1. Introduction

Welcome to Kudos4Kids LLC ("we," "our," or "us"). We are committed to protecting the privacy and security of students, parents, educators, and school administrators who use our house point and student recognition platform (the "Service").

This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our Service. We comply with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and other applicable privacy laws.

2. Information We Collect

2.1 Student Information (Collected by Schools)

We collect student information on behalf of and at the direction of schools. This may include:

• Personal Information: Name, student ID, grade level, date of birth
• Academic Information: House assignment, points earned, recognition awards, achievement badges
• Behavioral Data: Positive behavior recognitions, reasons for points awarded
• Account Information: Username, profile picture (optional)

2.2 Staff Information

For educators and administrators, we collect:

• Personal Information: Name, email address, staff ID
• Account Information: Username, password (encrypted), role/permissions
• Authentication Data: SSO tokens from Google or Microsoft (if using single sign-on)
• Activity Data: Points awarded, recognitions given, login history

2.3 School/Organization Information

• School name, district, address
• School configuration settings
• Custom reward items and pricing
• House names, colors, and point values

2.4 Usage and Technical Information

We automatically collect certain technical information:

• Device Information: Device type, operating system, browser type
• Log Data: IP address, access times, pages viewed, actions taken
• Cookies and Similar Technologies: Session cookies for authentication
• Performance Data: System usage patterns, feature utilization

3. How We Use Information

3.1 Educational Purposes

We use collected information to:

• Provide the Service: Enable house point tracking, reward redemption, and leaderboards
• Student Recognition: Award points, badges, and kudos coins for positive behaviors
• Analytics and Reporting: Generate insights on student engagement, at-risk student identification, and 12-week trend analysis
• School Administration: Support staff management, OneRoster synchronization, and system configuration

3.2 Service Improvement

• Improve platform features and user experience
• Troubleshoot technical issues
• Analyze usage patterns to enhance functionality
• Develop new features based on user needs

4. Information Sharing and Disclosure

4.1 We Do NOT Sell Student Data

4.2 Sharing Within Schools

• Student data is visible to authorized staff members within the student's school
• Students can view their own points, achievements, and purchase history

4.3 Service Providers

We may share information with trusted third-party service providers who assist us in operating the Service:

• Cloud Hosting Providers: For secure data storage and platform hosting
• Authentication Services: Google and Microsoft for SSO integration
• Payment Processors: For processing school subscriptions (not student purchases)
• Analytics Tools: For platform performance monitoring (aggregate data only)

All service providers are contractually obligated to protect data and use it only for specified purposes.

5. Data Security

5.1 Security Measures

We implement industry-standard security measures to protect your information:

• Encryption: Data encrypted in transit (HTTPS/TLS) and at rest
• Access Controls: Role-based permissions, multi-factor authentication for administrators
• Secure Authentication: Password hashing, SSO integration with Google/Microsoft
• Regular Security Audits: Vulnerability assessments and penetration testing
• Backup and Recovery: Regular automated backups with disaster recovery procedures
• Employee Training: Staff trained on data protection and privacy practices

5.2 Data Breach Notification

In the event of a data breach involving personal information, we will:

• Notify affected schools within 72 hours
• Provide details about the breach and our response
• Comply with all applicable data breach notification laws

6. Data Retention and Deletion

6.1 Retention Period

We retain data only as long as necessary for educational purposes and legal compliance:

• Active School Accounts: Data retained while school subscription is active
• Inactive Accounts: Data retained for 90 days after subscription ends, then deleted
• Legal Holds: Data may be retained longer if required by law

6.2 Data Deletion Requests

Schools can request deletion of data at any time:

• Student Deletion: Schools can remove individual student records
• Bulk Deletion: Export and delete all school data upon request
• Automated Deletion: Data automatically deleted 90 days after account closure

7. FERPA Compliance

7.1 School Official Exception

Kudos4Kids operates under the "School Official Exception" under FERPA (20 U.S.C. § 1232g):

• We perform an institutional service on behalf of the school
• We use student data only for authorized educational purposes
• We are subject to direct control of the school regarding data use
• We comply with FERPA's requirements for protection and re-disclosure

7.2 Parent Rights

Under FERPA, parents have the right to inspect and review their child's educational records, request corrections, and consent to disclosures of personally identifiable information. Contact your school administrator for assistance. No parent portal is currently available.

8. COPPA Compliance

8.1 Collection from Children Under 13

We comply with the Children's Online Privacy Protection Act (COPPA):

• No Direct Collection: We do not knowingly collect personal information directly from children under 13
• School Authorization: Schools provide student data and act as the agent for parents
• Parental Consent: Schools obtain necessary parental consent before providing student data
• Limited Use: Student data is used only for educational purposes authorized by the school

8.2 Parent Rights Under COPPA

Parents have the right to review and request deletion of their child's information, and to refuse further collection or use of their child's information. To exercise these rights, contact your child's school administrator. No parent portal is currently available.

9. Student Privacy Pledge

10. Your Rights and Choices

10.1 Access and Correction

• Students/Parents: Access and correct information by contacting the school administrator. No parent portal is currently available.
• Staff: Update your profile information in account settings
• Schools: Manage all data through the command center

10.2 Data Portability

Schools can export all data in standard formats (CSV, JSON) at any time.

10.3 Account Deletion

• Staff Accounts: Can be deactivated by school administrators
• Student Records: Can be removed by school administrators
• School Accounts: Contact support to close account and delete all data

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect:

• Changes to our practices
• Legal or regulatory requirements
• New features or services

By using Kudos4Kids, you acknowledge that you have read, understood, and agree to this Privacy Policy.