Privacy Policy

Last Updated: March 13, 2026

1. Introduction

EduFlip, LLC (“EduFlip,” “we,” “us,” or “our”) is committed to protecting the privacy of every person who uses our structured literacy and dyslexia intervention platform — especially the learners and students whose educational journeys we support.

This Privacy Policy explains what information we collect, how we use it, how we protect it, and your rights regarding that information. It applies to the EduFlip website at eduflip.org and all associated platform services (collectively, the “Service”).

This policy should be read alongside our Terms of Service. By using the Service, you agree to the practices described here.

2. Who We Serve — and Why Data Protection Matters

EduFlip is used by four primary groups:

Because we serve learners who may be minors, we apply the highest data protection standards to all learner accounts, regardless of age. We comply with the Children’s Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), and applicable state student privacy laws.

3. Information We Collect

3.1 Account and Registration Information

When practitioners, administrators, or families create accounts, we collect:

• Name and professional title or role
• Email address
• Organization name (district, clinic, or school)
• Password (stored as a secure cryptographic hash — never in plain text)
• Billing and payment information (processed by our PCI-compliant payment processor; EduFlip does not store full card numbers)

3.2 Learner Profile Information

Learner accounts are created by authorized practitioners, educators, or parents/guardians — never directly by the learner themselves. We collect:

• First name and last name
• Grade level
• Date of account creation
• Assigned practitioner or classroom

We do not collect learner Social Security numbers, government ID numbers, or home addresses.

3.3 Platform Usage and Telemetry Data

To deliver progress monitoring, support IEP/MTSS reporting, and improve instructional accuracy, we collect structured session data including:

• Lesson and unit identifiers accessed
• Activity type and completion status
• Response accuracy and error patterns (phoneme-level, word-level, spelling)
• Time-on-task metrics
• Device type and operating system
• Session timestamps

This telemetry is tied to learner accounts and is used exclusively for educational progress tracking and platform improvement — not advertising or profiling.

3.4 Communications

If you contact us by email or through support channels, we retain the content of those communications to respond to your inquiry and improve our service.

3.5 Automatically Collected Technical Data

Like most web services, we automatically collect:

• IP address
• Browser type and version
• Referring URL
• Crash reports and performance diagnostics

We use this data for security, fraud prevention, and platform stability — not for behavioral advertising.

4. How We Use Information

We use the information we collect to:

• Deliver and personalize the curriculum — adapting lesson sequences to learner progress and diagnostic results
• Generate progress reports — including IEP/ARD documentation, MTSS tier reports, and practitioner dashboards
• Operate and improve the platform — analyzing usage patterns to improve instructional design and fix technical issues
• Communicate with account holders — sending service notices, account updates, and (with consent) educational resources and product news
• Ensure security and prevent fraud — detecting unauthorized access and protecting the integrity of student data
• Comply with legal obligations — including responses to lawful government requests and state dyslexia reporting requirements

We do not use learner data for behavioral advertising, sell student data to third parties, or use student information to build commercial profiles.

5. Children’s Privacy (COPPA Compliance)

EduFlip takes children’s privacy seriously and complies with the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506, and the FTC’s COPPA Rule.

5.1 No Direct Collection from Children Under 13

We do not knowingly collect personal information directly from children under 13. All learner accounts for minors are created by a parent, legal guardian, or an authorized school or clinical professional acting under a valid institutional agreement.

5.2 Institutional Consent Mechanism (School Exception)

When EduFlip is deployed by a school or school district, the institution may provide consent on behalf of parents under the COPPA school authority exception, provided the institution uses the data solely for educational purposes. Districts deploying EduFlip are responsible for providing required COPPA and state privacy notices to parents.

5.3 Parental Rights for Direct (Non-School) Family Accounts

If you are a parent or guardian who has directly created a learner account for a child under 13, you have the right to:

• Review the personal information collected about your child
• Request correction or deletion of your child’s information
• Withdraw consent and request account deletion

To exercise these rights, contact us at [email protected].

5.4 Discovery of Improperly Created Child Accounts

If we discover that personal information has been collected from a child under 13 without appropriate parental or institutional consent, we will delete that information promptly.

