Super Teacher Inc. (“Company,” “we,” “us,” or “our”) takes many measures to protect the privacy and security of our users’ data. This Data Privacy and Security Plan outlines the policies and procedures that we have or will implement to comply with relevant local, state, and federal laws applicable to us. This document covers Super Teacher for Schools, or school-based accounts in Super Teacher (the “Product”, “Services”). For non-school accounts, and for more general information beyond the scope of this document, please see our general privacy policy.
The Product will collect and retain personal data necessary for the functionality in the app and to support internal Company operations. The following is data that could be considered Personally Identifiable Information (PII) that the Product may collect, store and use:
Additionally, during a student's interaction with the Product, voice recordings will be collected to enable speech-based interactions. This is required for the Product to function. However, we will not retain a voice recording longer than necessary to transcribe the recording using automatic speech-transcription technology – after which the recording is promptly deleted. More information is provided below in the section titled Data Retention Policy. The following are examples of non-PII data that the Product may associate with a user’s account:
Data will be securely stored using Amazon Web Services (AWS), an industry-leading cloud service provider. AWS maintains strict security certification, including SOC 2 and ISO 27001 compliance. All data will be stored within the United States.
The Company will retain data associated with a user only for as long as is necessary to fulfill the purpose for which the information was collected, or as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. When a user account is deleted (whether by request of the student, family, or school administrator) or deemed inactive, we will delete it and all associated data within a reasonable amount of time.
All communication with our servers will occur over secure channels. Requests from client devices will transmit data over HTTPS, which ensures data is encrypted via TLS 1.2 or higher. Our server connection has been rated an A+ from Qualys SSL Labs. Communication between different systems hosted in AWS will occur within a Virtual Private Cloud (VPC) that ensures only Company-authorized traffic is permitted and prevents data in transit from being observed by outside sources.
The Company employs industry-standard encryption protocols to ensure that all stored data remains secure. Within AWS, we utilize services including S3 (Simple Storage Service), EBS (Elastic Block Store), and EFS (Elastic File System). All use AES-256 encryption with managed keys, ensuring that data at rest is protected.
Access to data and infrastructure for the Product will be limited to those Company employees or independent contractors whose job function requires it. Access permissions will be gated at multiple points throughout the system, including where appropriate at the object level and the API level. Only Company personnel whose job function necessitates access to our infrastructure will be granted permission to do so. Access will be logged and require multi-factor authentication (MFA).
Parents, teachers, and school administrators will have the right to access, review, and request modifications to any of their (or, as applicable, their student/child’s) associated data. A parent or school administrator may at any time request the deletion of their child’s/student’s account and all associated data. Inquiries can be directed to support@getsuperteacher.com.
The Company endeavors to ensure that data is handled in accordance with district or other local educational agency (“LEA”) requirements for data return, transition, and deletion. In the event of contract termination, or at the request of an LEA, data will be managed as follows, at the LEA’s option and direction:
The Company will not sell or share personal data with third-party companies for those third party’s marketing purposes. Third-party service providers (e.g., cloud hosting, speech-to-text conversion tools, analytics tools) may have access to data solely for the purpose of supporting the Product’s functionality or analysis, and will be bound by confidentiality agreements and data protection clauses.Company’s agreements with such third-party service providers will require the service provider to make representations regarding its own data-privacy and security practices that are commensurate with those representations that Company has made in this Data Privacy and Security Plan and in its published Privacy Policy.
The Company will maintain periodic backups of its databases and other system data. These backups will ensure a timely recovery in the unlikely case of extreme data loss or corruption. All backups will be encrypted using AES-256 encryption, ensuring that backups, like the primary data, will remain secure and protected from unauthorized access during both the storage and recovery processes.
Employees and contractors employed by the Company will receive training in the following areas where necessary to securely perform their job function:
The Company does not use Confidential Information to train AI Systems. The Company does use some established technologies that may be considered AI Systems in providing the Services.
This Data Privacy and Security Plan will be periodically reviewed by the Company. Material updates will be communicated to the LEAs and any relevant stakeholders as appropriate.