Student privacy commitments

What we collect from a school account

Name, school email address, the class or section the student belongs to, and what the student does inside the program: lessons opened, practice answers, scores, skill ratings, points, attendance a teacher records, and a self-reported exam date. The complete inventory is on the data and retention page.

We do not collect date of birth, demographics, home address, phone numbers, parent contact details, grades, disciplinary records, or special-program indicators. School accounts never see pricing or checkout, so we hold no payment information for them.

What we never do

• No targeted advertising to students, on our product or anywhere else, and no advertising or analytics tag loads for a school account.
• No profile of a student for any purpose other than the school's educational purpose.
• No sale, rental, or trade of student information. Ever.
• No sharing with a third party except the subprocessors that run the service, each under a written agreement, and each listed publicly.
• No student data to AI assistants or AI models. Our Claude and ChatGPT connector is disabled for school accounts.
• No marketing or lifecycle email to school accounts. They receive transactional messages only.
• No use of student data to build or improve products for anyone other than the school, and only in de-identified form if at all.

Roles under FERPA and COPPA

Under FERPA we act as a school official with a legitimate educational interest, under the direct control of the school, using education records only for the purpose the school authorizes and never re-disclosing them. Under COPPA the school provides consent on behalf of students under 13 for school accounts, and we collect no more than the service needs. Parents and eligible students exercise their rights through the school; we fulfill the school's instructions within 3 calendar days.

Florida

Florida Statutes section 1006.1494 and section 1002.22 govern operators of school-facing technology. We comply with each requirement: no targeted advertising, no non-educational profiling, no sale or disclosure, data minimization, reasonable security practices, and deletion of covered information when the program ends or within 90 days after a student leaves on district notice. District terms of service and privacy policy review under Rule 6A-1.09550 is welcome; this trust center is built to make that review quick.

Deletion, return, and requests

• Access or correction: a school requests a student's data at security@classictestprep.com and receives a complete export within 3 calendar days.
• A student leaves: on district notice we erase the student's account within 90 days (in practice, within days).
• Agreement ends: all student data for the district is erased within 60 days, and the district receives a written certification of destruction listing every account.
• Individual accounts: a person can delete their own account at any time; erasure runs immediately and completes within 30 days including backups.

If something goes wrong

We maintain an incident response plan. If we confirm unauthorized access to student data we notify the affected district without unreasonable delay and in every case within the period the agreement and Florida law require, with what happened, which data and students were affected, what we did about it, and a named contact. We cooperate fully with the district's own notification duties and bear the costs that our agreement assigns to us.