6. FERPA Compliance

For school districts and educational institutions, EduFlip operates under a Data Processing Agreement and functions as a school official with a legitimate educational interest in student education records, consistent with FERPA (20 U.S.C. § 1232g).

This means:

• We access student education records only as directed by and for the benefit of the institution
• We do not redisclose student education records to unauthorized third parties
• We support institutions in honoring parental rights to access, amend, and restrict student records
• We maintain appropriate physical, technical, and administrative safeguards for education records

Institutions retain ownership and control of student education records at all times. Upon request or contract termination, we will return or delete education records as directed.

7. State-Specific Privacy Compliance

EduFlip’s curriculum and platform are aligned with dyslexia education laws in Texas, Arkansas, Mississippi, Tennessee, Colorado, and South Carolina. Our data practices are designed to support compliance with related student data privacy provisions in those states, including:

• Texas: Texas Education Code Chapter 32 (Student Data Privacy); Texas Government Code Chapter 552
• Arkansas: Student Data Accessibility, Transparency and Accountability Act (DATA Act)
• Other states: We monitor applicable student privacy legislation in all states where EduFlip is deployed and update our practices accordingly

If your state has specific data processing agreement requirements, please contact us to initiate a compliant agreement before deploying to students.

8. How We Share Information

We do not sell personal information. We share information only in the following limited circumstances:

8.1 With Your Institution

Practitioner and learner data is shared with authorized administrators within your organization (e.g., a District Manager can view progress reports for their schools).

8.2 With Service Providers

We work with carefully vetted third-party vendors to operate the Service — including cloud hosting, payment processing, and customer support tools. These vendors process data only on our behalf and under contractual data protection obligations. We do not permit them to use your data for their own purposes.

8.3 For Legal Compliance

We may disclose information when required to do so by law, court order, or lawful government request, or when necessary to protect the safety of a user or the public.

8.4 Business Transfers

If EduFlip is acquired, merged, or substantially restructured, user data may be transferred to a successor entity, subject to the same privacy commitments described in this policy. We will notify users in advance of any such transfer.

We will never share learner data with advertisers, data brokers, or commercial analytics firms.

9. Data Retention

Upon verified deletion request, we will remove personal data within 30 days, except where retention is required by law.

10. Data Security

We implement industry-standard security practices to protect all personal information, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS
• Encryption at rest: Sensitive data fields are encrypted in our database using AES-256-CBC
• Access controls: Role-based access limits data visibility to authorized users only
• Database isolation: Each district’s data is stored in a physically separate database
• Audit logging: Administrative access to sensitive data is logged with actor, timestamp, and IP address

No system can guarantee perfect security. If we become aware of a data breach affecting personal information, we will notify affected users and relevant authorities as required by applicable law.

11. Offline Use and Local Data Storage

EduFlip’s architecture is designed to support offline use in low-connectivity schools and rural districts. As offline capabilities are implemented:

• Lesson content and active session data may be stored locally in your device’s browser storage
• Any local data will be scoped to the authenticated session and synced to our servers when connectivity is restored
• Locally stored data will be cleared upon logout or session expiration

We will not access locally stored data on your device outside of the Service’s normal sync process. This section will be updated as offline features are released.

12. Your Privacy Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you or your child
• Correct inaccurate information
• Delete your account and associated personal data
• Restrict or object to certain processing activities
• Portability — receive a copy of your data in a machine-readable format

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

13. Cookies and Tracking Technologies

We use minimal, essential cookies and browser storage to:

• Maintain your logged-in session
• Remember display preferences
• Ensure platform security

We do not use advertising cookies, third-party tracking pixels, or cross-site behavioral tracking. We do not participate in advertising networks.

You may configure your browser to refuse cookies, but this may impair platform functionality.

14. Third-Party Links and Integrations

The Service may link to or integrate with third-party platforms (such as student information systems). EduFlip is not responsible for the privacy practices of third-party services. We encourage you to review the privacy policies of any external service you connect to EduFlip.

15. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or the features of our Service. We will notify account holders of material changes via email or in-platform notice at least 14 days before the change takes effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

16. Contact Us

If you have questions, concerns, or requests related to this Privacy Policy, please contact us:

EduFlip, LLC
Privacy Inquiries: [email protected]
Website: eduflip.org

For student data or FERPA-related inquiries from institutions, please email us with your district or organization name for expedited response.