Student data agreement
Between a school or district and WealthyHabitat.com, for the youth unit. It is written so that a parent can read it, and every promise in it is one the site's code keeps. It is offered as a draft for the district's counsel to mark up; the signed copy governs.
1. Who and what
The school or district named on the signature page (the School) and WealthyHabitat.com (the Provider) agree to these terms for the Provider's youth financial education unit (the Unit), delivered through wealthyhabitat.com to students the School enrolls through a class roster.
2. What the Provider collects about a student
A display name the teacher types, which may be a first name or an initial. A parent's or guardian's name, only if the School chooses to enter one. A username and a code the Provider generates, stored as a one way hash. Which of the six lessons the student finished and whether each arithmetic check passed and on which try. The student's five question score before and after the Unit. The outcome of the practice game and the My goal game. The date of the student's last visit. Nothing else.
3. What the Provider never collects about a student
No email address, phone number, photo, date of birth, home address, or location. No account is created and no password is set. No real financial figure: every number a student types in the Unit is a practice number, and the page says so. No behavioral or advertising profile. No cookie other than the one that keeps the student in class mode for the session.
4. Why it is collected and how it is used
Only to run the Unit and to show the teacher each student's progress and scores. The Provider does not sell student data, does not use it for advertising, does not use it to build a profile for any purpose other than showing the teacher the student's progress, and does not use it to train any model.
5. The School's consent and the law
The School represents that it is authorized to enroll its students and that it has given whatever notice or obtained whatever consent its policies require. The Provider treats every student on a roster as a child under the Children's Online Privacy Protection Act regardless of age, and relies on the School's consent as that law allows for classroom use. Where the School shares a roster, the Provider acts as the School's service provider under the Family Educational Rights and Privacy Act, performs a service the School would otherwise perform itself, is under the School's direct control as to the use of that data, and uses it for nothing else. Where a state student privacy law applies to the School, the Provider will meet its requirements, and the School will name that law on the signature page.
6. Who may see it
The teacher who made the class sees the roster, progress, and scores. The School's administrators see what the teacher sees, if the School asks for a school wide view. The Provider's operator can reach the data only to run the service, fix a fault, or answer a request from the School. No one else. The Provider's hosting providers (the database host, the web host) process the data under their own contractual duties of confidentiality and security and may not use it for their own purposes. No student data is sent to any model provider.
7. Security
Data moves over encrypted connections and is stored in a database with row level access control. Codes are stored as hashes. Keys that can reach the database are held on the server and never in a browser. If a breach affects student data, the Provider will notify the School without unreasonable delay and within the time the School's state requires, and will cooperate with the School's notice to parents.
8. Access, correction, and deletion
A parent or eligible student may ask the School to see what is held about the student, to correct it, or to delete it, and the School may pass that request to the Provider, who will act on it within ten days. A teacher may remove a student at any time from the teacher page. The School may ask the Provider to delete a class, a school's data, or the district's data in writing, and the Provider will delete it within thirty days and confirm in writing. At the end of the term of this agreement, the Provider deletes the School's student data within sixty days unless the School asks in writing for it sooner or for a copy first.
9. Changes
The Provider will not change what it collects or how it uses student data without written notice to the School at least thirty days in advance, and the School may end this agreement during that period.
10. Term and ending
This agreement runs for the school year named on the signature page and renews only if the School renews the Unit. Either side may end it on thirty days' written notice. Ending it triggers the deletion in section 8.
11. Fees
The price of the Unit is on the Schools page and on the School's invoice. There is no other charge, and no student is ever charged anything.
12. Nothing is advice
The Unit teaches how money works. It never tells a student what to do with money, never recommends a product, an account, or a fund, and carries no sponsor. The Provider's No Advice Disclosure applies.
Signature page
School or district name, address, and the state student privacy law that applies, if any. School year. Number of classes. Name, title, and signature for the School. For the Provider: WealthyHabitat.com, admin@wealthyhabitat.com, signature and date.
To sign, write to admin@wealthyhabitat.com with the School's name and the school year, and a countersigned copy comes back. Counsel's changes are welcome and are read as they come. The Privacy Notice and Terms apply to everyone who uses the site; where this agreement is stricter, it governs for the School's students.