Certain of our Sites host our ST Math® instructional Software, which has been developed for use by students from pre-kindergarten through high school (“Student(s)”), for the improvement of math-related skills and achievement. Students are provided access to our Software and Sites through their schools and school districts (collectively, “Local Educational Agencies” or “LEAs”), who utilize these services to assess their Students’ progress and supplement their mathematics curriculum. Students may also be provided access to our Software and Sites through community-based organizations and similar nonprofit program providers (collectively, “Community-Based Organizations” or “CBOs”), which are responsible for obtaining any parental or legal guardian consent required by applicable law prior to a Student’s use of the Software. Homeschooled Students may also access versions of our Software that are licensed by their parent or legal guardian for homeschool use, per the terms of our Terms of Use for such Software. “Users” of our Sites include these Students; authorized representatives of the LEAs or CBOs, including the Students’ teachers or program staff (“LEA Representative(s)”); parents / legal guardians of the Students (“Parent(s)”); and other visitors to our websites and mobile applications (“Visitor(s)”).

We are engaged by LEAs to provide the services described herein to them and to their Student Users. To utilize the Software, LEA devices are activated, and students obtain user names and passwords in order to utilize the software. We receive one or more of the following types of information regarding each Student User either directly from their LEA, or through the Student’s use of the Software via their school / LEA (“Student Records”): the Student’s legal name; name of the Student’s teacher; name of the course in which the Software is used, if applicable; the Student’s grade in school; the school and school district; the Student’s user name and password (in text or and/or pictorial form); the Student’s identifier assigned by the LEA. Student Records may also include additional Student information owned, controlled by the LEA and provided to us in connection with research studies that we conduct at the applicable LEA’s discretion, including the Student’s ethnicity; free/reduced lunch status; English-learner status; special-needs status; date-of-birth; test scores / performance, separate from the Software. To the extent that we receive any of the foregoing as Student Records provided by or on behalf of an LEA, such Student Records shall remain owned and controlled by the LEA. We will not use or share any personal or sensitive information contained in Student Records for commercial purposes unrelated to the operation of the Sites or the services provided to the applicable LEA, Students, parents, or teachers, or for any other purposes other than those expressly described herein or the Terms of Use. We do not knowingly collect any personally identifying information regarding the Parents or other family members through the LEAs, except to the extent that such family members are themselves Students whose Student Records are provided via a LEA hereunder; for the avoidance of doubt, we may collect personally identifying information that is voluntarily provided by Visitors to our Sites, as described elsewhere under this Privacy Policy.

We may collect or generate certain information automatically from the Student’s use of the Sites, including login and logout timestamps. We may also collect and generate additional information about students through their use of the Software (“Student Performance Data”), including measurements / assessments of Student’s progress against the ST Math® curriculum (for example, Learning Objectives encountered, passes, fails); ST Math® quiz scores; and information derived and reports generated from the foregoing information and the Students’ use of the Software, for utilization by the Students, their parents / legal guardians, teachers, and the LEAs.

We may use Student Records for the following purposes:

• To monitor and generate Student Performance Data, and provide students, parents, and/or the students’ teachers or LEAs, with Student Performance Data;
• To operate our software and Sites, including personalizing / customizing content for the applicable Students, reviewing / analyzing Site performance; authenticating Students; maintaining the Sites; and protecting the security or integrity of the Sites. 
• We may also use aggregated or de-identified information about Students, from which we have removed personally identifying information, for educational research, analysis, and similar purposes.

For the avoidance of doubt, we will not utilize any personally identifiable information in Student Records for the purposes of targeted advertising.

We do not utilize Student Records for any purposes other than those set forth in this Privacy Policy or the Terms of Use. MIND collects, retains, and uses student personal information only to the extent necessary to provide the educational services described herein, and not beyond what is authorized by the applicable LEA or, in the homeschool context, the parent or legal guardian.

Additional information gathered by MIND Education via the Sites falls into the following categories: (1) information voluntarily supplied by Visitors through optional online forms completed by such Visitors of our Sites when requesting additional information about MIND Education or its products or services, or through Communications (as defined below) with MIND Education; (2) information automatically obtained from the use of User names and password to access the restricted portion(s) of the Sites (the “Restricted Pages”) to do things such as view online demonstrations or presentations about MIND Education or its products or services, including, by way of example, pages visited and timestamps; and (3) tracking information gathered as Visitors navigate through our websites or mobile applications.

