Privacy Policy Rider for School Use of Mia & Codie

This Privacy Policy Rider (“Rider”) describes how Codie LLC, doing business as Mia & Codie (“Mia & Codie,” “we,” “our,” or “us”), handles personal information collected from K–12 students through the Mia & Codie student application (the “App”) and the product’s learning management system (“LMS”) when we provide the product to schools, school districts, and educators (“Schools”) under a School agreement. It works alongside the Mia & Codie Website Privacy Policy and is intended to support Schools in meeting their obligations under, and to describe how Mia & Codie complies with:

  • The Family Educational Rights and Privacy Act (FERPA);
  • The Children’s Online Privacy Protection Act (COPPA) and its implementing Rule;
  • New York Education Law §2-d and its implementing regulations at 8 NYCRR Part 121;
  • California’s Student Online Personal Information Protection Act (SOPIPA) and Education Code §49073.1 (AB 1584); and
  • Comparable student-data-privacy laws of other states in which our Schools operate.

Scope and precedence. This Rider governs personal information that Mia & Codie collects from or about K–12 students through the App and LMS in connection with a School agreement (“student data”). The Mia & Codie Website Privacy Policy governs personal information collected from teachers and other adult users through our marketing website and account-registration and purchasing functions. The Website Privacy Policy’s descriptions of advertising, marketing, retargeting, profiling, and sale or sharing of personal information apply to adult-user data only and do not apply to student data. To the extent of any conflict with respect to student data, this Rider controls.

1. Our Role

When a School contracts with Mia & Codie to provide the product to its students, our legal role is as follows:

  • FERPA — “school official.” We act as a “school official” performing an institutional service or function for which the School would otherwise use its own employees, under the exception at 34 CFR §99.31(a)(1). We perform that function under the School’s direct control, use education records only for the authorized purpose, and do not re-disclose them except as FERPA permits and the School directs.
  • New York Education Law §2-d — “third-party contractor.” For Schools that are New York educational agencies, we act as a “third-party contractor” and assume the obligations described in Section 6.
  • California — vendor / operator. For California Schools, we act as a contracting party under Education Code §49073.1 and as an “operator” under SOPIPA, subject to Section 7.

We commit to:

  • Processing student data only under the direction of the School and only for the educational purposes the School authorizes;
  • Not using student data for any commercial purpose unrelated to providing the product; and
  • Maintaining the security safeguards and access controls described in Section 9 and required by applicable state law.

2. Data We Collect from Students

We receive student information through two channels in connection with a School agreement: (a) directly from students when they use the App, and (b) from teachers and School administrators who enter or upload class and roster information into the LMS. The categories of student information are limited to what is reasonably necessary to provide the educational service and include:

  • Account and roster information: student name, grade level, School or class affiliation, and login credentials.
  • Educational usage data: activity logs, progress and performance data, coding-course participation, and support interactions.
  • Device and technical data: browser type, device type, IP address, and similar technical identifiers, collected only as necessary to deliver, secure, and troubleshoot the App.

We practice data minimization. We do not collect more student information than is necessary to provide the educational service, we do not require students to provide personal contact information or other unnecessary personal information as a condition of participating in any activity, and we do not use cookies, software development kits, or similar technologies in the App or LMS to collect student information for advertising, retargeting, or behavioral-profiling purposes.

3. How We Use and Disclose Student Data

We use student data only to:

  • Provide, support, and maintain the Mia & Codie learning services;
  • Personalize instruction and measure student progress within those services;
  • Improve and adapt the Mia & Codie educational services themselves (and not for unrelated product development); and
  • Comply with our legal obligations and the School’s lawful direction.

We do not:

  • Sell, rent, or license student data;
  • Use student data for targeted or behavioral advertising, or allow any third party to do so through the App or LMS;
  • Use student data to build profiles of students for any purpose other than supporting the educational service authorized by the School;
  • Use student personal information to train or develop artificial-intelligence or machine-learning models, except solely to provide and improve the educational service delivered to the School’s students; or
  • Disclose student data to any third party except to subprocessors engaged to deliver the service (Section 8), as the School directs in writing, or as required by law.

4. COPPA Compliance

The App and LMS are made available to students only through School agreements. For students under 13, Mia & Codie relies on the School to provide consent in lieu of parental consent, consistent with FTC guidance on the school-authorized educational context. This authorization is limited to the educational purpose for which the School engages us and does not extend to any commercial purpose.

As the operator, Mia & Codie independently commits to:

  • Collecting from students under 13 only the personal information reasonably necessary to provide the service;
  • Not conditioning a student’s participation on the disclosure of more personal information than is reasonably necessary;
  • Not using or disclosing under-13 student information for advertising, profiling, or any commercial purpose beyond providing the service;
  • Retaining under-13 student information only as long as necessary to provide the service, in accordance with a written data-retention determination, and not retaining it indefinitely; and
  • Providing, through the School, access to review and to delete a child’s information on request.

Schools agree to:

  • Confirm that their authorization for our collection of under-13 student information is limited to the educational context;
  • Make this Rider and the Website Privacy Policy available to parents; and
  • Route parental requests to review or delete a child’s information to us through the School.

5. FERPA Commitments

  • Education records and personally identifiable information from those records are used only to perform the authorized service for the School and are not re-disclosed except as the School directs and FERPA permits;
  • We act under the direct control of the School with respect to the use and maintenance of education records;
  • Access to personally identifiable information is limited to those with a legitimate educational interest in providing the service; and
  • Any de-identified data we derive will be subject to controls reasonably designed to prevent re-identification, and we will not attempt to re-identify it.

