Wonder Privacy Notice

Last updated: August 25, 2026

1. Introduction

This Privacy Notice explains how Sun Is Up Labs Ltd. (“Sun Is Up,” “we,” “us,” or “our”) collects, uses, discloses, and protects Personal Data of (a) Learners, Instructors, and Institution Representatives (as defined below) in connection with their use of Wonder, our learning management system platform (the “Platform”), available at [institution].wonderlms.com, and (b) visitors of our website (the “Website Visitors”), available at www.wonderlms.com.

The Platform serves four distinct groups, each with a different relationship to Sun Is Up, as detailed below.

Data Subject Groups	Who They Are	Sun Is Up's Role
Learners	Students enrolled in a course on the Platform.	We process Learners' Personal Data on behalf of, and under the instructions of, the Institution they are enrolled with.
Instructors	Lecturers, teaching staff, and other course operators who teach, grade, and manage courses on the Platform on behalf of an Institution.	We process Instructors' account and activity information both as a User in their own right and, for the coursework and grading data they handle, on behalf of their Institution.
Institution Representatives	Representatives of colleges, universities, and other educational bodies and their staff who implement the Platform in their institutions.	We process Institution Representatives' Personal Data as a data controller.
Website Visitors	Individuals who browse our website, whether or not they have a Platform account.	We process Website Visitors' Personal Data as a data controller.

Throughout this Notice, “Users” means Learners, Instructors and Institution Representatives. “You” refers to whichever of the groups above — a Learner, an Instructor, an Institution Representative, or a Website Visitor — is reading this Notice. Where something applies to only one group, this Notice states so specifically.

You are not legally required to provide us with any of your Personal Data, and may do so (or avoid doing so) at your own free will. If you prefer not to provide us with your Personal Data, or to have it processed by us or any of our service providers, please refrain from visiting or interacting with our sites or using our Platform.

You may also choose not to provide us with “optional” Personal Data (i.e. “not required” fields on forms), but please keep in mind that without it we may not be able to provide you with the full range of our services or with the best experience when using our services.

2. Scope of This Notice

This Notice applies to Personal Data collected through the Platform, including our web application and related services, and through our website. It does not apply to third-party websites or services that may be linked from the Platform or our website, or to information your Institution collects through its own systems outside the Platform.

3. Data Controller and Processor Roles

Sun Is Up's role in relation to your Personal Data depends on which group described above you belong to, and on the type of data involved.

For Learners' Personal Data, and for the coursework and grading data Instructors handle on a course, we act as a processor/service provider, processing that data on behalf of, and under the instructions of, the Institution. The Institution is the controller for that data, and remains responsible for its own compliance obligations toward Learners and Instructors, including under applicable education-privacy laws.

For Instructors' own account and activity information, and for Institution Representatives' Personal Data, we act as a controller, determining the purposes and means of that processing ourselves. We likewise act as a controller for Website Visitors' Personal Data, as described in Section 1 above.

Where your Institution has a data processing agreement (DPA) with us, that agreement — not this section — governs our processor obligations in detail, including the scope of our authority to process data, our sub-processor arrangements, and our obligations on breach notification, deletion, and audit. Contact your Institution, or contact us at hello@wonderlms.com, for a copy of that agreement or the current subprocessor list.

4. Information We Collect

The following details the types of Personal Data we process, the purpose of our processing, and the lawful basis for such processing:

Account & registration data (Learners, Instructors, Institution Representatives)

When you create an account or your Institution enrolls you, we collect information such as your name, email address, username, password, role (student or instructor), Institution affiliation, and preferences you set on the Platform, such as your display language.

Purpose: Providing and operating the Platform
Securing and improving the Platform
Legal Basis: Performance of a contract with you
Our legitimate interest in providing and improving the Platform

Enrollment & course data (Learners, Instructors)

We collect information about the courses you are enrolled in or teach, including course names, sections, enrollment dates, assignments, submissions, discussion posts, messages sent through the Platform, and other content you create or upload while using the Platform.

Purpose: Providing and operating the Platform
Legal Basis: Performance of a contract

Grades & assessment results (Instructors, Learners)

We collect grades, exam scores, rubric evaluations, and instructor feedback in connection with coursework completed on the Platform.

