BabbleBot COPPA Compliance Policy

Effective Date: January 14, 2026

Last Updated: July 16, 2026

1. Introduction

BabbleBot ("we," "us," "our," or "Company") is committed to protecting the privacy of children and educators using our platform. This Privacy Policy describes how BabbleBot collects, uses, discloses, and otherwise handles personal information, with particular attention to the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq., and its implementing regulations (16 C.F.R. Part 312).

BabbleBot is an educational software platform designed to help elementary school students (ages K-3) learn phonemic awareness and reading skills using Science of Reading methodology. The platform is used exclusively in school settings under direct teacher supervision and administration.

Important: BabbleBot is designed to be used by schools, teachers, and students alike. Teachers manage student accounts and control all student data.

2. Applicability of COPPA

BabbleBot acknowledges that our platform is likely to be accessed by children under 13 years of age. We are committed to full compliance with COPPA. This policy outlines the specific ways we comply with COPPA's requirements.

3. Information We Collect from Children

3.1 Student Information Collected by Teachers

Students do not create their own accounts. Instead, teachers create and manage all student accounts on behalf of their classroom. The following information is collected about students and stored in our secure database:

Required Student Information:

• Name (first name plus last initial by default; full last name only when the teacher opts in and acknowledges the change)
• Current Learning Objective (curriculum progression level)
• Grade Level (K-3)
• Classroom Assignment (linked to teacher's class code)

Optional Student Information (Customization):

• Profile Picture (selected from BabbleBot's pre-defined avatar options)
• Background Image (selected from BabbleBot's pre-defined background options)

Activity and Learning Data:

Lesson Performance Data:

• Lesson completion status
• Lesson scores and accuracy percentages
• Pass/fail status on lessons
• Lesson duration (time spent on activity)
• Timestamps of lesson completion

Progress Tracking:

• Streak count (consecutive days/lessons completed)
• Current objective number
• Number of lessons passed
• Number of lessons completed
• Stories read
• Badge achievements

Audio/Voice Recording Data:

• Student audio recordings during phoneme lessons
• Student speech-to-text transcripts generated from audio
• Accuracy scoring based on phonemic pronunciation
• Audio files stored in Firebase Storage

No Direct Contact Information Collection:

BabbleBot does not collect any of the following from students:

• Email addresses
• Phone numbers
• Passwords (students do not log in independently)
• Physical addresses
• Birthdates (grade level only)
• Social media accounts
• Parent contact information (collected from teachers only)

3.2 Information We Collect from Teachers

Teachers create and manage their accounts directly. Information collected from teachers includes:

Teacher Account Information:

• First Name
• Last Name
• Email Address (for account creation and password recovery)
• Password (encrypted)

Classroom Configuration:

• Unique 5-character Class Code (auto-generated for student access)
• Grade Level
• Class Progression Type (Fixed or Free)
• Class Privacy Setting (Open or Closed)
• Required Passes to Progress (customizable lesson advancement rules)
• Selected Curriculum (default: "Science of Reading")

Support and Feedback:

• Teacher feedback messages
• Support tickets and inquiries
• Email address associated with support submissions

Payment Information:

• Plan type (Free/Paid tier)
• Billing status

Parent/Guardian Contact Information:

Parent email addresses are collected only when parents request to receive support communications or feedback about students. This is done strictly for notification purposes and not for marketing.

4. How Information Is Collected

4.1 Direct Collection

From Teachers:

• Sign-up form (name, email, password)
• Classroom settings configuration
• Student roster entry (manual or bulk XLSX upload)
• Support ticket submissions
• Feedback forms

From Students:

• Implicit collection during lesson activities
• Audio recordings during phoneme lessons
• Automated speech-to-text processing
• Learning activity completion

4.2 Automatic Collection

• Session Storage: Basic user preferences and session state
• Lesson Metrics: Automatically recorded when students complete lessons
• Timestamp Data: When lessons are taken and completed
• Platform Analytics: Google Firebase Analytics (anonymized, no PII)

4.3 What We Do NOT Collect

• Browsing history or cookies for tracking purposes
• IP addresses linked to student identities
• Geolocation data
• Device identifiers
• Behavioral tracking across websites
• Third-party data (except curriculum content)

5. How We Use Collected Information

5.1 Primary Uses

For Students:

1. Instruction Delivery: Delivering phonemic awareness and reading instruction
2. Progress Tracking: Measuring learning outcomes and advancement
3. Personalization: Customizing lessons based on current objective level
4. Assessment: Scoring pronunciation accuracy and lesson performance
5. Teacher Feedback: Generating reports for teacher review

For Teachers:

