Privacy
Effective October 2026. RateMySpanish Classroom ("Classroom") is a practice tool for Spanish classes. This page says plainly what we collect and why.
What we collect
- Teachers: name, school email, password (hashed), the classes and modules you create.
- Students: a display name chosen when joining, the class, and each practice attempt (the English sentence, the Spanish written, and the tutor's rating and correction). When a school connects through its LMS or Clever, we also receive the identifier that system assigns, and the name on the roster. We never require a student email.
- Technical: server logs with IP addresses, kept for 30 days for security and debugging. No analytics trackers, no advertising, no third-party scripts.
How we use it
Only to run the service: to grade attempts, show teachers their students' work, and keep the lights on. Student writing is sent to our AI tutor (Anthropic's Claude API) to be graded and is never used to train any model. We do not sell data, show ads, build profiles, or share student data with anyone except the processors that host the service, under contract.
Who can see student work
The student, their teacher(s), school administrators the school designates, and RateMySpanish staff when needed for support. Every teacher or administrator view of a student's record is logged.
Retention and deletion
Practice attempts are deleted after 365 days by default (schools can choose a shorter window). A teacher can remove a student at any time, which deletes that student's attempts. Schools can request deletion of everything we hold for them; we complete it within 30 days and confirm in writing.
Children's privacy (COPPA) and FERPA
We act as a school official under FERPA at the direction of the school, which may consent on parents' behalf under COPPA for this educational use. We collect only what the service needs, and we sign the Student Data Privacy Consortium's National Data Privacy Agreement on request. Questions or requests: privacy@ratemyspanish.com.
Security
Everything travels over TLS; passwords are hashed with Argon2; access to production is limited to named staff with keys. If we ever learn of a breach affecting a school's data we notify that school within 72 hours.