Purpose: Grading, assessment, and academic administration
Legal Basis: Our legitimate interest in providing the Platform

Usage & log data (Learners, Instructors, Institution Representatives, or Website Visitors)

We automatically collect information about how you interact with the Platform or website, including pages viewed, features used, time spent on assignments, login timestamps, IP address, browser type, device identifiers, and similar technical data.

Purpose: Providing, securing and improving the Platform or website
Legal Basis: Legitimate interest in providing the Platform or website

Lecture recordings, messages, and AI-generated content (Learners, Instructors)

Lecture Recordings

Where enabled by your Institution, we retrieve recordings of course sessions that your Institution has already recorded — including instructor and, where applicable, student audio, video, and screen-share content — copy them to our cloud environment, and process them (including using artificial intelligence) so that enrolled Users can review course sessions later. Your Institution is responsible for providing any required notices to, and obtaining any required consents from, instructors and students in connection with the recording of course sessions; our role is limited to retrieving, storing, and processing recordings your Institution has already made available to us.

Messages, Forum Posts, and Course-Support Chat

We collect messages you send to instructors or other Users, posts you make in course forums, and your interactions with the Platform's AI-powered course-support chat assistant.

AI-Generated Course Content

The Platform uses artificial intelligence to turn lecture recordings and course materials into supplementary study content, including written summaries, podcast-style audio, and explanatory videos. Producing this content may involve sending recordings or materials — which can include your voice, image, or spoken contributions if you appear or speak during a recorded session — to a third-party AI service for processing.

Purpose: Providing and operating the Platform, including recordings, chat, and AI-generated content
Legal Basis: Legitimate interest in providing the Platform

Contact information

Marketing communications

Purpose: Marketing communications
Legal Basis: Consent

In accordance with the EU AI Act, we disclose that the Platform's course-support chat assistant is an artificial intelligence system, not a human, and that AI-generated study content (written summaries, podcast-style audio, and explanatory videos) is marked as artificially generated where technically feasible.

5. How We Share Your Personal Data

We share your Personal Data with third parties, including Learners, Instructors, Institution Representatives, or service providers that help us provide our Platform. The table below provides information regarding the categories of such third-party recipients.

Category of Recipient	Data that will be shared	Purpose of Sharing
Your Instructors	Your coursework, submissions, grades, forum posts, and messages related to their course	To enable your Instructors to deliver course instruction, evaluate and grade your coursework, respond to your questions and messages, and otherwise administer the course in which you are enrolled
Your Institution	Enrollment status, grades, and usage information	To administer your degree and monitor your courses and academic achievements
Service providers we use to deliver the Platform (including AI vendors)	All types of Personal Data needed to provide a specific portion of the Platform (e.g. cloud hosting, payment processing, analytics, customer support, the chat assistant, AI content generation) To operate, secure, and improve the Platform. These providers only access what they need to provide the specific service, and are contractually barred from using it for any other purpose.	To operate, secure, and improve the Platform
Service providers we use to host and operate our website (e.g., web hosting providers)	Website usage and inquiry data, as described in Section 4 These providers only access what they need to provide the specific service, and are contractually barred from using it for any other purpose.	To host and operate our website
Law enforcement, governmental agencies, or authorized third parties (subject to an official request by law enforcement)	Personal Data requested by law enforcement authority request	As determined by the law enforcement agency requesting the Personal Data.
Any acquirer of our business	Any Personal Data processed by us	For the purpose of evaluating the acquisition.
Other Users (Learners and Instructors)	Content and identifying information (such as your name) that you choose to share within course discussion forums, chat, or similar collaborative features	To enable collaboration and communication as part of the Platform's course functionality.

When we share Personal Data with third parties, we ensure they only have access to Personal Data that is strictly necessary for them to pursue the purpose for which the Personal Data was shared. These parties are required to secure the Personal Data they receive and perform their services while ensuring compliance with all applicable data protection regulations.

