • Encrypted storage of passwords
  • Secure transmission of data using encryption technology
  • Access controls limiting who within William & Mary can access your information
  • Use of PCI DSS-compliant payment processing through Authorize.net

While we take all reasonable steps to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, and we encourage you to use a strong, unique password for your lilyPD account.

If you believe your account has been compromised, please contact us immediately at lilypd@wm.edu.

11. Your Rights

11a. All users

Regardless of where you are located, you have the right to:

  • Access the personal information we hold about you
  • Correct inaccurate or incomplete information
  • Close your account and request deletion of your personal data, subject to any legal obligations we have to retain certain information
  • Contact us with any concerns about how we handle your information

11b. EU and UK users (GDPR)

If you are located in the EU or UK, you have the following additional rights under the GDPR or UK GDPR:

  • Right to erasure — to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected
  • Right to restriction — to request that we limit the processing of your data in certain circumstances
  • Right to data portability — to receive your personal data in a structured, commonly used format
  • Right to object — to object to processing based on legitimate interests, including profiling
  • Right to withdraw consent — where processing is based on consent, to withdraw it at any time
  • Right to lodge a complaint — with your local data protection authority. In the EU, a list of national authorities is available at edpb.europa.eu. In the UK, the relevant authority is the Information Commissioner’s Office (ico.org.uk).

11c. California users (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

  • The right to know what personal information we collect, use, share, or sell
  • The right to request deletion of your personal information
  • The right to opt out of the sale of your personal information — please note that William & Mary does not sell your personal information
  • The right not to be discriminated against for exercising your CCPA rights

To exercise any of your CCPA rights, please contact us at lilypd@wm.edu. We will respond to verifiable requests within 45 days as required by law.

12. Data Retention

We retain your personal information for as long as your account is active or as necessary to provide you with access to the platform and its courses and resources.

If you close your account, we will delete or anonymize your personal information within a reasonable period, except where we are required to retain it for legal, regulatory, or institutional purposes. As a public university, William & Mary is subject to Commonwealth of Virginia records retention requirements, which may require us to retain certain information for a specified period after your account is closed.

[PLACEHOLDER] 

14. Third-Party Links

The lilyPD platform may contain links to third-party websites or resources. These links are provided for convenience only and do not constitute an endorsement by William & Mary. We are not responsible for the privacy practices or content of third-party websites and encourage you to read their privacy policies before providing any personal information.

15. Changes to This Privacy Policy

William & Mary reserves the right to update this Privacy Policy at any time. Revised versions will be posted with an updated effective date. For material changes, we will make reasonable efforts to notify registered users by email. Continued use of the platform following notification of changes constitutes acceptance of the revised policy.

16. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal information, please contact us:

lilyPD — William & Mary P.O. Box 8795, Williamsburg, VA 23187-8795

Email: lilypd@wm.edu Website:https://lilypd.wm.edu/

EU and UK users who are not satisfied with our response have the right to lodge a complaint with their local data protection authority.