FlashEDU Student Data Privacy Agreement for Private Schools

Article I: Purpose and Scope

1. Purpose. This DPA describes the duties and responsibilities of the Parties to protect Student Data consistent with the federal and state privacy laws that apply to the School and to Company, including the Children's Online Privacy Protection Act ("COPPA," 15 U.S.C. §§ 6501–6506) and applicable state student data privacy laws. The Family Educational Rights and Privacy Act ("FERPA," 20 U.S.C. § 1232g) applies to a private school only if it receives funds under a program administered by the U.S. Department of Education. Exhibit F sets out Company's FERPA terms and applies unless the School declines it under Section 4.
2. Scope. This DPA applies to all Student Data collected, processed, transmitted, stored, or maintained by Company through the Services (as defined in Exhibit A) in connection with the Service Agreement, regardless of the format in which it is maintained.
3. Term. This DPA is effective as of the DPA Effective Date and remains in effect for as long as Company maintains any Student Data received under the Service Agreement, notwithstanding termination or expiration of the Service Agreement.
4. FERPA Status. Exhibit F applies to the School unless the School declines it by stating in writing, when it signs or accepts this DPA or later, that it receives no funds under any program administered by the U.S. Department of Education, so that FERPA does not apply to it. Exhibit F stops applying when Company receives that statement. A School that has declined Exhibit F will tell Company in writing if it begins to receive such funds, and Exhibit F applies again from then. Nothing in this DPA makes Company a FERPA "school official" of a School that has declined Exhibit F.

Article II: Definitions

Terms used in this DPA have the meanings given below (see also Exhibit D for additional defined terms).

1. "Student Data" means personally identifiable information of a student — including "personal information" as COPPA defines it, personally identifiable information as applicable state law defines it, and, while Exhibit F applies, personally identifiable information from education records — that is collected, created, or maintained by the School and provided to, or generated by, Company through the Services. Student Data includes, at minimum, the categories described in Exhibit B, and does not include de-identified or aggregated data from which no student can reasonably be identified.
2. "De-Identified Data" means Student Data from which all direct and indirect identifiers have been removed, such that there is no reasonable basis to believe the remaining information can be used to identify a student, either alone or in combination with other reasonably available information.
3. "Services" means the FlashEDU Service described in Exhibit A.
4. "Authorized Employee" means an employee, contractor, or agent of Company who has a legitimate need to access Student Data to fulfill Company's obligations under the Service Agreement and who is bound by confidentiality obligations no less protective than this DPA.
5. "Subprocessor" means a third party engaged by Company that has access to or processes Student Data to provide services to Company necessary to deliver the Services, as listed in the Subprocessor and Security Overview, incorporated by reference.
6. "Security Breach" means the unauthorized acquisition of, or access to, Student Data maintained by Company that compromises the security, confidentiality, or integrity of the Student Data.
7. "School" means the private elementary or secondary school identified on the signature page, which is not a local educational agency. A public school contracts through its school district, and a charter school that is its own local educational agency contracts itself, under the FlashEDU Student Data Privacy Agreement for local educational agencies, published at https://edu.flashmath.io/legal/dpa, not under this DPA.
8. "Parent" means a student's parent or legal guardian, or the student where the student is 18 or older.
9. "Campus" means a school, campus, or division the School sets up within its account in the Services, such as a lower school and an upper school. "School Administrator" means a member of the School's staff to whom the School gives administrator access to its whole account in the Services; a "Campus Administrator" is one whose administrator access the School limits to one or more Campuses.

