COPPA Compliance ; "School as Agent" Framework

The federal Children's Online Privacy Protection Act (COPPA) requires services collecting personal information from children under 13 to obtain verifiable parental consent. WiseBoard does not collect data directly from children. Instead, the school creates classes, adds student names, and acts as the parent's agent for the limited purpose of authorizing WiseBoard to process the minimum information needed to deliver the educational service.

This is the FTC-sanctioned "school as agent" framework, formally described in the FTC's COPPA: A Six-Step Compliance Plan (Step 4) and the Complying with COPPA: FAQs (Section N).

• First name + last initial (or full name if the teacher chooses)
• Class identifier and grade level
• Pip's Arcade gameplay metrics (points, badges, streaks, accuracy)
• Pip's Study Hall AI tutoring transcripts (30-day rolling deletion)
• SEL check-in responses (emoji + optional one-line text)
• Behavior tracker entries entered by the teacher
• Grade and assignment scores entered by the teacher

What we do NOT collect from students under 13: precise geolocation, persistent advertising identifiers, photos or videos uploaded by the student, social-network connections, email addresses, voice recordings, or behavioral / advertising profiles.

1. The data collection is for a school-authorized educational purpose.
2. The data is not used for any commercial purpose unrelated to the educational service.
3. The school has provided parents with direct notice of what's collected and why.
4. The school has reviewed and approved WiseBoard's privacy practices before student use.
5. WiseBoard provides access and deletion rights at the school's request.
6. WiseBoard does not condition access on collecting more data than necessary.

If any of these is false, the framework collapses and the school must obtain direct verifiable parental consent for every child. This is a contract violation under our DPA and can result in service suspension.

Parents of children under 13 may, at any time, contact the school (their child's WiseBoard data controller) OR contact WiseBoard directly at info@mywiseboardclassroom.com to:

• Review all personal information we have about their child.
• Refuse to permit further collection or use.
• Request deletion of their child's information (we honor within 30 days; the school can also self-serve immediate deletion).

When a parent contacts WiseBoard directly, we verify the request with the school of record before fulfilling it.

Reviewed annually OR on any FTC enforcement action against a peer EdTech vendor that materially clarifies the framework. The 2025 amendments to the COPPA Rule (effective 2026-06-23 ; biometric data, persistent identifiers, push notifications) will be incorporated before the effective date.