FlashEDU Student Data Privacy Agreement

Article I: Purpose and Scope

1. Purpose. This DPA describes the duties and responsibilities of the Parties to protect Student Data consistent with applicable federal and state privacy law, including the Family Educational Rights and Privacy Act ("FERPA," 20 U.S.C. § 1232g), the Children's Online Privacy Protection Act ("COPPA," 15 U.S.C. §§ 6501–6506), the Protection of Pupil Rights Amendment ("PPRA"), and applicable state student data privacy laws.
2. Scope. This DPA applies to all Student Data collected, processed, transmitted, stored, or maintained by Company through the Services (as defined in Exhibit A) in connection with the Service Agreement, regardless of the format in which it is maintained.
3. Term. This DPA is effective as of the DPA Effective Date and remains in effect for as long as Company maintains any Student Data received under the Service Agreement, notwithstanding termination or expiration of the Service Agreement.

Article II: Definitions

Terms used in this DPA have the meanings given below (see also Exhibit D for additional defined terms).

1. "Student Data" means personally identifiable information, as defined by FERPA and applicable state law, of a student that is collected, created, or maintained by the LEA and provided to, or generated by, Company through the Services. Student Data includes, at minimum, the categories described in Exhibit B, and does not include de-identified or aggregated data from which no student can reasonably be identified.
2. "De-Identified Data" means Student Data from which all direct and indirect identifiers have been removed, such that there is no reasonable basis to believe the remaining information can be used to identify a student, either alone or in combination with other reasonably available information.
3. "Services" means the FlashEDU Service described in Exhibit A.
4. "Authorized Employee" means an employee, contractor, or agent of Company who has a legitimate need to access Student Data to fulfill Company's obligations under the Service Agreement and who is bound by confidentiality obligations no less protective than this DPA.
5. "Subprocessor" means a third party engaged by Company that has access to or processes Student Data to provide services to Company necessary to deliver the Services, as listed in the Subprocessor and Security Overview, incorporated by reference.
6. "Security Breach" means the unauthorized acquisition of, or access to, Student Data maintained by Company that compromises the security, confidentiality, or integrity of the Student Data.

Article III: Data Ownership and Authorized Access

1. LEA Ownership. All Student Data is and remains the property of the LEA. Company acquires no ownership rights or interest in Student Data.
2. Authorized Access. Company will provide the LEA, upon request, access to Student Data maintained by Company in a usable, exportable format, to enable the LEA to comply with FERPA and other applicable law, including responding to parent/eligible student requests for access to education records.
3. Third-Party Requests. Company will not use, disclose, compile, transfer, sell, or share Student Data for any purpose other than providing the Services described in Exhibit A, except: (a) as directed or authorized in writing by the LEA; (b) as required by law, court order, or lawful subpoena, in which case Company will, to the extent legally permitted, promptly notify the LEA before disclosure so the LEA may seek a protective order; or (c) as otherwise expressly permitted by this DPA.
4. No Sale; No Advertising. Company will not sell, rent, or trade Student Data. Company will not use Student Data to develop, improve, or market products or services unrelated to the Services, and will not use Student Data for targeted advertising, behavioral advertising, or to build advertising profiles.
5. Authorized Use. Company may use Student Data only to: (a) provide and support the Services; (b) for adaptive learning or customization of the Services to the student; (c) diagnostic, product improvement, and research purposes using De-Identified Data; (d) legal, regulatory, and security compliance; and (e) other purposes expressly authorized by the LEA in writing.
6. De-Identified Data. Company may use and disclose De-Identified Data for the purposes described in Section 5(c) and to develop and improve Company's products and services generally, provided Company will not attempt to re-identify De-Identified Data and will contractually prohibit any third-party recipient of De-Identified Data from attempting to do so.

