Privacy Policy & Student Data Protection

elevatED operates as a school official under FERPA (20 U.S.C. § 1232g; 34 CFR Part 99), processing student educational records solely for legitimate educational purposes on behalf of the educational institution.

Student rights under FERPA include:

• The right to inspect and review education records.
• The right to request amendment of records believed to be inaccurate.
• The right to consent before disclosures of personally identifiable information (PII).
• The right to file a complaint with the U.S. Department of Education regarding FERPA violations.

We do not disclose student education records to third parties without prior written consent from a parent or eligible student, except as permitted under FERPA's limited exceptions (e.g., school officials with legitimate educational interest, legal compliance).

elevatED serves students in grades K–12. For users under 13 years of age, we comply fully with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506).

• Verifiable parental consent is obtained before collecting personal information from children under 13, unless the school provides consent on behalf of parents in accordance with COPPA's school authority exception.
• We collect only the minimum necessary personal information required for educational functionality.
• Personal information collected from children is never used for commercial purposes, behavioral advertising, or data profiling.
• Parents may review, correct, or request deletion of their child's information by contacting us at the address below.

In compliance with Florida Statute § 1002.22 (Student Records; Public Schools), ElevatED:

• Treats all student academic and behavioral data as confidential education records.
• Restricts access to student records to authorized school personnel and parents/guardians only.
• Does not release student records to any unauthorized party.
• Ensures that any data collected on elevatED is used exclusively for improving the educational experience of the enrolled student.
• Provides parents and eligible students with the right to inspect, challenge, and request correction of records.

In compliance with Florida Statute § 1002.221 (Student Data Privacy), elevatED agrees to the following obligations as a third-party operator:

• Student data is used only for the purposes authorized by the educational institution and for fulfilling the educational purposes of this platform.
• We do not sell student data under any circumstances.
• We do not use student data for targeted advertising or to build commercial profiles.
• We implement reasonable security measures including encryption in transit (TLS 1.3), encryption at rest (AES-256), access controls, and regular security reviews.
• Upon contract termination or school request, student data will be deleted or returned within 60 days.
• We will notify the educational institution within 72 hours of discovering any unauthorized access to student data.

elevatED operates as an operator as defined under Florida Statute § 1006.1494 (the Student Online Personal Information Protection Act, "SOPIPA"), which governs how operators of websites, online services, and applications used for K-12 school purposes may collect, use, and disclose student covered information.

Definitions (§ 1006.1494(1)). For purposes of this section:

• Covered information — Personal identifying information or material of a student, or information linked to such information, in any media or format that is not publicly available, including information created by or provided to elevatED by the student, parent/guardian, or school for K-12 school purposes, or gathered through operation of the platform and personally identifying a student (e.g., name, email address, test results, grades, evaluations, student identifiers, search activity).
• K-12 school purposes — Purposes directed by or that customarily take place at the direction of a K-12 school, teacher, or school district, or that aid in the administration of school activities, including instruction, administrative activities, and collaboration between students, school personnel, or parents.
• Operator — The operator of an Internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for K-12 school purposes, or was designed and marketed for K-12 school purposes.
• Targeted advertising — Advertisements presented to a student selected on the basis of information obtained or inferred over time from that student's online behavior, usage of applications, or covered information.

Prohibited activities (§ 1006.1494(2)). elevatED does not knowingly:

• Engage in targeted advertising on the platform, or on any other site, service, or application, where the targeting is based on covered information or persistent unique identifiers acquired through K-12 use of the platform.
• Use covered information, including persistent unique identifiers, to amass a profile of a student, except in furtherance of K-12 school purposes. Account information that remains under the control of the student, parent/guardian, or school is not considered "amassing a profile."
• Sell, share, or rent a student's covered information to any third party.
• Disclose covered information except as expressly permitted under § 1006.1494(2)(d) or (4) (see permitted disclosures below).

Required practices (§ 1006.1494(3)). elevatED:

• Collects no more covered information than is reasonably necessary to operate the platform for K-12 school purposes.
• Implements and maintains reasonable security procedures and practices appropriate to the nature of the covered information, designed to protect it from unauthorized access, destruction, use, modification, or disclosure (see Section 9).
• Will delete a student's covered information at the conclusion of the course or corresponding program, and no later than 90 days after the student is no longer enrolled in a school within the district, upon notice by the school district — unless a parent or guardian expressly consents to elevatED retaining the covered information.

Permitted disclosures (§ 1006.1494(2)(d) and (4)). elevatED may disclose covered information only under the following circumstances:

• In furtherance of the K-12 school purpose of the platform, where the recipient does not further disclose the information;
• As required by state or federal law;
• To comply with the order of a court or quasi-judicial entity;
• To protect the safety or integrity of users of the platform or others, or the security of the platform;
• For a school, educational, or employment purpose requested by the student or parent/guardian, provided the information is not used or further disclosed for any other purpose;
• To a third party that is contractually prohibited from using covered information for any purpose other than providing the contracted service to or on behalf of elevatED, prohibited from disclosing it to subsequent third parties, and required to implement and maintain reasonable security procedures and practices;
• To a state educational agency or the student's local educational agency (including K-12 schools and school districts) for K-12 school purposes, as allowed under state or federal law.