We do not sell your Personal Data, and we do not use it for cross-context behavioral advertising or targeted advertising. Note that we will not share your Personal Data with additional third parties or for purposes not detailed in the table above or subsequently authorized by you or required by applicable law. You may contact us directly at hello@wonderlms.com regarding our use or disclosure of your Personal Data.

6. Cookies & Tracking Technologies

The Platform and our website (including some of our service providers) use “cookies”, anonymous identifiers, pixels, and similar technologies to provide and monitor the website and Platform, ensure they perform properly, and support their security and technical functioning. These technologies may be temporarily placed on your device, and some may recall personal information, such as an IP address, associated with a Learner, Instructor, Institution, or Website Visitor. Where use of cookies or similar technologies requires your prior consent under applicable law, we will provide an appropriate mechanism to obtain and manage that consent.

We do not change our practices in response to a “Do Not Track” signal from your browser. Most browsers let you control cookies, including whether to accept them and how to remove them, and can be set to notify you when a cookie is received or to block or remove cookies altogether.

Because we do not sell Personal Data or use it for cross-context behavioral advertising, Global Privacy Control (“GPC”) and similar universal opt-out signals do not change how we process your Personal Data. To the extent applicable state law treats a GPC signal as a valid opt-out request, we will honor it.

7. Data Retention

We retain Personal Data according to the following schedule, except where a legal hold, dispute, or applicable law requires a longer period:

Account, profile, and education-related data (including account and profile data, grades, enrollment and other education records, lecture recordings, forum posts, messages, course-support chat transcripts, AI-generated content, and usage and log data) — retained for as long as the Platform remains active for your Institution. Your Institution owns this data and may access or download it at any time during that period. Following the end of our contract with your Institution, we delete this data within 3 months, except where a legal hold, dispute, or applicable law requires a longer period.
Payment and billing information — retained for 7 years from the end of the relevant tax year, in accordance with Israeli tax record-keeping requirements.
Website and inquiry data (Website Visitors) — retained for as long as necessary to operate, secure and improve our website and, where you contact us, to handle your inquiry and keep a record of our correspondence, after which it is deleted or anonymised.
Contact information used for marketing — retained until you withdraw your consent or unsubscribe. After that, we keep a minimal record of your withdrawal, such as your email address on a suppression list, for as long as necessary to ensure we do not contact you again.

When Personal Data is no longer needed we delete it or render it anonymous.

8. Data Security

We use administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, or destruction. However, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any Personal Data stored with us or with any third parties.

9. Communications

We send two kinds of communications in connection with the Platform.

Service communications relate to your account, course activity, security, and other operational matters necessary to provide the Platform — for example, password resets, enrollment confirmations, and notices about changes to this Notice. You cannot opt out of service communications while you hold an account on the Platform, as they are necessary for us to provide the service.

Marketing communications, if any, describe new features, other Sun Is Up products, or similar promotional content. We only send marketing communications with your consent or another appropriate legal basis, and you can withdraw that consent at any time — see Section 10 below (Your Rights in relation to your ‘Personal Data’).

10. Your Rights in relation to your 'Personal Data'

You may access and update certain account information directly within the Platform. For other requests, including if you do not have an account on the Platform, please contact us by email at hello@wonderlms.com or contact your Institution if the request relates to your official education records.

We understand that privacy preferences vary among individuals, and we are committed to transparency regarding the Personal Data we collect and how it is used. Depending on your relationship with us, your location, and applicable data protection laws, you may have certain rights and choices with respect to your Personal Data, as detailed below:

Right to access — request a copy of the Personal Data we hold about you.
Right to correction — ask us to correct information that is incorrect, incomplete, unclear, or outdated.
Right to deletion — request deletion of your data, including where it is inaccurate, incomplete, unclear, or outdated, where it is no longer needed for the purpose it was collected for, or where there is no longer a lawful basis to process it.
Right to restriction and objection — if the GDPR or UK GDPR applies to you, object to certain processing or ask us to restrict how we use your data.
Right to data portability — if the GDPR or UK GDPR applies to you, receive your data in a portable, machine-readable format.
Right to opt out — depending on your U.S. state of residence, opt-out of certain uses of your Personal Data, including via the Global Privacy Control signal as described in Section 6.
Right to withdraw marketing consent — opt out of marketing communications at any time by using the unsubscribe link included in the communication or by contacting us.
Right to lodge a complaint — with your local data protection authority (EEA/UK) or the Israeli Privacy Protection Authority (Israel).