1. Class Management: Managing student rosters and classroom configuration
2. Performance Monitoring: Displaying student progress dashboards and analytics
3. Lesson Planning: Generating AI-powered stories and curriculum materials
4. Account Management: Authentication and account administration
5. Communication: Responding to support requests and feedback

5.2 Secondary Uses

• Product Improvement: Analyzing aggregated, non-identifiable data to improve platform features
• Safety and Security: Detecting and preventing fraud, abuse, and security incidents
• Legal Compliance: Meeting legal obligations and law enforcement requests
• School Reporting: Generating reports for school administrators (at school's request)

5.3 What We Do NOT Do

• Sell student or teacher personal information to third parties
• Use student data for behavioral advertising or marketing
• Share student data with advertisers
• Use student information for purposes unrelated to education
• Create shadow profiles or merge data from other sources
• Disclose student names or identifiable information publicly

6. Disclosure and Sharing of Information

6.1 Teachers and School Administrators

Students: Student information is shared with the teacher who created the student account and school administrators with access privileges. Teachers use this data to monitor student progress.

Teachers: Teacher account information is visible only to the teacher and our administrative team for account management purposes.

6.2 Third-Party Service Providers

BabbleBot uses third-party vendors to operate our platform. These vendors are contractually obligated to maintain confidentiality and use information solely to provide services:

Essential Infrastructure:

• Google Firebase
  • Firestore Database (student/teacher data storage)
  • Firebase Authentication (login security)
  • Firebase Storage (audio files and media)
  • Firebase Analytics (aggregated usage metrics only)
  • Data Location: Google Cloud facilities
  • COPPA Compliance: Firebase does not use children's data for advertising

Communication Services:

• EmailJS
  • Used for: Teacher support ticket email notifications
  • Data Shared: Teacher email address, message content
  • Does NOT receive: Student data or identifiable student information

AI Services:

• OpenAI (GPT-4o)
  • Used for: AI-generated story content based on teacher input
  • Data Shared: Curriculum objective information, phoneme focus areas, teacher prompts
  • Does NOT receive: Student data, student names, or student performance data
  • Compliance: OpenAI's terms prohibit use of data for training unless explicitly opted in

Speech Assessment Services:

• Azure Speech Services (Microsoft)
  • Used for: Phoneme-level speech assessment and pronunciation scoring
  • Data Shared: Student audio recordings during phoneme lessons
  • Data Location: Microsoft Azure cloud facilities
  • Compliance: Azure Speech does not use children's data for advertising or model training

Payment Services:

• Stripe
  • Used for: Payment processing for teacher subscriptions
  • Data Shared: Teacher name, email, billing information
  • Does NOT receive: Student data or identifiable student information

6.3 No Sale of Data

BabbleBot does not sell student or teacher information to any third party. We do not permit third parties to track our users.

6.4 Legal Requirements

We may disclose information if required by law, court order, or government request:

• Subpoena or legal process
• Protect against fraud or security threats
• Protect rights, privacy, or safety of users
• Comply with applicable regulations (FERPA, COPPA, state laws)

We will provide notice of such disclosure where legally permitted.

7. Parental Rights Under COPPA

7.1 Parental Consent

For School-Based Use: COPPA recognizes that schools may act as parent/guardian agents. When student accounts are created by teachers in a school context for curriculum purposes, we rely on the school's determination that parental consent has been obtained through standard school enrollment and technology policies.

For Inquiries: Parents may contact BabbleBot regarding their child's information, and we will verify the relationship before disclosure.

7.2 Parental Access and Control

Parents have the right to:

1. Review Information - Request a review of what information we've collected about their child
2. Request Deletion - Request that we delete information we've collected
3. Deny Collection - Request that their child not participate in data collection (working with their school)
4. Direct Communication - Request that we not further contact their child

How to Exercise Rights:

• Contact: connor@babblebot.xyz
• Request must include: Student name, classroom teacher, and requester relationship to student
• Response timeframe: 30 days

7.3 Parental Verification

We will verify parental/guardian relationship before disclosing or deleting student information. Verification may include:

• Requesting copy of custody documents
• Requesting school enrollment records
• Phone verification

8. Data Security and Protection

8.1 Security Measures

BabbleBot implements industry-standard security practices to protect information:

Technical Safeguards:

• Encryption: Data encrypted in transit (TLS/SSL) and at rest (Firebase encryption)
• Authentication: Firebase Authentication with strong password requirements
• Access Control: Role-based access (only teachers access their own data)
• Database Security: Firestore rules restrict access to authorized users only
• Regular Updates: Framework and dependency updates for security patches

Administrative Safeguards:

• Staff Training: Data privacy and security training for all employees
• Data Minimization: We collect only necessary information
• Incident Response: Procedures for detecting and responding to breaches
• Monitoring: Regular security audits and monitoring

8.2 Data Retention

Information is retained as follows:

Active Student Accounts:

• Student data retained while student is actively enrolled in class
• Student profile is removed when a teacher removes the student from the roster. Complete purge of associated lesson data and audio is performed manually upon verified request (email connor@babblebot.xyz, actioned within 30 days).

