🔒 Student Privacy

💡 Our Privacy-First Commitment

EDmazing Learning was designed by a teacher, for teachers. We believe student data belongs to students, families, and their schools — not to us. Our platform is architected so that we collect and store as little student data as possible, and what we do process is handled with the highest care.

⚙️ How Our Platform Works

Understanding our architecture is the best way to understand our privacy practices. EDmazing Learning activities — including both reading comprehension assessments and math assessments — are self-contained HTML applications that run entirely in the student's web browser.

📊 What Data Is Collected

Data Entered by Students

• First name and last initial only — entered at the start of each activity (e.g., "Maya T."). Full last names are never collected. If a student types their full last name, the system rejects the entry and asks them to provide only the first letter.
• Question responses — multiple-choice selections and open-ended written answers

Data Stored for Teacher Dashboard

• TEKS mastery scores — aggregate correct/total counts per standard, linked to the student's first name and last initial, class period, and teacher
• Activity completion records — which activities were completed, when, and the score achieved

This data powers the teacher dashboard's TEKS Progress charts, AI-generated instructional recommendations, and reteach worksheet selection. It contains no personally identifiable information beyond the student's first name and last initial.

Data We Do NOT Collect

• ❌ No full last names, only first initial
• ❌ No student accounts, usernames, or passwords
• ❌ No email addresses
• ❌ No dates of birth or demographic information
• ❌ No device fingerprints or persistent tracking identifiers
• ❌ No location data
• ❌ No photos, videos, or biometric data
• ❌ No social media profiles or contacts
• ❌ No cookies that track students across websites

🔍 How Data Is Used

🤖 AI Features & Transparency

Every EDmazing Learning assessment includes an AI Learning Insight feature that automatically generates personalized teacher recommendations based on the student's performance. The teacher dashboard also uses AI to generate instructional strategy recommendations based on aggregate class TEKS mastery data.

How AI Insights Work

1. When a student completes an activity, their score, skill breakdown, and response data are sent to our secure server endpoint.
2. Our server forwards a prompt to an AI language model. The prompt contains:
   • The student's first name and last initial only (as entered)
   • Which questions were answered correctly or incorrectly
   • The text of any written responses (for writing analysis)
   • The reading or math skill and TEKS standard assessed
3. The AI generates a brief analysis and returns it in a single response.
4. The analysis is embedded into the PDF report alongside the student's score and skill breakdown.
5. No student data is stored on our server or by the AI provider after the response is generated.

Teacher Dashboard AI Recommendations

The teacher dashboard uses aggregate TEKS mastery data (not individual student responses) to generate instructional strategy recommendations. These recommendations help teachers identify learning gaps, plan reteach activities, and group students effectively. The AI receives only summary-level data (e.g., "65% of students scored below mastery on TEKS 4.3D") — not individual student names or responses.

AI Data Safeguards

• Student data is not used to train AI models
• Data is transmitted over encrypted HTTPS connections
• Our AI endpoint processes requests in real-time and does not log or retain student response data
• AI requests are rate-limited to prevent abuse and protect against unauthorized cost escalation
• The AI insight is generated once per assessment completion and is not stored independently of the PDF report

📁 Google Drive Integration

PDF reports are saved directly to the teacher's own Google Drive account. This means:

• EDmazing Learning does not host or store student reports on our servers
• The teacher has full ownership and control over all student data
• Reports can be deleted, moved, or shared at the teacher's discretion
• Google Drive access is authenticated via the teacher's own Google account using OAuth 2.0
• Google Drive OAuth tokens are encrypted at rest using AES-256-CBC encryption
• Student browsers never authenticate with Google — only the teacher's pre-authorized token is used

🔐 Security Measures

Encryption & Data Protection

• Encryption in transit: All data transmitted between the student's browser and our server uses TLS/HTTPS encryption
• Encrypted credentials: Teacher OAuth tokens for Google Drive are encrypted at rest using AES-256-CBC
• Token-based access: Google Drive uploads use teacher-specific OAuth tokens; students never authenticate with Google
• Client-side processing: PDF reports are generated entirely in the browser before upload, minimizing data exposure

Access Control & Authentication

• Access codes: Students access activities via teacher-generated, time-limited access codes — no student accounts or passwords
• CSRF protection: All teacher dashboard actions are protected by cryptographic nonce tokens that prevent cross-site request forgery attacks
• Role-based access: Teacher dashboard features require authenticated WordPress accounts with teacher or tutor roles
• Session tokens: Student sessions use cryptographically signed, time-limited tokens (HMAC-SHA256) that expire automatically

Abuse Prevention

• Brute-force protection: After 5 failed access code attempts, the requesting IP address is temporarily locked out for 15 minutes
• Rate limiting: All endpoints are rate-limited to prevent automated abuse, with generous limits that accommodate classroom-scale usage (including school networks where many students share a single IP address)
• Input validation: All user inputs are sanitized and validated before processing to prevent injection attacks
• Prepared statements: All database queries use parameterized prepared statements to prevent SQL injection

⚖️ Legal Compliance

FERPA (Family Educational Rights and Privacy Act)

EDmazing Learning operates as a "school official" under FERPA when used as directed by a teacher or school district. We use student data solely for the educational purpose for which the activity was assigned. We do not disclose personally identifiable information (PII) to any third party except as necessary to generate the PDF report saved to the teacher's own storage. Our collection of only first names and last initials further minimizes PII exposure.