If the Israeli Privacy Protection Law, 5741-1981 applies to you, the right to view your Personal Data and the right to correct your Personal Data pursuant to Sections 13 & 14 of the law are available to you.

Please note that certain rights of Learners and Instructors may require you contacting your Institution, as our obligations to you are governed by our data processing agreement with the Institution. In that case, you should contact your Institution directly, or contact us and we will refer you to them.

11. International Data Transfers

Because Wonder is provided by an Israeli company to Users, Institutions, and Website Visitors worldwide, your Personal Data may be transferred to, stored, and processed in countries other than the one where you or your Institution are located, including the European Economic Area (EEA) and the United States. Regardless of where Personal Data is processed, we require it to receive a level of protection consistent with this Notice and applicable law.

11.1 Transfers from the European Economic Area and the United Kingdom

Where Personal Data originating in the EEA is transferred to a country outside the EEA that the European Commission has not recognized as providing an adequate level of protection, the transfer is made subject to the European Commission's Standard Contractual Clauses (“SCCs”). Where Personal Data originating in the United Kingdom is transferred to a country outside the UK that the UK Information Commissioner's Office has not recognized as providing an adequate level of protection, the transfer is made subject to the UK's International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses, as applicable).

11.2 Transfers to the United States

Where Personal Data originating in the EEA or the United Kingdom is transferred to a U.S.-based recipient that is self-certified under the EU-U.S. Data Privacy Framework (and, where relevant, its UK Extension), the transfer is made pursuant to the European Commission's adequacy decision for the Framework (Commission Implementing Decision (EU) 2023/1795) and the UK's corresponding adequacy regulations, without the need for additional safeguards; where a U.S.-based recipient is not, or is no longer, so certified, the transfer is instead made subject to the Standard Contractual Clauses (or the UK International Data Transfer Agreement, as applicable).

11.3 Transfers from Israel

Any transfer of Personal Data out of Israel — including to the EEA, the UK, the United States, or elsewhere — is subject to the Privacy Protection Regulations (Transfer of Data to Databases Outside of the State of Israel), 2001. Unless an exception applies, under Regulation 2(4), we require the recipient of any such transfer to contractually commit to protections equivalent to those required under Israeli law, in addition to any mechanism described in Sections 11.1 or 11.2 above, which also applies to that transfer. Where Personal Data originated in the EEA and is transferred onward from Israel, the recipient must also commit to the obligations in the Privacy Protection Regulations (Instructions Regarding Data Transfers from the European Economic Area to Israel), 5783-2023 (the “EEA Transfer Regulations”).

12. Children's Privacy

The Platform is intended for use by Learners enrolled in university-level and other post-secondary coursework. It is not our intention to ever directly collect Personal Data from children under the age of 16. If you believe that a child has disclosed Personal Data to us directly, or that we inadvertently hold Personal Data about a child, please email us at hello@wonderlms.com. If we become aware that a child under the age of 16 has provided us with Personal Data, we will take steps to delete that information as soon as possible, unless we are required to retain it for legal or contractual reasons.

13. Changes to This Notice

We may update this Notice from time to time. The “last updated” date at the top of this Notice reflects when the most recent changes were made. If we make significant changes, we will notify you by posting a notice on the Platform to ensure you are aware of the updated terms. We encourage you to visit this Notice from time to time for any changes.

14. Additional Notices

Accessibility. We are committed to making the Platform accessible to users with disabilities and have implemented an in-house accessibility overlay designed to improve compatibility with assistive technologies. If you experience any accessibility barriers while using the Platform, please contact us at hello@wonderlms.com so we can assist you.

Questions, Concerns, or Complaints. If you have any questions or comments about this Notice or how we handle your Personal Data, if you have concerns about your Personal Data held with us, or if you wish to make a complaint about how we process your Personal Data, please contact us by email at hello@wonderlms.com. We will acknowledge receipt of your complaint and investigate and respond to it within applicable regulatory timeframes.