Article IV: Duties of Company

1. Provide Services. Company will provide the Services as described in Exhibit A in a manner consistent with the LEA's obligations under FERPA, COPPA, and applicable state law.
2. Employee Obligations. Company will require Authorized Employees to comply with all applicable provisions of FERPA and this DPA with respect to Student Data.
3. No Unauthorized Disclosure. Company will not disclose Student Data to any third party except a Subprocessor bound by obligations at least as protective as this DPA, without the LEA's prior written consent, unless disclosure is required by law (subject to Article III.3(b)).
4. Advertising Restrictions. Company affirms the restrictions in Article III.4.
5. Data Security. Company will maintain a comprehensive data security program consistent with Exhibit C and industry-standard practices appropriate to the sensitivity of Student Data, including administrative, technical, and physical safeguards.
6. Subprocessors. Company will ensure that any Subprocessor with access to Student Data is contractually bound to data protection obligations no less protective of Student Data than those in this DPA, and will maintain the current Subprocessor list referenced in Article II.5.
7. No Unauthorized Uses. Company will not use Student Data for AI/machine-learning model training beyond what is necessary to provide the Services to the LEA, and will not permit any third-party AI provider used to deliver AI-assisted features (see Exhibit A) to use Student Data to train that provider's own general-purpose models.
8. Return or Deletion. Upon expiration or termination of the Service Agreement, or upon the LEA's request under Article VI.C.2, Company will, at the LEA's election, delete or provide a mechanism for the LEA to export all Student Data in Company's possession within the timeframe described in Exhibit C, except for data Company is required to retain by law or that has been fully De-Identified, and except as provided in Article VI.C.3.
9. Advertising-Free Environment. Company will not permit third-party advertising to be displayed to students within the Services.

Article V: Duties of LEA

1. The LEA will provide notice to parents/eligible students of its use of the Services and Company's role as a "school official" with a "legitimate educational interest" under FERPA, as required by the LEA's own policies and applicable law.
2. The LEA is responsible for ensuring its own compliance with FERPA, COPPA, and applicable state student data privacy law with respect to its use of the Services, including obtaining any consents required under COPPA for students under 13.
3. The LEA will designate an administrator responsible for account provisioning, roster management, and serving as point of contact for data privacy matters under this DPA.
4. The LEA will use the Services in a manner consistent with its own data governance policies and applicable law.

Article VI.A: Data Security

Company will implement the data security measures described in Exhibit C, including encryption of Student Data in transit and at rest as described in Exhibit C; access controls limiting Student Data access to Authorized Employees on a need-to-know basis; and periodic security review of its systems.

Article VI.B: Data Breach and Notification

1. In the event of a confirmed Security Breach affecting Student Data, Company will notify the LEA without unreasonable delay, and in no event later than the timeframe required by applicable law.
2. Company's notification will include, to the extent known at the time: the nature and scope of the breach, the categories and approximate number of students affected, the steps Company has taken or plans to take to mitigate the breach, and a contact for further information.
3. Company will cooperate with the LEA's reasonable investigation and, where legally required, its own notification obligations to affected parents/students, regulators, or other authorities. This cooperation does not shift the LEA's own independent legal notification obligations.
4. The Parties will cooperate in good faith to determine the content of any notification to parents/students and applicable regulators, provided that nothing in this Section prevents either Party from making any notification independently required by law.