Article III: Data Ownership and Authorized Access

1. School Ownership. All Student Data is and remains the property of the School. Company acquires no ownership rights or interest in Student Data.
2. Authorized Access. Company will provide the School, upon request, access to Student Data maintained by Company in a usable, exportable format, to enable the School to respond to Parents' requests to review a student's information and to comply with applicable law.
3. Third-Party Requests. Company will not use, disclose, compile, transfer, sell, or share Student Data for any purpose other than providing the Services described in Exhibit A, except: (a) as directed or authorized in writing by the School; (b) as required by law, court order, or lawful subpoena, in which case Company will, to the extent legally permitted, promptly notify the School before disclosure so the School may seek a protective order; or (c) as otherwise expressly permitted by this DPA.
4. No Sale; No Advertising. Company will not sell, rent, or trade Student Data. Company will not use Student Data to develop, improve, or market products or services unrelated to the Services, and will not use Student Data for targeted advertising, behavioral advertising, or to build advertising profiles.
5. Authorized Use. Company may use Student Data only to: (a) provide and support the Services; (b) for adaptive learning or customization of the Services to the student; (c) diagnostic, product improvement, and research purposes using De-Identified Data; (d) legal, regulatory, and security compliance; and (e) other purposes expressly authorized by the School in writing.
6. De-Identified Data. Company may use and disclose De-Identified Data for the purposes described in Section 5(c) and to develop and improve Company's products and services generally, provided Company will not attempt to re-identify De-Identified Data and will contractually prohibit any third-party recipient of De-Identified Data from attempting to do so.
7. Parent Requests. A Parent may ask to review the student's Student Data, to have it deleted, or to stop its further collection. COPPA gives these rights to the parent of a child under 13, and the School's policies or applicable law may give others. Because the School controls the student's account, these requests are made to the School. Company refers any such request it receives directly to the School, acts on the School's written instruction, and gives the School the access described in Section 2 and the deletion described in Article VI.C with which to carry it out.

Article IV: Duties of Company

1. Provide Services. Company will provide the Services as described in Exhibit A in a manner consistent with COPPA, applicable state law and, while Exhibit F applies, FERPA.
2. Employee Obligations. Company will require Authorized Employees to comply with this DPA and with the laws that apply to Student Data under it.
3. No Unauthorized Disclosure. Company will not disclose Student Data to any third party except a Subprocessor bound by obligations at least as protective as this DPA, without the School's prior written consent, unless disclosure is required by law (subject to Article III.3(b)).
4. Advertising Restrictions. Company affirms the restrictions in Article III.4.
5. Data Security. Company will maintain a comprehensive data security program consistent with Exhibit C and industry-standard practices appropriate to the sensitivity of Student Data, including administrative, technical, and physical safeguards.
6. Subprocessors. Company will ensure that any Subprocessor with access to Student Data is contractually bound to data protection obligations no less protective of Student Data than those in this DPA, and will maintain the current Subprocessor list referenced in Article II.5.
7. No Unauthorized Uses. Company will not use Student Data for AI/machine-learning model training beyond what is necessary to provide the Services to the School, and will not permit any third-party AI provider used to deliver AI-assisted features (see Exhibit A) to use Student Data to train that provider's own general-purpose models.
8. Return or Deletion. Upon expiration or termination of the Service Agreement, or upon the School's request under Article VI.C.2, Company will, at the School's election, delete or provide a mechanism for the School to export all Student Data in Company's possession within the timeframe described in Exhibit C, except for data Company is required to retain by law or that has been fully De-Identified, and except as provided in Article VI.C.3.
9. Advertising-Free Environment. Company will not permit third-party advertising to be displayed to students within the Services.

Article V: Duties of the School

1. Notice to Parents. The School will inform Parents of its use of the Services and of Company's role as a service provider acting on the School's behalf, as the School's own policies, its agreements with families, and applicable law require.
2. COPPA Authorization. For a student under 13, the School authorizes Company, on the Parent's behalf, to collect, use and disclose the student's personal information as this DPA describes, solely for the use and benefit of the School and for no other commercial purpose. The School represents that it is able to give that authorization, and will give Parents any notice, and obtain any consent, that its policies or applicable law require. Company's Education Privacy Policy, published in the same library as this DPA, describes Company's practices so that the School can review them before giving it.
3. Compliance. The School is responsible for its own compliance with COPPA, applicable state law and, where it applies to the School, FERPA with respect to its use of the Services.
4. The School will designate an administrator responsible for account provisioning, roster management, and serving as point of contact for data privacy matters under this DPA.
5. The School will use the Services in a manner consistent with its own data governance policies and applicable law.

Article VI.A: Data Security

Company will implement the data security measures described in Exhibit C, including encryption of Student Data in transit and at rest as described in Exhibit C; access controls limiting Student Data access to Authorized Employees on a need-to-know basis; and periodic security review of its systems.