MIND Education may provide Users with opportunities to contact us via e-mail, conventional mail, or other methods, with questions or comments you may have about our Site, products and services, personnel, employment opportunities, or any other matter of interest to you (“Communications”). These Communications may also include e-mail attachments or any materials that you would like to send us. Any Communications and materials attached thereto that you provide to MIND Education will be treated as non-confidential and non-proprietary. Please see our Terms of Use for additional information regarding how such Communications are treated.

In visiting or using our Site and in transmitting Communications with us, we may request and collect the following types of personally identifiable information from Visitors including: legal name; business name (if applicable); e-mail address; or user name and password. MIND Education may also ask for additional personal information from Visitors at various times such as when we run a promotion or contest or conduct a survey, as described in such promotion or contest or elsewhere on the Site. The personally identifying information we collect from Visitors helps us offer Visitors more personalized features, respond to Visitor requests, provide you with information that is of most interest to you, improve our products and services, and, to the extent that you consent to such communications, send you promotions and events offered by MIND Education.

When you visit the Site, our servers automatically collect information about your Internet address (which is a number that lets computers attached to the Internet know where to send you data). Your Internet address does not identify you personally. We log your Internet address to deliver our web pages to you upon request, help diagnose problems with our servers, administer our Site in order to constantly improve its quality and the services we offer you, and identify and authenticate you and your licensed content and preferences as you navigate the Site. We may also use your Internet address to gather broad demographic information. We may also track and analyze non-identifying and aggregate usage and volume statistical information from our Visitors and other Users and provide such information to third parties.

MIND Education researches our customers’ and Visitors’ demographics based upon information provided by them or, their LEAs (if applicable), gathered from their Communications or password, or contained in our server log files or surveys. We do this to better understand and serve our customers and other Visitors. This research is compiled and analyzed on an aggregated basis.

MIND Education does not provide, sell, trade, or rent personally identifiable information. We may disclose or share personally identifying information as follows:

To our service providers.

We may share personally identifying information collected through the Site or otherwise in our possession with companies and organizations that perform services on our behalf, for example, companies that provide data management or other support services to us (such as data storage and Web hosting services), subject to confidentiality and security obligations. We require all service providers acting as our data processors to: – Use the information solely to provide services for MIND Education; – Maintain industry-standard security protections; – Comply with applicable student privacy laws (FERPA, COPPA, SOPPA, etc.). Service providers that access or process Student Records do so only for legitimate educational purposes and under the direction of the applicable LEA, consistent with FERPA’s school official exception.

A list of categories of third-party service providers (e.g., cloud hosting, analytics to monitor system performance, customer support tools) is available upon request.

For compliance with law.

We may disclose personally identifying information to comply with applicable law, including requests from a governmental agency, court of law, regulation, or civil service process. MIND Education also reserves the right to use or disclose any information as needed to fulfill your requests or to cooperate in any law enforcement investigation or an investigation on a matter of public safety, or the safety of our users or customers; to enforce the Terms of Use or this Privacy Policy; to protect the integrity of the Sites and our services; to protect our rights or those of our Users, customers, contractors, or licensors; to investigate, prevent, or take action regarding illegal activities, fraud; to take precautions against liability; to provide evidence in litigation or dispute; or to respond to an emergency. In responding to court orders, subpoenas, or other legal process that may require disclosure of Student Records, MIND will make reasonable efforts to notify the applicable LEA prior to disclosure unless prohibited by law or court order.

To parents/legal guardians.

We may provide Student Records or Student Performance Data to the Students’ Parents or legal guardians when directed to do so by the applicable LEA, or as otherwise required by applicable law. Because Student Records are owned and controlled by the LEA, parents or legal guardians seeking access to their child’s Student Records should contact their child’s school or school district directly. MIND will cooperate with any LEA-directed instruction to package requested individual Student Records and Student Performance Data in a legible format and securely transmit to the LEA in a timely manner. The LEA, as the custodian of those records, is responsible for legal guardian authorization in the course of responding to FERPA inspection and amendment requests.

To teachers / LEAs.

We may provide Student Records and corresponding Student Performance Data to the teachers or other authorized LEA representatives for the applicable Students.

In a business transfer.

We may transfer personal information and other data in our possession in connection with an acquisition by or merger with another company, if substantially all of our assets are transferred to another company, or as part of a bankruptcy proceeding. In any such transaction, the acquiring entity will be contractually required to honor this Privacy Policy with respect to Student Records and other student data, and will be prohibited from using such data for purposes inconsistent with the educational purposes for which it was collected. MIND will notify affected LEAs of any such transfer. If the acquiring entity cannot or will not honor these obligations, MIND will provide affected LEAs the opportunity to request deletion of their Student Records prior to the transfer.

Reviewing and updating Student Records.