COPPA (Children's Online Privacy Protection Act)

EDmazing Learning is designed for use in school settings where the teacher or school acts as the consenting party on behalf of parents, consistent with FTC guidance. Our COPPA compliance measures include:

• Name minimization: We collect only the student's first name and the first letter of their last name. Our system technically enforces this — if a student attempts to enter their full last name, the system rejects the entry and prompts them to enter only the first letter.
• No student accounts: Students do not create accounts, usernames, or passwords
• No persistent identifiers: We do not use cookies, device fingerprints, or any tracking technology to identify students across sessions
• No commercial use: We do not collect data from children for any commercial purpose, advertising, or profiling
• Minimal data collection: We collect only the minimum data necessary for the educational activity
• Parental rights: Parents may request access to, correction of, or deletion of their child's data at any time

Texas HB 18 (Securing Children Online through Parental Empowerment Act)

EDmazing Learning aligns with Texas HB 18 requirements:

• We do not create student accounts or require login
• We do not collect data beyond what is necessary for the educational activity
• We do not use student data for advertising, marketing, or profiling
• We do not sell or share student data with third parties
• We support parental rights to access, review, and request deletion of their child's data
• We maintain this clear, publicly accessible privacy policy

SDPC National Data Privacy Agreement (NDPA)

EDmazing Learning is prepared to execute the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement v2 with any interested school district. Our minimal-data architecture makes compliance straightforward. Contact us to initiate the NDPA process for your district.

🔗 Third-Party Services

EDmazing Learning uses the following third-party services in the delivery of activities:

We do not use any advertising networks, analytics trackers, or social media pixels on student-facing activity pages.

🗑️ Data Retention & Deletion

On Our Servers

EDmazing Learning stores the following data on our servers:

• TEKS mastery scores: Aggregate correct/total counts per standard, linked to student first name + last initial, class period, and teacher. Retained for the school year or until the teacher or district requests deletion.
• Access codes: Teacher-generated codes are automatically deleted after their expiration date (typically 24-48 hours after creation).
• Teacher accounts: Teacher login credentials and Google Drive connection data. Retained until the teacher deactivates their account.

Individual student responses, written answers, and AI prompts are not stored on our servers. They are processed in real-time and discarded.

In the Student's Browser

Activity data (draft responses, session state) may be temporarily stored in the browser's sessionStorage to prevent data loss if the page is accidentally refreshed. This data:

• Is automatically deleted when the browser tab is closed
• Is not accessible by EDmazing Learning or any third party
• Is scoped to the single browser tab and cannot be read by other websites

In the Teacher's Google Drive

PDF reports stored in the teacher's Google Drive are subject to the teacher's and their school district's own data retention policies. Teachers may delete reports at any time. EDmazing Learning does not have access to these files after upload.

Requesting Deletion

Teachers, parents, or school districts may request deletion of any stored student data by contacting us at alisha@edmazinglearning.com. We will process deletion requests within 30 days. TEKS score data can also be deleted directly by the teacher from the teacher dashboard.

👨‍👩‍👧 Parent & District Rights

Parents, guardians, and school districts have the right to:

• Access: Request a copy of any data associated with their child (the PDF report from the teacher, and/or TEKS score data from the platform)
• Correction: Request corrections to any inaccurate information
• Deletion: Request that the teacher delete their child's PDF report from Google Drive and/or that EDmazing Learning delete TEKS score data from the platform database
• Information: Request details about what data is collected and how it is processed
• Opt-out: Request that their child not participate in EDmazing Learning activities

Since student reports are stored exclusively in the teacher's Google Drive and TEKS scores are linked only to first name + last initial, most data requests should be directed to the student's teacher or school first. EDmazing Learning will cooperate fully with any school or district data request.

🚨 Data Breach Notification

In the unlikely event of a data breach affecting student information, EDmazing Learning will:

1. Notify affected schools and districts within 72 hours of discovery
2. Provide a clear description of the nature and scope of the breach
3. Describe the steps taken to contain and remediate the breach
4. Cooperate fully with school, district, and regulatory investigations

Our security architecture — including name minimization (first name + initial only), encrypted credentials, rate limiting, brute-force protection, and CSRF tokens — is designed to minimize both the likelihood and the potential impact of any breach.

📝 Changes to This Policy

We may update this privacy page to reflect changes in our practices, features, or legal requirements. When we make material changes:

• We will update the "Last Updated" date at the top of this page
• We will notify schools and districts that have executed data agreements with us
• We will provide at least 30 days' notice before material changes take effect

📧 Contact Us

If you have questions about our privacy practices, need to execute an NDPA, or want to submit a data request, please contact us: