Privacy Policy

1. Introduction

EmpowerEd Money ("we," "our," or "us") provides a K-12 financial-literacy learning platform to schools and districts. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights of schools, parents, and students. We follow the principle of data minimization.

2. Our Role (School Official / Service Provider)

When a school or district adopts EmpowerEd Money, the school directs us to collect and process limited student information solely to provide the educational service on the school's behalf. Under FERPA, we act as a "school official" with a legitimate educational interest, under the school's direct control. Under COPPA, the school provides consent on behalf of parents for the collection of students' personal information for educational purposes only. The school — not EmpowerEd — owns and controls the student data.

3. Information We Collect

Provided by the school or district

• Student: first name, last name, username, grade level / graduation year, and class enrollment. Student email is optional and not required.
• Educator / school leader: name, school email, and role.
• School / district: name, address, and system-generated access/join codes.

Generated by use of the service

• Educational records: lesson/course progress, quiz and activity responses, points, badges, and game sessions.
• Technical logs: IP address, browser type, and timestamps, used only for security, debugging, and operating the service.

4. How We Use Your Information

We use collected information solely to operate the educational service:

• To deliver and operate the courses, dashboards, progress tracking, and gamification
• To give educators and school leaders reporting on their own students, classes, and schools
• To secure, maintain, debug, and improve the service

We do not use student information to build advertising profiles, and we do not sell it.

5. Children's Privacy (COPPA Compliance)

• We limit collection to what the educational service requires
• Student accounts are created by schools and educators, not directly by children
• We do not condition participation on disclosing more than is reasonably necessary
• We do not use children's data for advertising or to create non-educational profiles
• We honor school, parent, and guardian requests to review or delete a student's information

6. Sharing, Subprocessors & Artificial Intelligence

We never sell personal data, and we never use it for targeted advertising. We share information only with subprocessors that help us operate the service, under contract and only as needed:

Subprocessor	Purpose	Student data?
Amazon Web Services	Application & database hosting	Yes (as host)
Anthropic (Claude)	Offline authoring of teacher lesson plans by our staff only — not used by the live app	No — never sent
Email delivery provider	Account invitations and password setup	Limited (name/email)
On-screen translation (EN/ES)	Optional page translation; being replaced with our own bilingual content	Page text only

We may also disclose information if required by law or to protect rights and safety, and in a business transfer only to a successor bound by commitments at least as protective, with notice to schools.

7. Data Retention & Deletion

We retain student personal information only as long as needed to provide the service to the school, and we delete or de-identify it on request or at contract termination. The school controls retention.

• Roster identifiers, progress, and gamification data: retained for the duration of the school's active subscription.
• Transactional email records: up to 12 months. Security/technical logs: up to 90 days. Backups: rolling window of up to 35 days.
• On a school's deletion request, we action it within 30 days (sooner where required by law) and confirm in writing.
• On contract termination, all student personal information is deleted or de-identified, and an export is available on request before deletion.

In the event of a data breach affecting student data, we notify the affected school without undue delay and within the time required by the applicable agreement and law.

8. Data Security

We protect data with administrative, technical, and physical safeguards, including:

• Encryption of data in transit (HTTPS/TLS) and hashed passwords
• Role-based access control and per-school data scoping
• Application-layer protections (CSRF/nonce verification, input validation, output escaping, parameterized queries)
• Access logging, least-privilege administrative access, and routine backups

9. Your Rights

Schools and parents/guardians (through the school) have the right to:

• Access and review the personal information we hold about a student
• Request correction of inaccurate information
• Request deletion of student data at any time
• Export school data in a portable format

For student data, parents should contact their child's school; schools can contact us directly for data requests.

10. State Student-Privacy Laws

We support compliance with applicable U.S. state student-data-privacy laws (such as California's SOPIPA and the many state laws modeled on it) and will execute a district's required state-specific data-privacy agreement or the Student Data Privacy Consortium National Data Privacy Agreement (NDPA). A Data Protection Agreement is available to schools on request.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: privacy@empoweredmoney.com
• Contact Form: Contact Us