Student Data Commitments

Effective and last updated: October 11, 2026

These commitments summarize MasteryCue’s handling of student information. A signed district data privacy agreement or services agreement controls if it provides stronger or more specific requirements.

FERPA school-official role and purpose limitation

When designated by a school or district as a school official performing an outsourced institutional service, we process education records only for the legitimate educational interests and purposes specified by that institution. The institution retains direct control over the use and maintenance of its education records. We do not redisclose student information except as directed by the institution, required to operate the contracted service through bound subprocessors, or otherwise permitted by law and the applicable agreement. We act under the institution’s direction and do not claim ownership of school data.

Our commitments

• No sale or rental of student personal information.
• No targeted advertising or advertising profiles based on student data.
• No collection beyond information reasonably needed to provide the contracted service.
• Role-based access, organization isolation, teacher-class assignment controls, and administrative audit visibility.
• Contracted subprocessors limited to operating and securing the service.
• Support for school-directed access, correction, export, and deletion requests.
• Deletion or return following termination under the applicable agreement and retention schedule.
• Documented incident response and notice to affected institutions as required by contract and law.

COPPA school-authorized use

MasteryCue does not permit children to create independent consumer accounts. If a school authorizes collection from a child for a school-directed educational service where permitted, we provide the school the notice required of an operator, collect only what is reasonably necessary, honor verified access and deletion directions, and remain responsible for MasteryCue’s COPPA obligations.

District controls

Authorized administrators can manage membership and identity connections, review roster synchronization status, and access permitted aggregate reporting. Teachers are limited to assigned classes. Small administrator-reporting cohorts are suppressed to reduce re-identification risk.

Artificial intelligence

Student data is used to generate requested educational analysis and recommendations. MasteryCue does not sell student personal information or use it to build advertising profiles. Schools can request the applicable provider-specific processing, model-training, and retention terms before approving student-data use. Automated recommendations support—not replace—professional educator judgment.

Retention and deletion

MasteryCue retains student information only for the service, contractual, security, and legal purposes described in the Privacy Policy and applicable school or district agreement. Authorized institutions may request export or deletion. Following termination, student information is returned or deleted according to the applicable agreement and documented retention process, subject to limited legal or security retention and controlled backup rotation.

Requests

Districts may request our current data inventory, retention schedule, subprocessor list, security overview, deletion certification, or proposed data privacy addendum at MasteryCue support.