Article VI.C: Data Retention and Deletion

1. Company will retain Student Data only for as long as necessary to provide the Services during the term of the Service Agreement, plus a reasonable transition period described in Exhibit C.
2. The LEA may request deletion at any time, of the Student Data of one or more individual students or of all of the LEA's Student Data: a district administrator may request the deletion of individual students in the Services, and the LEA may send Company a written request for either. Upon such a request, or automatically upon expiration or termination of the Service Agreement absent a contrary LEA instruction, Company will delete or de-identify the Student Data concerned within the period stated in Exhibit C, except data it is required by law to retain (for example, financial/tax records unrelated to individual students) or fully De-Identified Data. When Company confirms a written request to delete all of the LEA's Student Data, the Services end: access to them, including data export, ends at that moment and the deletion is scheduled to start immediately, so the LEA should export any Student Data it wants to keep before sending that request. A parent's or eligible student's request to delete a student's data is made through the LEA, which controls the student's account; Company refers any such request it receives directly to the LEA and acts on the LEA's written instruction.
3. The following are also excepted from deletion: (a) Audit trail. Company keeps a tamper-evident audit trail of sign-ins and administrative actions in the Services. It contains internal account identifiers, sign-in network data such as IP addresses, and the text recorded with each administrative action, which may include a student's name where staff typed one — for example in a stated reason or a note. Company does not remove those identifiers or that text when the corresponding Student Data is deleted, and the audit trail has no scheduled deletion date; Company uses it only for security, integrity and legal-compliance purposes. A second copy of the LEA's audit trail, kept with the LEA's other Student Data, is de-identified when all of the LEA's Student Data is deleted. (b) Backups. Backup copies are encrypted and are not altered when Student Data is deleted; they expire on their own schedule. Nightly backups kept on the servers that host the LEA's data are deleted within 16 days, database-log archives there are deleted 14 days after they are copied off-site, and the encrypted off-site copies are deleted once they are more than 90 days old — so every backup copy made before a deletion is gone within 91 days of it. The deletion certificate Company issues when the LEA's Student Data is deleted states the dates.

Article VII: General Offer of Privacy Terms

Company may, at its option, extend the terms of this DPA to other LEAs that wish to procure the Services, via the General Offer of Privacy Terms described in Exhibit E. An LEA accepting the General Offer is bound by, and entitled to the protections of, this DPA as if it were an original signatory, without further negotiation of this DPA's terms (though the Service Agreement's commercial terms, including fees, remain subject to that LEA's own Order Form).

Article VIII: Miscellaneous

1. Conflicts. In the event of a conflict between this DPA and the Service Agreement regarding the treatment of Student Data, this DPA controls. In the event of a conflict between this DPA and Exhibit C (state-specific terms), Exhibit C controls to the extent required by the applicable state's law.
2. Amendment. This DPA may only be amended by written agreement of the Parties, except that Company may update the Subprocessor list referenced in Article II.5 with notice to the LEA as described in the Subprocessor and Security Overview.
3. Survival. The obligations in Articles III, IV, VI, and this Article VIII survive termination or expiration of the Service Agreement for as long as Company retains any Student Data.
4. Notices. Notices under this DPA must be sent to the contacts identified on the signature page and to Company at education@flashmath.io.
5. Governing Law. This DPA is governed by the same law and venue as the Service Agreement, except as superseded by a state-specific requirement in Exhibit C.

Exhibit A: Description of Services

FlashEDU is a K-12 mathematics practice and assessment platform providing:

1. Individual student practice sessions with adaptive difficulty.
2. Optional real-time practice matches. By default, an LEA-managed student is matched only with other students of the same LEA. An LEA may opt in to a shared pool that matches its students with students of other participating LEAs. Students may also be matched with automated (non-human) opponents when no suitable opponent is available.
3. Teacher-facing classroom management: rosters, assignments, progress reports, and printable conference one-pagers.
4. Beginning-, middle-, and end-of-year benchmark placement assessments.
5. AI-assisted features. Coach Flash, AI-assisted practice coaching for students, is controlled by an LEA-level setting, which is disabled by default for an LEA whose account is created on or after September 25, 2026; an LEA whose account was created before that date keeps the setting it had, which was enabled unless the LEA turned it off. While Coach Flash is disabled, Student Data is not transmitted to AI providers for that feature. Separate AI-assisted tools support educators and administrators — for example answering questions about the LEA's own data, drafting district and board reports, summarizing class progress, generating practice content, explaining why a student was flagged for attention, drafting parent summaries, mapping an uploaded roster file, and a voice assistant for staff. These educator-facing tools are controlled by their own LEA-level setting, independent of Coach Flash: enabling or disabling Coach Flash neither enables nor disables them, and while the educator setting is off, Student Data is not transmitted to AI providers for those tools. The educator setting is disabled by default for an LEA whose account is created on or after the effective date of version 1.2 of this DPA; an LEA whose account was created earlier keeps the state its educator tools were already in, which may be enabled. The LEA's district administrators can turn either setting on or off in the Services at any time. Data transmitted to AI providers for educator-facing tools may include student names or usernames, school and classroom names, teacher names, and performance summaries — not only individual practice questions and answers. For roster mapping, only the column headings of the uploaded file and a small sample of its values, with sensitive fields removed, are transmitted.
6. Optional virtual currency and cosmetic reward features earned through gameplay. Virtual currency cannot be purchased directly. FlashMath's consumer subscription products, which are sold outside the LEA relationship and are not part of the Services purchased by the LEA, do include virtual currency grants.