Student Records provided by an LEA (FERPA). Student Records that MIND receives from an LEA are owned and controlled by that LEA. Under the Family Educational Rights and Privacy Act (FERPA), parents and eligible students (age 18 or older) have the right to inspect, review, and request correction of education records held by the LEA. To exercise these rights, please contact your child’s school or school district directly. MIND will cooperate with any LEA-directed instruction to access, correct, or delete Student Records in MIND’s possession.

MIND will delete Student Records received from an LEA upon written instruction from that LEA, including in connection with the termination of MIND’s services to that LEA. Requests from parents to delete LEA-provided Student Records must be submitted to the LEA; MIND will act upon the LEA’s written instruction. This deletion obligation applies to all student data in MIND’s possession relating to the applicable LEA, including Student Performance Data generated by MIND through the student’s use of the Software.

Data collected directly by MIND from children under 13 (COPPA). This section applies only to personally identifiable information that MIND collects directly from a child, and not to Student Records or other information provided to MIND by or on behalf of a school, district, or other Local Educational Agency (LEA).

For personally identifiable information that MIND collects directly from a child under the age of 13 through the child’s use of the Software—such as usage logs and Student Performance Data not received from an LEA—parents and legal guardians may contact MIND at privacy@mindeducation.org to exercise their rights under applicable law. MIND will take reasonable steps to verify that the requester is the child’s parent or legal guardian before responding to the request.

Parents or legal guardians of homeschool students may also contact MIND at privacy@mindeducation.org to exercise their rights under applicable law with respect to their child’s information.

Requests relating to Student Records or other information maintained by MIND on behalf of an LEA should be directed to the applicable LEA, which is responsible for determining how such requests are handled in accordance with applicable law and its agreement with MIND.

If MIND deletes information that is necessary to provide the requested services, and where applicable such deletion is authorized or directed by the applicable LEA, certain features or functionality of the Sites or Software may no longer be available to the applicable user.

Our Site has security measures in place to minimize the risk of loss, misuse, and alteration of the information under our control. Your access to the Restricted Pages or other accounts (if you have any) established through MIND Education or the Site is password-protected so that only you have access to that personal information, so keep your password private and secure.

We provide and require training of all of our personnel involved in the handling, usage, or storage of Student Records or other personally identifying information, which training is renewed periodically. This training includes compliance with relevant federal and state legal requirements, including, as a non-limiting example, the federal Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g) (“FERPA”), the Children’s Online Privacy Protection Act (15 U.S.C. Secs. 6501 – 6506) (“COPPA”), and the Student Online Personal Protection Act (105 ILCS 85) (“SOPPA”). To protect our information technology environment and the data that we store, MIND Education employs industry-standard safeguards to protect data, implemented with a multi-tier software architecture, that are consistent with standards generally recognized in the industry, including:

• Encryption of personal information both in transit (TLS 1.3 or higher) and at rest (AES-256 or stronger);
• Role-based access controls and authentication, including multi-factor authentication for administrative systems;
• Continuous monitoring and logging of systems handling personal data;
• Regular access reviews and security testing by internal and third party entities.

These protections are in addition to the training and compliance measures already described.

Please be aware, however, that despite our efforts, no security measures are perfect or impenetrable. Due to the open nature of the Internet, we cannot guarantee that any of your information stored on our servers, or transmitted to or from a user, will be 100% free from unauthorized access, and we disclaim any liability for any theft or loss of, unauthorized access or damage to, or interception of any data or communications. By using the Site, you acknowledge that you understand and agree to assume these risks.

MIND Education requires its employees and agents who access or utilize Student Records or any other personally identifying information of students or of their families to abide by the terms of this Privacy Policy. MIND Education also contractually requires any of its subcontractors or vendors who are accessing or utilizing such data on its behalf to comply with the requirements of this Privacy Policy pertaining to the use and access of such data.

MIND Education’s infrastructure is hosted within the United States. We design and implement our systems to provide resiliency against server, segment, and geographic failure, through the implementation of a clustered redundant architecture that yields highly available service endpoints. We utilize service providers whose systems have been certified for compliance with security standards including ISO 27001. We cannot, however, guarantee that systems will never be subject to a security breach, or will be otherwise error-free. Additional information regarding our system availability and security guarantee practices is provided below, and for additional questions, please reach us at privacy@mindeducation.org.

Unauthorized access of User data is a real risk facing the users of today’s electronic information services. MIND Education strives to keep informed of these risks, and we work diligently to combat them. One method of protecting User data is to utilize cryptography to prevent data visibility in the event of its unauthorized access. MIND Education leverages cryptography to protect user data in the following two ways:

Data in Transit.

