By business type

Refund Policy Generator for edtech

Written for student data, children’s privacy, school contracts and age-appropriate design.

Generate your refund policy Read the refund policy guide

Education refunds split cleanly into two regimes that a single policy usually confuses: institutional contracts negotiated per seat and per term, and consumer purchases of courses where statutory cancellation rights apply in full.

Education technology processes data about children, which changes almost every default. COPPA applies to under-13s in the US, the UK Age Appropriate Design Code applies to services likely to be accessed by under-18s, several EU member states set the digital age of consent at 16, and India’s DPDP Act treats everyone under 18 as a child.

The school relationship adds a second complication. When a school buys your product, the school is usually the controller and you are the processor - which means consent for your processing comes from the school on the pupils’ behalf, and your ability to use the data for product improvement or marketing is sharply limited.

FERPA in the US layers on top for education records held by institutions receiving federal funding, and the school official exception that vendors rely on comes with conditions about direct control and limited use.

What a refund policy for an education or edtech business has to cover

Institutional licences: term, mid-term cancellation and any pro-rata position
Consumer course purchases and the fourteen-day cancellation right
The digital-content waiver, and the express acknowledgement needed to rely on it
Access after refund: whether downloaded or cached material must be destroyed
Refunds where a course is withdrawn or materially changed after purchase

How an education or edtech business actually moves personal data

Pupil accounts and rosters

Names, year groups, class assignments and sometimes identifiers issued by the school, usually synced from a school information system.

Learning and assessment data

Progress, scores and behavioural analytics, which can constitute profiling of children.

Parent and guardian records

Contact details and consent records, held under a different relationship from the pupil data.

Teacher and staff accounts

Employment-adjacent processing with the school as employer.

Product analytics inside a children’s service

Ordinary telemetry becomes a design-code question when the user is a child.

Safeguarding disclosures

Where the product surfaces a welfare concern, the disclosure route and its basis need defining in advance.

Third parties the draft will ask you about

Google Workspace for Education or Microsoft 365 Education · AWS or Azure · Wonde or Clever for roster sync · Stripe · Zendesk · Sentry

The rules that apply

COPPA

Verifiable parental consent before collecting personal information from under-13s, with restrictions on behavioural advertising and disclosure.

Age Appropriate Design Code

Fifteen standards including data minimisation, high-privacy defaults, no nudge techniques and detrimental use restrictions, for services likely to be accessed by children.

FERPA and the school official exception

Education records may be shared with vendors performing an institutional service, under the institution’s direct control and for limited purposes.

School as controller

For most classroom deployments the institution determines purposes and means, making the vendor a processor with instruction-limited rights.

Digital age of consent variation

From 13 to 16 across the EU, 13 under COPPA, and 18 in India - which makes a single global age gate impossible.

What the generated refund policy contains

The statutory right, stated separately
Consumer cancellation rights exist whatever your policy says, so they are set out first and your goodwill terms second.
Time limits and how they are counted
When the clock starts, whether it runs in calendar or working days, and what stops it.
Condition and evidence requirements
What state goods must come back in, and what proof of purchase you accept.
Who pays return postage
Split between faulty and change-of-mind returns, because the law treats them differently.
Refund method and timing
Original payment method, and the deadline you commit to once goods or notice are received.
Exclusions, stated lawfully
Perishables, personalised goods, unsealed hygiene items and downloaded digital content - the exclusions the law actually permits.

Edtech compliance essentials

Decide your role per deployment
School-purchased is usually processor; direct-to-consumer is controller. The documents differ completely.
Complete a DPIA before launch
Children’s data at scale requires one in the UK and EU.
Build a market-aware age gate
With verifiable parental consent flows for the thresholds that apply.
Turn off behavioural advertising entirely
It is the simplest defensible position for a children’s product.
Set high-privacy defaults
The design code requires them, and defaults are what regulators test first.
Document deletion at contract end
With a defined window and evidence you can produce.

Where this usually goes wrong

Using pupil data for product improvement without instruction

As a processor you act on the school’s instructions. Product analytics on pupil data needs to be authorised, not assumed.

Behavioural advertising in a children’s service

Prohibited or heavily restricted under COPPA, the design code and India’s DPDP Act.

One global age gate

The threshold varies from 13 to 18 by market, so a single number is wrong somewhere.

Nudge techniques and engagement mechanics

The design code specifically targets techniques that encourage children to weaken their privacy settings or stay engaged longer.

No data protection impact assessment

Processing children’s data at scale is on every regulator’s mandatory DPIA list.

Retaining pupil records after a contract ends

Article 28 requires deletion or return, and school contracts usually specify a window.

Frequently asked questions

Is my edtech company a controller or a processor?

For school deployments, usually a processor acting on the institution’s instructions. For direct-to-consumer products, a controller. Many companies are both, and the documents have to distinguish them.

What age counts as a child?

It varies: 13 under COPPA, 13 to 16 across EU member states, 16 in Ireland, and 18 under India’s DPDP Act and for parts of the UK design code. A single global threshold will be wrong in some markets.

Can I show ads in a children’s education product?

Behavioural advertising is restricted or prohibited under COPPA, the Age Appropriate Design Code and the DPDP Act. The defensible position is not to run it at all.

Do I need a DPIA?

For processing children’s data at scale, yes - it appears on the mandatory list published by UK and EU regulators.

Can I run a no-refunds policy?

Not against statutory rights. In the UK and EU a consumer’s cancellation and faulty-goods rights apply regardless of what your policy says, and advertising "no refunds" is itself treated as a misleading practice.

Do digital products have to be refundable?

The cancellation right can be waived for digital content, but only if the customer gave express consent to immediate delivery and acknowledged losing the right. That acknowledgement has to be captured at checkout, not assumed.

How long do I have to issue a refund?

In the UK and EU, within 14 days of receiving the goods back or of the customer proving they returned them. Card scheme rules and marketplace policies often impose something tighter.