6. New York Education Law §2-d and 8 NYCRR Part 121

For Schools that are New York educational agencies, Mia & Codie affirms the following as a third-party contractor:

  • We will not sell student personally identifiable information (PII) or use or disclose it for any marketing or commercial purpose, or permit another party to do so;
  • We will maintain a Data Security and Privacy Plan (DSPP) aligned with the NIST Cybersecurity Framework and with the educational agency’s data-security and privacy policy, provided to the agency in connection with the agreement;
  • Student PII will be encrypted in transit and at rest using validated encryption methods;
  • Access to student PII is limited to individuals with a legitimate educational interest and is subject to written confidentiality obligations;
  • Any subcontractor or other authorized person to whom we disclose student PII will be contractually bound to data-protection obligations at least as protective as those in this Rider and §2-d;
  • We will notify the educational agency of any breach or unauthorized release of student PII in the most expedient way possible and without unreasonable delay, but no later than seven (7) calendar days after we discover it; and
  • We will comply with the educational agency’s Parents’ Bill of Rights for Data Privacy and Security, and the supplemental information for that Bill of Rights is set out below.

Supplemental Information for the Parents’ Bill of Rights

  • Exclusive purposes: Student data will be used only for the purposes in Section 3 of this Rider.
  • Subcontractor oversight: We require subcontractors, by contract, to abide by data-protection and security obligations consistent with §2-d and this Rider.
  • Contract term and data handling: On expiration or termination of the agreement, student data will be returned to the agency and/or securely destroyed as the agency directs, as described in Section 10.
  • Right to challenge accuracy: Parents and eligible students may challenge the accuracy of student data through the School, as described in Section 11.
  • Storage and security: Student data is stored and secured as described in Sections 9 and 12.

A New York educational agency with a complaint about our handling of student data may contact us using the details in Section 13 and may also contact the New York State Education Department’s Chief Privacy Officer at privacy@nysed.gov.

7. California Student Privacy

SOPIPA. Consistent with SOPIPA, we do not sell student information, use it to engage in targeted advertising, build non-educational profiles of students, or disclose covered information except as SOPIPA permits.

Education Code §49073.1 (AB 1584). For agreements with California local educational agencies, we affirm that:

  • Pupil records continue to be the property of and under the control of the educational agency;
  • Parents may access and, through the agency, correct pupil records held by us;
  • We will not use pupil records for any purpose other than those authorized in the agreement;
  • We will, on request or on termination, delete or return pupil records and, where required, certify their deletion;
  • We maintain the security procedures described in Section 9 and the breach procedures described in Sections 6 and 9; and
  • We will not retain, use, or disclose pupil records after the agreement ends except as required by law or as the agreement permits.

CCPA/CPRA. These education-specific commitments are distinct from the CCPA/CPRA framework in the Website Privacy Policy. To the extent the CCPA/CPRA applies to student data, we handle it as a service provider acting on the School’s behalf and do not “sell” or “share” it as those terms are defined.

8. Subprocessors

We share student data with subprocessors only as necessary to deliver the Mia & Codie service. Each subprocessor is contractually bound to:

  • Handle student data securely and only to deliver the Mia & Codie service;
  • Be subject to the same prohibitions on sale, advertising use, and non-educational profiling that apply to us; and
  • Comply with applicable privacy laws, including FERPA, COPPA, and New York Education Law §2-d.

A current list of subprocessors — including providers of cloud infrastructure, hosting, and customer-support tools — is available to Schools on request. We control onward transfers and do not permit subprocessors to engage further parties without equivalent obligations.

9. Data Security

We implement administrative, technical, and physical safeguards designed to protect student data, including:

  • Encryption of student PII in transit and at rest;
  • Role-based access controls and least-privilege access, with authentication for personnel who access student data;
  • Logging, monitoring, and regular security assessments or audits; and
  • Alignment with the NIST Cybersecurity Framework.

Incident response. We maintain an incident-response process. If we discover a breach or unauthorized release of student data, we will notify the affected School without unreasonable delay and within the timelines required by applicable law (including the seven-calendar-day timeline for New York educational agencies in Section 6), and will cooperate with the School’s own notification obligations.

10. Data Retention and Deletion

We retain student data only as long as necessary to provide services to the School. On the School’s request or on termination of the agreement, we will:

  • Return or delete student PII in accordance with the School’s instructions; and
  • Permanently delete student PII from backup systems within ninety (90) days.

11. Parent, Student, and School Rights

Working through the School, parents and eligible students may:

  • Review the student’s personal information that we hold;
  • Request correction of inaccurate information; and
  • Request deletion of the student’s information or decline further use of the service.

We will work with the School to accommodate verified requests promptly and within any timelines required by law.

12. Data Location

We store and process student data on infrastructure located in the United States. Where a School requires data residency in a particular jurisdiction, we will address that requirement in the School agreement.

13. Changes and Contact Information

We may update this Rider from time to time. We will give Schools advance notice of any material change affecting student data and will not apply a material change to an existing School agreement without the notice (and, where required, the consent) that the agreement or applicable law specifies.

Privacy contact:

Codie LLC (Mia & Codie), Attn: Privacy

48 South Broadway, Suite 181, Nyack, NY 10960

support@codieblocks.com

New York educational agencies may also contact the NYSED Chief Privacy Officer at privacy@nysed.gov.