Student data privacy

Schools and districts can license Classroom under the Student Data Privacy Consortium National Data Privacy Agreement (NDPA), including a General Offer of Terms so other districts in your state can adopt the same signed agreement.

Our commitments

• No targeted advertising, no profiling, no sale of student data (NDPA §4.7).
• Data minimization: student id, name, class and practice work only — no demographics, no email required.
• Deletion or return of all student data within 60 days of a request or the end of the agreement (§4.6).
• Breach notification to the school within 72 hours (§5.4).
• Subprocessors bound by contract not to use or sell student data (§2.3). Current subprocessors: DigitalOcean (hosting, USA), Anthropic (AI grading, USA; no training on your data), Postmark (teacher email only).
• Annual security review; TLS everywhere; audit log of every access to student records.

To start: email classroom@ratemyspanish.com with your district's NDPA exhibit and we'll return a signed copy.