Article VI.B: Data Breach and Notification

1. In the event of a confirmed Security Breach affecting Student Data, Company will notify the School without unreasonable delay, and in no event later than the timeframe required by applicable law.
2. Company's notification will include, to the extent known at the time: the nature and scope of the breach, the categories and approximate number of students affected, the steps Company has taken or plans to take to mitigate the breach, and a contact for further information.
3. Company will cooperate with the School's reasonable investigation and, where legally required, its own notification obligations to affected Parents, regulators, or other authorities. This cooperation does not shift the School's own independent legal notification obligations.
4. The Parties will cooperate in good faith to determine the content of any notification to Parents and applicable regulators, provided that nothing in this Section prevents either Party from making any notification independently required by law.

Article VI.C: Data Retention and Deletion

1. Company will retain Student Data only for as long as necessary to provide the Services during the term of the Service Agreement, plus a reasonable transition period described in Exhibit C.
2. The School may request deletion at any time, of the Student Data of one or more individual students or of all of the School's Student Data: a School Administrator may request the deletion of individual students in the Services, and the School may send Company a written request for either. Upon such a request, or automatically upon expiration or termination of the Service Agreement absent a contrary School instruction, Company will delete or de-identify the Student Data concerned within the period stated in Exhibit C, except data it is required by law to retain (for example, financial/tax records unrelated to individual students) or fully De-Identified Data. When Company confirms a written request to delete all of the School's Student Data, the Services end: access to them, including data export, ends at that moment and the deletion is scheduled to start immediately, so the School should export any Student Data it wants to keep before sending that request. A Parent's request to delete a student's data is made through the School, which controls the student's account; Company refers any such request it receives directly to the School and acts on the School's written instruction.
3. The following are also excepted from deletion: (a) Audit trail. Company keeps a tamper-evident audit trail of sign-ins and administrative actions in the Services. It contains internal account identifiers, sign-in network data such as IP addresses, and the text recorded with each administrative action, which may include a student's name where staff typed one — for example in a stated reason or a note. Company does not remove those identifiers or that text when the corresponding Student Data is deleted, and the audit trail has no scheduled deletion date; Company uses it only for security, integrity and legal-compliance purposes. A second copy of the School's audit trail, kept with the School's other Student Data, is de-identified when all of the School's Student Data is deleted. (b) Backups. Backup copies are encrypted and are not altered when Student Data is deleted; they expire on their own schedule. Nightly backups kept on the servers that host the School's data are deleted within 16 days, database-log archives there are deleted 14 days after they are copied off-site, and the encrypted off-site copies are deleted once they are more than 90 days old — so every backup copy made before a deletion is gone within 91 days of it. The deletion certificate Company issues when the School's Student Data is deleted states the dates.

Article VII: General Offer of Privacy Terms

Company may, at its option, extend the terms of this DPA to other private schools that wish to procure the Services, via the General Offer of Privacy Terms described in Exhibit E. A private school accepting the General Offer is bound by, and entitled to the protections of, this DPA as if it were an original signatory, without further negotiation of this DPA's terms (though the Service Agreement's commercial terms, including fees, remain subject to that school's own Order Form).

Article VIII: Miscellaneous

1. Conflicts. In the event of a conflict between this DPA and the Service Agreement regarding the treatment of Student Data, this DPA controls. In the event of a conflict between this DPA and Exhibit C (state-specific terms), Exhibit C controls to the extent required by the applicable state's law.
2. Amendment. This DPA may only be amended by written agreement of the Parties, except that Company may update the Subprocessor list referenced in Article II.5 with notice to the School as described in the Subprocessor and Security Overview.
3. Survival. The obligations in Articles III, IV, VI, and this Article VIII survive termination or expiration of the Service Agreement for as long as Company retains any Student Data.
4. Notices. Notices under this DPA must be sent to the contacts identified on the signature page and to Company at education@flashmath.io.
5. Governing Law. This DPA is governed by the same law and venue as the Service Agreement, except as superseded by a state-specific requirement in Exhibit C.