Inactive Accounts:

• Accounts inactive for 24 consecutive months may be archived
• Archive preserved for 12 additional months for teacher access
• Eligible for manual purge after 36 months of inactivity, performed as part of periodic data minimization review.

Audio Recordings:

• Retained as long as associated lesson record exists
• Manually purged upon verified teacher request (email connor@babblebot.xyz, actioned within 30 days).

Teacher Accounts:

• Retained as long as teacher maintains active account
• Deleted upon teacher account deletion and 30-day grace period

8.3 Data Breach Response

In the unlikely event of unauthorized access to student data:

1. We will investigate promptly
2. Notify affected users (teachers/parents) without unreasonable delay, and no later than 72 hours after confirming the incident
3. Notify relevant authorities as required by law
4. Provide recommendations for account security
5. Document the incident

9. Children's Online Privacy Protection (COPPA) Compliance

9.1 COPPA Rule Compliance

BabbleBot complies with COPPA's Safe Harbor provisions by:

1. Limited Collection: Collecting only information necessary for education
2. No Marketing: Not using student data for marketing or behavioral advertising
3. Parental Rights: Providing parental access and control mechanisms
4. Transparency: Maintaining clear privacy policies
5. Reasonable Security: Implementing appropriate security safeguards
6. Third-Party Obligations: Requiring vendors to maintain confidentiality

9.2 No Behavioral Advertising

We do not:

• Display behaviorally-targeted advertisements to students
• Allow advertisers to collect student information
• Use student data to create profiles for targeting purposes
• Permit third-party tracking of student online activity

10. Student Rights and Protections

10.1 Right to be Forgotten

Students (through parents/teachers) have the right to request deletion of their data. To submit a request, email connor@babblebot.xyz with the student's name, classroom teacher, and requester relationship to the student.

Upon verified request, we will manually purge the following within 30 days:

• Student profile
• Associated lesson data
• Audio recordings
• All identifying information

Exception: Aggregated, non-identifying data may be retained for analytics purposes.

10.2 Data Accuracy

Teachers can update student information (name, grade level, objective) at any time through the classroom management interface.

10.3 Limitations on Data Use

Student data will not be used for:

• Advertising targeting
• Commercial purposes unrelated to education
• Selling or renting to third parties
• Profiling outside educational context
• Discrimination or exclusion

11. FERPA Compliance

BabbleBot recognizes that student records may be subject to the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g.

Our Role: We operate as a "school official" with a legitimate educational interest when acting under contract with a school.

Compliance Measures:

• Data shared only with authorized school personnel
• Data not re-disclosed without school consent
• Student records maintained securely
• Compliance with FERPA requests through school

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements.

Notification: When material changes are made, we will:

1. Post the updated policy on our website
2. Update the "Effective Date" at the top of this document
3. Notify teachers via email for significant changes affecting data practices
4. Seek updated consent if required

Your continued use of BabbleBot after changes constitutes acceptance of the updated policy.

13. Contact Us

For Privacy Questions or Concerns:

• Email: connor@babblebot.xyz
• We will respond to inquiries within 30 days.

14. FTC Complaints

Parents may file complaints about privacy practices with the Federal Trade Commission:

• Online: https://reportfraud.ftc.gov
• By Mail: FTC, 600 Pennsylvania Ave NW, Washington DC 20580

15. School and Teacher Responsibilities

15.1 Teacher Obligations

Teachers using BabbleBot must:

• Obtain appropriate parental consent as required by their school/district
• Maintain confidentiality of class codes and student data
• Use student data only for educational purposes
• Comply with FERPA and applicable state privacy laws
• Report security concerns to BabbleBot immediately
• Not share student data outside school except as authorized

15.2 BabbleBot's Responsibility

BabbleBot commits to:

• Maintaining secure infrastructure
• Complying with teacher/school data requests
• Providing breach notification
• Supporting audit and compliance activities
• Documenting data practices
• Training on COPPA/FERPA compliance

16. Acknowledgment

By registering for BabbleBot, teachers acknowledge they have:

1. Read and understood this Privacy Policy
2. Have authority to bind their school to these terms
3. Will comply with applicable privacy laws
4. Will obtain necessary parental consent
5. Understand student data will be used for educational purposes only

Teachers should ensure parents receive a copy of this policy through normal school communications.

Document Version: 1.2
Last Review Date: July 16, 2026
Next Review Date: January 14, 2027 or upon material change