FERPA Compliant
Student education records protected under 20 U.S.C. § 1232g
COPPA-Aware
Platform restricted to users 13+ through institutional enrollment
Data Security
AES-256 encryption at rest · TLS 1.2+ in transit
No Data Sales
Student data is never sold, rented, or used for advertising
Policy Documents
What data we collect, how we use it, your rights to access and deletion, and how we protect student records under FERPA.
Platform eligibility, acceptable use, institutional responsibilities, prohibited conduct, intellectual property, and governing law.
Background verification requirements for Pathway Sites, supervision protocols, incident reporting, and our youth protection framework.
Our Practices in Plain Language
We believe compliance should be readable, not just legal. Here is exactly how we handle data and safety on this platform.
FERPA Compliance
Real-World Pathways™ operates as a "school official" under FERPA (20 U.S.C. § 1232g) when contracted with educational institutions. We access student education records only to the extent required to provide the platform's services, never for secondary commercial purposes. Institutional partners retain full ownership of student records. Parents and eligible students may request access, amendment, or deletion by contacting privacy@wealthwisekids.org.
COPPA Notice
The platform is designed for users aged 13 and older and is accessed exclusively through verified institutional accounts (schools, nonprofits, and registered organizations). We do not knowingly collect personal information directly from children under 13. Students participate only after institutional enrollment by a verified school or program administrator. If you believe a minor under 13 has accessed the platform without institutional authorization, contact privacy@wealthwisekids.org immediately.
Data Collection
We collect only what is necessary to operate the platform: name, institutional email address, role (student/educator/site staff), program participation records, and activity logs within Field Lab experiences. We do not collect Social Security numbers, financial account data, health information, or location data beyond what is voluntarily provided in a program profile.
How Student Data Is Used
Student data is used exclusively to: (1) authenticate accounts and maintain session security; (2) display appropriate content based on program enrollment; (3) generate anonymized aggregate impact reports for institutional partners; and (4) support program facilitation by authorized educators. Student data is never used for behavioral advertising, third-party profiling, or sold to any external party under any circumstance.
Data Security
All data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. Our infrastructure runs on Supabase (hosted on AWS), which maintains SOC 2 Type II certification. Access to production databases is restricted to authorized engineering personnel via multi-factor authentication. We conduct periodic access reviews and revoke credentials upon role changes.
Data Retention & Deletion
Active user records are retained for the duration of program enrollment plus 12 months to support institutional reporting. Records may be deleted upon written request from the institution or the user. Institutional partners may request bulk data deletion at the end of a contract term. Anonymized, aggregated outcome data (no individual identifiers) may be retained indefinitely for research and platform improvement.
Third-Party Vendors
We use a limited number of sub-processors: Supabase (database and authentication infrastructure), Vercel (hosting and CDN), and Formspree (contact form routing). None of these vendors are granted access to student education records. Data processing agreements are maintained with each vendor consistent with FERPA's school official exception requirements.
Incident Response
In the event of a data security incident affecting student records, we will notify affected institutions within 72 hours of confirmed breach discovery, consistent with applicable state notification laws. Notifications will include the nature of the incident, categories of data affected, and remediation steps. Urgent safety incidents involving student welfare should be reported via the platform's Incident Report tool or directly to privacy@wealthwisekids.org.
Cookies & Tracking
We use session cookies strictly necessary for authentication and platform functionality. We do not use third-party advertising cookies, cross-site tracking pixels, or behavioral analytics tools that profile individual users. Basic aggregate analytics (page load counts, error rates) may be collected to monitor platform performance — these are never tied to individual student identities.
Governing Law
This platform is operated by WealthWise Kids LLC, a Georgia limited liability company. All disputes are governed by the laws of the State of Georgia without regard to conflict-of-law principles. Exclusive jurisdiction and venue for any legal proceedings shall be the state and federal courts located in Fulton County, Georgia.
Questions about compliance or your data?
We respond to all privacy inquiries within 2 business days. Safety and FERPA-related requests are prioritized within 24 hours.
Urgent Safety Concern?
If a student is in immediate danger, call 911 first. Then use our platform to file a formal incident report.
File an Incident Report →