Last Updated: December 27, 2023

1. Introduction

Wordpath, Inc ("we," "our," or "us") operates the website Wordpath.com ("Service"). This Privacy Policy informs users about our practices regarding the collection, use, and disclosure of personal data when you use our Service, focusing on educational purposes and safeguarding user data.

2. What Information We Collect

Teachers and Students:

• Keystroke Data: Collected for educational review purposes only.

• Writing Data: Analyzed by an AI assistant for educational insights.

Via Google Classroom:

• Teachers and Students: Limited personal identification data.

3. Use and Disclosure of Information

• Strictly for Educational Purposes: Data is used to enhance the educational process.

• No Commercial Use: We do not sell, use, or disclose covered PII for marketing, advertising, or other commercial purposes.

4. Data Protection and Security

• Compliance with NIST Framework: Our security measures, including encryption, firewalls, and password protection, align with the NIST Cybersecurity Framework.

• Limited Access: Access to PII is restricted to necessary personnel only.

• Encryption Standards: All data, both in transit and at rest, is encrypted as per US Department of Health and Human Services standards.

• Staff Training: Regular training on laws, policies, and best practices in data security.

5. Data Retention and Deletion

• Limited Retention: PII is not kept beyond its educational purpose.

• Secure Deletion: Data is permanently and securely deleted when no longer needed.

6. Third-Party Responsibilities

• Encryption Requirement: Third parties must protect PII with encryption.

• Data Deletion: Third parties must delete PII securely at contract termination.

7. Parental and Student Rights (Applicable to All Educational Institutions)

General Rights:

• Right to Notification: Parents and eligible students have the right to be notified in the event of a breach or unauthorized release of PII.

• Right to Complaints: Procedures are in place for lodging complaints about potential breaches or unauthorized disclosures of PII, ensuring timely and appropriate responses.

Specific Rights in Educational Context:

• Inspection of Records: Parents of minors, and eligible students, have the right to inspect and review their or their child’s complete education records. Requests will be addressed within a reasonable timeframe, not exceeding 45 days from the receipt and verification of the request.

• Request for Record Amendments: If records are believed to be inaccurate, misleading, or violating privacy, there is a right to request changes or amendments.

Data Handling in Educational Environments:

• Contractual Obligations: Our handling of PII adheres to the specific requirements of contracts with educational institutions, including limited data retention and secure deletion protocols.

• Disclosure Limitations: PII will not be disclosed to any third party without prior written consent from the parent or eligible student, except as necessary to fulfill our contractual obligations or as required by law.

8. Breach Notification and Response (Applicable to All Educational Institutions)

• Prompt Notification: In the event of a data breach or unauthorized release of PII, we will notify the relevant educational institution and affected individuals promptly and without unreasonable delay.

• Investigation and Cooperation: We will cooperate fully with the educational institution and law enforcement in investigating and responding to the breach, maintaining the integrity of the investigation.

• Responsibility for Notifications: If the breach or unauthorized release is attributed to us, we will bear the cost of notifications or reimburse the educational institution for such expenses.

9. Parental and Student Rights (Specific to NYC DOE Schools)

• Your child’s PII cannot be sold or released for any marketing or other commercial purposes.

• If your child is under age 18:

• You have the right to inspect and review the complete contents of your child’s education records within 45 days of the DOE receiving your request and verifying your identity.

• You also have the right to request changes to your child’s education records when you believe they are inaccurate, misleading, or violate your child’s privacy.

• Your rights extend to education records stored by DOE contractors or other outside parties on the DOE’s behalf.

• You have the right to be notified if a breach or unauthorized release of your child’s PII occurs.

• You have the right to make complaints about possible breaches and unauthorized disclosures of your child’s PII and to have such complaints addressed. The DOE must provide you with a response no more than 60 calendar days from when we receive your complaint. If more time is needed, the DOE will provide an explanation to you, along with an approximate date for a response.

10. Cookies and Analytics

• Use of Google and HotJar cookies for authentication and analytics.

11. User Rights

• Data Deletion Requests: Contact WordPath customer service.

12. Changes to This Policy

• Policy Updates: Any changes will be posted on this page.

13. Contacting WordPath:

• For Record Amendments and Inspection of Records: Parents of students, legal guardians, or eligible students (as defined by applicable laws) seeking to inspect or amend educational records can contact us at info@wordpath.com.

• For Data Deletion Requests: Users wishing to request the deletion of their personal data, or guardians acting on behalf of minors, should reach out to info@wordpath.com.

• For Breach Notifications or Complaints: Educational institutions, parents, legal guardians, or eligible students who need to report a data breach, or have complaints about data handling, can contact us at info@wordpath.com.

• In all instances, we encourage the provision of sufficient details to assist us in processing your request efficiently. For security and privacy reasons, identity verification may be required before proceeding with any requests related to personal data.