Permitted uses (§ 1006.1494(5)). This section does not prohibit elevatED from:

• Using de-identified covered information (not associated with an identified student) to improve educational products;
• Using de-identified covered information to demonstrate the effectiveness of the platform, including in marketing;
• Sharing de-identified covered information for the development and improvement of educational sites, services, or applications;
• Using recommendation engines to recommend additional educational content, services, or learning opportunities, where the recommendation is not determined in whole or in part by payment or consideration from a third party;
• Responding to a student's request for information or feedback, without third-party payment consideration.

elevatED complies with the Florida Digital Bill of Rights (FDBR), which requires controllers collecting personal information to maintain a transparent, up-to-date privacy policy covering data practices, retention, and consumer rights.

Types of personal data we collect: Account identifiers (name, email), educational performance data (quiz responses, accuracy, skill mastery), engagement data (session timestamps, streaks), and platform preferences (avatar, notification settings).

Data retention: Covered information is retained while the student account is active and for K-12 school purposes. At the conclusion of the course or corresponding program, and no later than 90 days after a student is no longer enrolled in a school within the district upon notice by the school district, covered information is deleted or returned — unless a parent or guardian expressly consents to retention (§ 1006.1494(3)(c)). Session timestamps are retained for a rolling 12-month period.

Your rights under the FDBR include:

• Right to access — You may request a copy of the personal data we hold about you or your child.
• Right to correction — You may request correction of inaccurate personal data.
• Right to deletion — You may request deletion of personal data, subject to our legal retention obligations.
• Right to data portability — You may request your data in a structured, commonly used, machine-readable format.
• Right to opt out of sale or profiling — We do not sell data or engage in profiling for non-educational purposes. No opt-out is required, but we acknowledge this right explicitly.

To exercise any of these rights, contact our Privacy Officer using the information in Section 8 below. We will respond to all verifiable requests within 45 days, with a possible 45-day extension for complex requests.

elevatED collects the minimum data necessary to provide an effective educational experience:

We do not collect Social Security Numbers, financial information, biometric data, health records, or any data not directly necessary for delivering the educational service.

elevatEDucation uses a limited set of trusted third-party service providers to operate the platform. We contractually require every provider to protect student data to the same standards we hold ourselves, and no provider is permitted to sell, share, or use student data for advertising, profiling, or any non-educational purpose.

Our hosting & infrastructure provider. The elevatEDucation platform is hosted on a cloud application platform (the "Hosting Provider"). The Hosting Provider:

• Stores and processes app data solely to operate and maintain the platform on our behalf;
• Is contractually restricted from selling, sharing, or monetizing student data;
• Hosts data in [PENDING — from Base44: data center region];
• Encrypts data in transit using [PENDING — from Base44: TLS standard] and at rest using [PENDING — from Base44: AES standard];
• Maintains [PENDING — from Base44: SOC 2 / security attestation] certification.

Complete sub-processor list. The full list of sub-processors that touch student data — including hosting, database, AI/LLM, email, and file storage providers — is available to partner districts under NDA and is provided as part of our standard Student Data Privacy Agreement. We notify partner districts of any new or changed sub-processor [PENDING — from Base44: notification timeframe] in advance.

AI features. elevatEDucation's AI tutoring and content-generation features use language-model providers. Student inputs to these features are processed solely to generate the student's response and are not used to train the provider's general models. [PENDING — from Base44: confirm whether LLM providers retain or train on inputs]

Data Processing Agreements. We sign a standard Student Data Privacy Agreement (SDPA) with every partner district. Our Hosting Provider [PENDING — from Base44: signs directly with the district / flows through elevatED] as part of that agreement. A copy of our SDPA template is available on request.

No sale of data. Neither elevatEDucation nor any of our sub-processors sells, rents, or licenses student data to any third party for any purpose.

• All data is transmitted using TLS 1.3 encryption (with TLS 1.2 fallback for compatibility).
• All data at rest is encrypted using AES-256, the industry standard for securing sensitive data.
• Access to student data is restricted to authenticated, authorized users only.
• Administrative access requires multi-factor authentication.
• Regular security assessments and vulnerability reviews are conducted.
• elevatED requires its hosting providers to store data within the United States wherever feasible; full residency details are available under NDA (see Section 8).
• We sign standard Student Data Privacy Agreements (SDPAs) with all partner districts and schools, contractually binding us to these protections.
• We do not sell, share, or monetize any student data or behavior analytics under any circumstances.

To exercise any data rights (inspection, correction, deletion, withdrawal of consent) or to report a concern:

You may also file a complaint with the U.S. Department of Education (FERPA) at studentprivacy.ed.gov or the Florida Department of Education at fldoe.org.