"EdTech companies have long and complicated privacy policies, but new research suggests they are not following their own policies."