Exhibit A: Description of Services

FlashEDU is a K-12 mathematics practice and assessment platform providing:

1. Individual student practice sessions with adaptive difficulty.
2. Optional real-time practice matches, which are off until the School turns them on. A student whose account the School manages is then matched only with other students of the School, unless, at the School's request, Company places the School in a shared pool that matches its students with students of other participating schools and school districts. Students may also be matched with automated (non-human) opponents when no suitable opponent is available.
3. Teacher-facing classroom management: rosters, assignments, progress reports, and printable conference one-pagers.
4. Beginning-, middle-, and end-of-year benchmark placement assessments.
5. AI-assisted features. Coach Flash, AI-assisted practice coaching for students, is controlled by a School-level setting, which is disabled by default for a School whose account is created on or after September 25, 2026; a School whose account was created before that date keeps the setting it had, which was enabled unless the School turned it off. While Coach Flash is disabled, Student Data is not transmitted to AI providers for that feature. Separate AI-assisted tools support educators and administrators — for example answering questions about the School's own data, drafting school-wide and board reports, summarizing class progress, generating practice content, explaining why a student was flagged for attention, drafting parent summaries, mapping an uploaded roster file, and a voice assistant for staff. These educator-facing tools are controlled by their own School-level setting, independent of Coach Flash: enabling or disabling Coach Flash neither enables nor disables them, and while the educator setting is off, Student Data is not transmitted to AI providers for those tools. The educator setting is disabled by default for a School whose account is created on or after the effective date of version 1.0 of this DPA; a School whose account was created earlier keeps the state its educator tools were already in, which may be enabled. School Administrators can turn either setting on or off in the Services at any time. Data transmitted to AI providers for educator-facing tools may include student names or usernames, school and classroom names, teacher names, and performance summaries — not only individual practice questions and answers. For roster mapping, only the column headings of the uploaded file and a small sample of its values, with sensitive fields removed, are transmitted.
6. Optional virtual currency and cosmetic reward features earned through gameplay. Virtual currency cannot be purchased directly. FlashMath's consumer subscription products, which are sold outside the School relationship and are not part of the Services purchased by the School, do include virtual currency grants.

Exhibit B: Schedule of Data

Company collects the following categories of Student Data through the Services.

Company does not collect, through the Services: Social Security numbers, biometric data, precise geolocation, criminal records, School disciplinary records, medical diagnoses, treatment records or health history, or any category of data not listed above. The accommodation indicators described above record only how a student takes practice, and account restriction records reflect conduct within the Services only.

Exhibit C: Data Security Requirements and State-Specific Terms

C.1 Data Security Requirements

1. Encryption of Student Data in transit using industry-standard transport security (TLS 1.2 or higher) between users' browsers and the Services, and between the Services' application servers and their PostgreSQL database servers.
2. Encryption of Student Data at rest to the AES-256 standard, covering the storage volumes that hold Student Data and the backup copies made from them. Stored student passwords, sign-in secrets and single sign-on secrets are additionally encrypted field by field.
3. Access to Student Data restricted to authorized personnel with a legitimate need to know, under role-based access controls. On the School side, access is scoped by role: a teacher sees the classrooms the teacher teaches and, unless the School turns this off, can view but not change the classrooms of other teachers at the same Campus, and the School can let a teacher view a particular classroom; a Campus Administrator sees the Student Data of that administrator's own Campuses, and only those Campuses' roster imports, stored student credentials and audit events, without the IP addresses recorded in the audit trail; a School Administrator sees the whole School. Company personnel access is limited by role and requires multi-factor authentication.
4. Sign-ins and administrative actions affecting Student Data are recorded in a protected, tamper-evident audit trail, whose contents and retention are described in Article VI.C.3(a). Security and access logs are retained for a period sufficient to support incident investigation.
5. Periodic review of security practices; prompt remediation of identified vulnerabilities affecting Student Data.
6. Deletion or de-identification of Student Data within 90 days of Service Agreement termination or expiration, or of the School's request, whichever is earlier. For a request a School Administrator makes in the Services, the 90 days run from when the request is made; for a written request sent to Company, they run from Company's confirmation of that request. The automatic deletion that follows termination completes within that period. Excepted are data Company is legally required to retain and the audit-trail and backup exceptions in Article VI.C.3.

C.2 State-Specific Terms

This section holds the state-specific rider required by the law of the School's state. Some state student data privacy laws govern the operator of a K-12 online service whichever school it serves; others govern only public schools and their contracts. A rider is added to the executed copy where the School's state requires one. The California rider is set out below.

