School Student Data Agreement

1. Parties and authority

The provider is YinYang Interactive LLC, operator of Number Ninjas. “School” means the school or district identified through the authorized representative’s Number Ninjas onboarding or account, unless a separately executed agreement identifies it differently. A person accepting electronically for a School represents that they have authority to do so, and that acceptance binds that School.

2. Scope and educational purpose

Number Ninjas may process student information only for roster import; student authentication and account matching; math gameplay; assignments; diagnostics; progress and mastery; teacher reporting; teacher-directed Google Classroom coursework; and the security, support, operation, maintenance, and improvement necessary to provide the authorized educational service.

3. COPPA

Number Ninjas remains responsible for its own COPPA obligations. Consistent with FTC guidance, a school may act as the parent’s agent for consent when student information is collected solely for the school’s educational benefit and for no other commercial purpose. School authorization is limited to that educational use. Number Ninjas will not use school-authorized student information for unrelated commercial purposes, and this Agreement does not transfer Number Ninjas’ COPPA obligations to the school.

4. FERPA school-official framework

Where the school chooses to rely on FERPA’s school-official exception, the parties intend that Number Ninjas: performs an institutional service or function for which the school would otherwise use employees or contractors; has a legitimate educational interest in relevant records solely to provide the authorized service; is under the school’s direct control regarding the use and maintenance of education records; uses personally identifiable information from education records only for the purposes for which the school disclosed it; and does not redisclose that information except as permitted by this Agreement, the school’s written direction, or applicable law. Where applicable, Number Ninjas must also meet the criteria specified in the School’s annual FERPA notice for being a school official with a legitimate educational interest. This clause does not represent that every school relies on that exception or that FERPA regulates Number Ninjas in exactly the same manner as a federally funded school.

5. Ownership and limited rights

The school and student retain applicable rights in education records and student-provided information. Number Ninjas receives only the limited rights necessary to provide, secure, support, maintain, and improve the authorized educational service under this Agreement and the Privacy Policy.

6. Advertising and commercial restrictions

Number Ninjas will not sell student information; use it for behavioral advertising or targeted advertising based on student data; market to students based on education records; provide it to data brokers; use it for unrelated profiling or unrelated product development; or train general-purpose AI or machine-learning models with identifiable student information. Appropriately de-identified aggregates may be used for service analysis only where they cannot reasonably identify a student.

7. Security

Number Ninjas will maintain reasonable administrative, technical, and organizational safeguards appropriate to student information, including access controls, HTTPS, encrypted teacher OAuth tokens, server-side authorization, least-privilege practices, retention and deletion controls, network firewall controls that restrict unauthorized infrastructure access, and appropriate provider safeguards. We maintain internal security and incident-response procedures without publishing security-sensitive implementation details.

8. Service providers and subprocessors

Number Ninjas may use providers necessary to operate the service. We will evaluate providers handling child or student information, obtain appropriate written contractual assurances, require reasonable confidentiality, security, and integrity safeguards, and restrict processing to authorized purposes. The current list is maintained in the Privacy Policy’s Service Providers section. It identifies DigitalOcean-hosted infrastructure, PostgreSQL, Redis, local logging, backups, and Google services; no other child-data provider is currently listed.

9. School review, access, and export

On a verified request, Number Ninjas will provide the school with the categories of information held, processing purposes, applicable retention dates, access to applicable student/course records, and an export where reasonably available. The school may request correction of inaccurate information.

10. Parent and student requests

Number Ninjas will reasonably assist the school with applicable parent or student education-record and privacy requests. Parents may also contact privacy@yinyang-interactive.com directly for COPPA-related access, correction, deletion, withdrawal, or stop-collection requests. We may verify identity and authority and coordinate school-managed records with the school.

11. Deletion and stopping collection

The school may request individual student, class/course, or school-wide deletion and termination of future collection. Applicable active-system records are targeted for deletion within 24 hours, including profiles, memberships, gameplay, answers, progress, mastery, rewards, character state, diagnostics, Number Ninjas assignments, cache, and reasonably linkable derived records. A stopped or deleted student is suppressed from routine roster recreation unless fresh valid authorization permits renewed collection. Backup copies expire within 35 days and are reconciled against deletion and suppression records if restored. Google Classroom posts remain in Google and are controlled and deleted there by the teacher or school.

12. Retention

The Privacy Policy’s retention schedule applies: student gameplay is retained 13 months after collection, diagnostics 25 months after collection, inactive classroom relationships 90 days after becoming inactive, operational/security logs up to 30 days, active Redis game state up to four hours, and backups up to 35 days. The 90-day deadline applies to records associated solely with that inactive classroom; records needed for another active, authorized classroom relationship remain under that relationship’s schedule. Number Ninjas will not retain children’s personal information indefinitely. Non-identifying aggregates may be kept longer only if they cannot reasonably be linked to a student or user.

13. Security incidents

Number Ninjas will notify the school without unreasonable delay following discovery of a security incident involving the school’s student information, and within any shorter period required by applicable law or an applicable school or district addendum. To the extent known and legally permitted, notice will reasonably describe the nature of the incident, categories of affected information, mitigation actions, and relevant next steps.

14. Termination

When authorization is withdrawn, the school stops using Number Ninjas, or this Agreement ends, Number Ninjas will stop new collection under that authorization, revoke or inactivate affected relationships, apply the retention/deletion schedule, suppress stopped or deleted students from routine recreation, and remove encrypted teacher OAuth tokens when the teacher account is deleted while attempting Google token revocation. Published Google Classroom posts remain under teacher or school control in Google.

15. State and district addenda

Where applicable law or a mutually executed state, district, or student-data privacy addendum imposes additional requirements, that addendum controls to the extent of a conflict.

16. Contact