Exhibit B: Schedule of Data

Company collects the following categories of Student Data through the Services.

Company does not collect, through the Services: Social Security numbers, biometric data, precise geolocation, criminal records, LEA disciplinary records, medical diagnoses, treatment records or health history, or any category of data not listed above. The accommodation indicators described above record only how a student takes practice, and account restriction records reflect conduct within the Services only.

Exhibit C: Data Security Requirements and State-Specific Terms

C.1 Data Security Requirements

1. Encryption of Student Data in transit using industry-standard transport security (TLS 1.2 or higher) between users' browsers and the Services, and between the Services' application servers and their PostgreSQL database servers.
2. Encryption of Student Data at rest to the AES-256 standard, covering the storage volumes that hold Student Data and the backup copies made from them. Stored student passwords, sign-in secrets and single sign-on secrets are additionally encrypted field by field.
3. Access to Student Data restricted to authorized personnel with a legitimate educational interest, under role-based access controls. On the LEA side, access is scoped by role: a teacher sees the classrooms the teacher teaches and, unless the LEA turns this off, can also view — but not change — the other classrooms at the teacher's own school; LEA administrators can give another teacher view access to a particular classroom, and a co-teacher listed in the LEA's Clever roster receives it automatically; a school administrator sees the Student Data of the administrator's own schools, and only those schools' roster imports, stored student credentials and audit events, without the IP addresses recorded in the audit trail; a district administrator sees the whole LEA. Company personnel access is limited by role and requires multi-factor authentication.
4. Sign-ins and administrative actions affecting Student Data are recorded in a protected, tamper-evident audit trail, whose contents and retention are described in Article VI.C.3(a). Security and access logs are retained for a period sufficient to support incident investigation.
5. Periodic review of security practices; prompt remediation of identified vulnerabilities affecting Student Data.
6. Deletion or de-identification of Student Data within 90 days of Service Agreement termination or expiration, or of the LEA's request, whichever is earlier. For a request a district administrator makes in the Services, the 90 days run from when the request is made; for a written request sent to Company, they run from Company's confirmation of that request. The automatic deletion that follows termination completes within that period. Excepted are data Company is legally required to retain and the audit-trail and backup exceptions in Article VI.C.3.

C.2 State-Specific Terms

This section holds the state-specific rider required by the contracting LEA's home state. The New York rider is set out below; a rider for another state is added to the executed copy as that state's law requires.

New York — Education Law § 2-d / Part 121

If the LEA is a New York educational agency, the following additional terms apply, consistent with NY Education Law § 2-d and 8 NYCRR Part 121:

1. Company will provide the LEA's designated Data Protection Officer with a completed Parents' Bill of Rights supplemental information addendum, consistent with the LEA's Parents' Bill of Rights for Data Privacy and Security.
2. Company will not use Student Data for any purpose other than those explicitly authorized in this DPA.
3. Company will notify the LEA of a Security Breach in the most expedient way possible and without unreasonable delay, in accordance with NY Education Law § 2-d(6).
4. Company will complete and provide the LEA any additional supplemental information required by the New York State Education Department's model Parents' Bill of Rights, upon request.
5. Officers or employees of Company who have access to Student Data will receive training on applicable data privacy and security requirements, at least annually.

Exhibit D: Additional Definitions

1. "FERPA" means the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations at 34 CFR Part 99.
2. "COPPA" means the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and its implementing FTC regulations at 16 CFR Part 312.
3. "Education Record" has the meaning given in FERPA, 34 CFR § 99.3.
4. "School Official" has the meaning given in the LEA's annual FERPA notification of rights, consistent with 34 CFR § 99.31(a)(1).
5. "Operator" has the meaning given in applicable state student data privacy statutes modeled on California's SOPIPA (Cal. Bus. & Prof. Code § 22584 et seq.).