Our services support Transport Layer Security (“TLS”) to encrypt User communications (TLS 1.2 or greater and only the strongest ciphers). Data transferred between our Site and its end Users (including credential submission, data uploads, and data downloads) are sent over TLS connections, which protect such data using strong encryption, so that data in transit is kept in a private channel between the intended User and our systems.

Data at Rest.

User data that contains personally identifying information, when “at-rest” (i.e., when in storage) is encrypted using industry standard AES-256. There are two types of “at rest” storage:

• Database. Database server disk storage is “volume” encrypted (i.e., encrypted at the level of the database).
• User Files. User files are individually encrypted before being recorded on long-term, secondary storage systems.

Personally identifiable information received from a LEA is de-identified or deleted within 60 days after the relationship between MIND Education and the LEA has been terminated, or sooner if instructed in writing by the LEA. Personally identifiable information that is voluntarily submitted by a Visitor pursuant to this Privacy Policy may be retained by MIND Education for the purposes described for Visitor data herein, provided that such information may be reviewed, updated or corrected as provided under the applicable sections of this Privacy Policy.

If you correspond with us by e-mail, or using the “contact us” feature on the Site, you should be aware that your transmission might not be secure. We will have no liability for disclosure of your information due to errors or unauthorized acts of third parties during or after transmission. If MIND believes that the security of User information may have been compromised, MIND will notify affected LEAs without unreasonable delay and in accordance with applicable federal and state breach notification laws. MIND will provide reasonable cooperation to enable affected LEAs to notify impacted parents, legal guardians, and Students as required by law. Where MIND has directly collected information from Visitors or other Users, MIND will notify affected individuals directly as soon as reasonably practicable and in accordance with the timeframes required by applicable state breach notification laws. You consent to our use of your e-mail address as a means of such notification. Please notify us of any unauthorized use of your password or account or any other breach of security of which you are aware.

“Cookies” are pieces of information that a web site transfers to your computer’s hard drive for record-keeping purposes. Like many sites on the Internet, we use cookies to identify you when you visit the Site. Most web browsers automatically accept cookies, but if you prefer, you can set your computer to not accept cookies. If you do this, however, you may not be able to use some of the features or services we offer on our Site.

MIND Education may use the information it collects to respond to requests for information, to notify you about functionality changes to the web site, or to provide industry and company updates. You may update or modify your information or change your privacy preferences (such as whether you wish to receive promotional offers) at any time by emailing us at privacy@mindeducation.org. If you wish to have your name removed from any of our mailing or subscription lists, please write to us at our above address or click the “remove subscription” link set forth in the relevant communication (typically provided at the end of such communication). Opt-out requests will be honored within 10 business days of receipt, after which you will not receive further communications from which you have opted out.

MIND Education Site may contain links to other web sites. MIND Education is not responsible for the privacy practices or the content of such third party sites. Use of information on third party sites is governed by the privacy policy of the operator of the site you are visiting. That policy may differ from ours. MIND Education has no control over such third party sites, and the existence of a link from our Site is not meant to imply any endorsement of these other third party web sites.

In some cases, third parties may be able to collect information about a user’s online activities over time and across different websites when he or she uses our Site or services. Some web browsers may transmit “do-not-track” signals to the websites with which the user communicates. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they even are aware of them. Because there currently is no industry standard concerning what, if anything, websites should do when they receive such signals, we currently do not take action in response to these signals.

Because MIND Education is headquartered within the United States, any personally identifiable information (PII) shared with us by international customers for the purpose of creation and ongoing use of ST Math accounts shall be stored on our servers. Our secure servers, hosted by Amazon Web Services (AWS), are located within North America. By partnering with MIND Education and using ST Math, you acknowledge and accept this nature of our business.

By using the Site provided by MIND Education, you expressly consent to the collection, use, and disclosure of information as described in this Privacy Policy.

If you are a teacher, school administrator, district administrator, or a parent/legal guardian of a homeschool student, you acknowledge that you have the authority to accept this Privacy Policy on behalf of the students under your supervision. By registering for and using the Site on their behalf, you confirm your consent to this Privacy Policy and agree to ensure compliance with all applicable privacy laws and district policies. Parents, legal guardians, and LEA Representatives are required to affirmatively accept this Privacy Policy upon first login and upon any material change to the policy before accessing the Site or Software.

This Privacy Policy applies to all of MIND Education’s software products and services, including ST Math® and related products, whether accessed via web browser, mobile application, or any other platform.

MIND Education
5281 California Avenue, Suite 300
Irvine, CA 92617
Tel: (949) 345-8700
Toll Free: (888) 751-5443
Fax: (949) 572-2680
Email: privacy@mindeducation.org