California — Student Online Personal Information Protection Act

If the School is located in California, Company acknowledges that it is an operator of the Services under the Student Online Personal Information Protection Act (Cal. Bus. & Prof. Code § 22584 et seq.) and will comply with that Act with respect to Student Data, including by:

1. Not using Student Data for targeted advertising, and not using it to amass a profile about a student except in furtherance of K-12 school purposes.
2. Not selling or renting Student Data.
3. Maintaining reasonable security procedures and practices appropriate to the nature of the Student Data, as described in Exhibit C.1.
4. Deleting a student's Student Data at the School's request, as described in Article VI.C.

Exhibit D: Additional Definitions

1. "COPPA" means the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and its implementing FTC regulations at 16 CFR Part 312.
2. "FERPA" means the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and its implementing regulations at 34 CFR Part 99. Exhibit F applies unless the School declines it under Article I.4.
3. "Education Record" has the meaning given in FERPA, 34 CFR § 99.3, and is used only in Exhibit F.
4. "School Official" has the meaning given in the School's annual FERPA notification of rights, consistent with 34 CFR § 99.31(a)(1), and is used only in Exhibit F.
5. "Operator" has the meaning given in applicable state student data privacy statutes modeled on California's SOPIPA (Cal. Bus. & Prof. Code § 22584 et seq.).

Exhibit E: General Offer of Privacy Terms

Company offers the same privacy protections, terms, and conditions described in this DPA to any other private school that is not a local educational agency and wishes to accept them for its own procurement of the Services (an "Accepting School"). The General Offer excludes Exhibit C's state-specific terms, which are governed by the Accepting School's own state requirements, and excludes the Service Agreement's commercial terms, which remain subject to a separate Order Form.

To accept the General Offer, an Accepting School's authorized representative should request the acceptance form from education@flashmath.io and return it signed; an Accepting School that receives no funds under any program administered by the U.S. Department of Education may decline Exhibit F on that form. Acceptance binds Company and the Accepting School to this DPA as of the date of Company's countersignature, without further negotiation of this DPA's terms.

Exhibit F: FERPA Terms

This Exhibit applies unless the School has declined it, as Article I.4 describes. It adds to the rest of this DPA and does not reduce it.

1. To the extent Student Data includes Education Records, the School designates Company as a "school official" with a "legitimate educational interest" in them, under the School's direct control with respect to their use and maintenance, as 34 CFR § 99.31(a)(1)(i)(B) permits.
2. Company will use personally identifiable information from Education Records only for the purposes for which the School discloses it, and will not redisclose it except as FERPA permits, as the School directs in writing, or as required by law (subject to Article III.3(b)).
3. Where FERPA applies to the School, the School will include in its annual notification of FERPA rights the criteria under which Company qualifies as a School Official.
4. Company will cooperate with the School in responding to a parent's or eligible student's request under FERPA to inspect and review, or to seek to amend, Education Records held in the Services.
5. Where the Protection of Pupil Rights Amendment (20 U.S.C. § 1232h) applies to the School's use of the Services, the School remains responsible for the notices and consents it requires.

Change Log

Version 1.1 replaces version 1.0 (effective 2026-09-28): the accommodation indicators in Exhibit B add extended time. It is derived from version 1.3 of the FlashEDU Student Data Privacy Agreement for local educational agencies, published at https://edu.flashmath.io/legal/dpa, and adapted for a private school that is not a local educational agency. Its commitments about what the Services do, the Student Data they collect, security, retention and deletion follow that agreement. It differs as follows:

1. Counterparty. The agreement is made with the School, a private school, rather than a local educational agency. A charter school that is its own local educational agency signs the agreement for local educational agencies.
2. Article I and Exhibit F — FERPA. FERPA applies to a private school only if it receives funds under a program administered by the U.S. Department of Education. Company's role as a FERPA school official is set out in Exhibit F, which applies unless the School declines it by stating in writing that it receives no such funds.
3. Article V — COPPA. The School authorizes, for students under 13, Company's collection of personal information for the School's use and benefit and for no other commercial purpose.
4. Article III — Parents. A Parent's request to review or delete a student's data, or to stop its collection, is made to the School, which controls the account; Company refers any such request it receives to the School.
5. Exhibit C.2 — state terms. The state-specific terms address laws that reach a private school or the operator serving it. The New York rider, which applies to public educational agencies, is not included; a California rider is.
6. Exhibit E — General Offer. The General Offer is extended to other private schools.