Exhibit E: General Offer of Privacy Terms

Company offers the same privacy protections, terms, and conditions described in this DPA to any other LEA that wishes to accept them for its own procurement of the Services (an "Accepting LEA"). The General Offer excludes Exhibit C's state-specific terms, which are governed by the Accepting LEA's own state requirements, and excludes the Service Agreement's commercial terms, which remain subject to a separate Order Form.

To accept the General Offer, an Accepting LEA's authorized representative should request the acceptance form from education@flashmath.io and return it signed. Acceptance binds Company and the Accepting LEA to this DPA as of the date of Company's countersignature, without further negotiation of this DPA's terms.

Change Log

Version 1.3 replaces version 1.2 (effective 2026-09-28). The one change: Exhibit B — schedule of data. The accommodation indicators add extended time, a delivery flag LEA staff may set so that the student's timed practice rounds last longer.

Version 1.2 replaced version 1.1 (effective 2026-08-10). Two of the changes below were first published on this page before the version number changed — on September 25 and September 28, 2026 — and are recorded here as part of version 1.2. The substantive changes since version 1.1 were:

1. Exhibit A — Coach Flash default. Coach Flash is disabled by default for an LEA whose account is created on or after September 25, 2026; it was previously enabled by default, and an LEA created earlier keeps its existing setting. First published on this page on September 25, 2026.
2. Exhibit A — AI tools for educators. Educator-facing AI tools are controlled by their own LEA-level setting, independent of Coach Flash, which the LEA's district administrators set in the Services, and every one of them — including the staff voice assistant — honors that setting. The setting is disabled by default for an LEA created on or after the effective date of version 1.2; an earlier LEA keeps the state its tools were in. Roster mapping transmits only the column headings and a small sample of values with sensitive fields removed, instead of the uploaded file.
3. Article VI.C and Exhibit C.1 — deletion on request. The LEA may request deletion of individual students' data or of all of its Student Data: a district administrator can request the deletion of individual students in the Services, and the LEA can send Company a written request for either. The 90 days run from when a request made in the Services is made, and from Company's confirmation of a written request. Confirming a written request to delete all of the LEA's Student Data ends the Services, including data export, at that moment. A parent's or eligible student's deletion request is made through the LEA.
4. Article VI.C — exceptions. Added the audit-trail and backup exceptions. They were first published on September 28, 2026 with a statement that student names are removed from the audit trail; that statement was wrong and is corrected: the tamper-evident audit trail keeps account identifiers, IP addresses and the text of administrative actions, which may include names, without a scheduled deletion date. Backups are encrypted and expire on a stated schedule.
5. Exhibit B — schedule of data. Added chat messages (where the LEA and teacher turn chat on; only the latest 100 of each party chat are kept, until one hour after its most recent message) and support requests (a student's report stays in the Services for the teacher or LEA administrators; staff requests go to a dedicated support tracker and refer to students only by anonymous identifier). Scoped the date-of-birth statement to registration with an email address and password. Removed crash diagnostics and in-app usage events, which the Services do not collect. Corrected voice features: audio is not cached or stored; the 30-day limit previously stated for voice session records was not being applied and has been removed; and the educator voice assistant follows the LEA's educator AI setting.
6. Exhibit C.1 — security. In-transit encryption is stated for the connections it covers; backups are named in the at-rest encryption commitment; a teacher can view other classrooms at the same school unless the LEA turns this off; school administrators see only their own schools' roster imports, stored credentials and audit events, without IP addresses; the audit-trail item points to the disclosure in Article VI.C; the automatic deletion after termination completes within the 90-day period.
7. Subprocessors. The Subprocessor and Security Overview (available on request) now lists the roster and sign-in integrations an LEA may connect (Clever, Google, the LEA's own identity provider), the dedicated support tracker for staff requests, the log server, the off-site backup storage provider and Google Fonts, and corrects the descriptions of the email provider, Stripe, Anthropic and OpenAI.