HUB+ Student Data Privacy Policy

This ProSolve Student Data Privacy Policy ("Policy") describes how ProSolve ("ProSolve," "We," "Us," "Our") collects and protects Personal Information of users in the United States who are under the age of 13 and access our Service through their Schools.

Capitalized words have special meaning in this Policy and are defined below:

• "Child," "Children" means a user or users of the Service in the United States who are under the age of 13 for purposes of COPPA; and where required by applicable law or contract, including certain U.S. State and international student privacy laws, ProSolve will treat "Child" to include users under the age of 18 and will apply the protections described in this Notice accordingly.
• "Educator," "Educators" means an individual, or individuals, authorized to act on behalf of the School contracting with ProSolve for use of the Service.
• "Parent" means a legal guardian of a Child.
• "Personal Information" means information about a Child that can reasonably be used alone or in combination with other reasonably available information to identify, locate, or contact a specific Child.
• "Service" means the HUB with Student Profiles and/or Benchmarking, including the websites, applications, and features through which Schools and Children access it.
• "School" means a school, district, or other educational institution that has contracted with ProSolve for use of the Service.

ProSolve only collects information from a Child that is reasonably necessary for the Child to use the Service for educational purposes authorized by a School. Schools are informed of the specific data elements collected in connection with their contracted Services at the time of contracting.

Account and Enrollment Information

Student account and enrollment information is handled differently depending on how a School chooses to provision access to the Service.

• Standard Account Creation: ProSolve collects a Child's first name, last name, grade level, and school email address to create an account.
• Single Sign-On (SSO): ProSolve collects only an anonymized student identifier. Roster data (including names, email addresses, student ID, and grade level) flows directly between the School's Student Information System (SIS) and ProSolve's roster management system and is not stored by ProSolve's core platform. Schools retain full control over what roster data is provisioned.

User-Generated Content

User Generated Content consists of information a Child submits to or creates within the Service as part of Educator-directed educational activities, including prompts, inputs, assignments, written responses, messages, and other academic content generated while using the Service. Educators and Schools control the instructional context in which Children interact with the Service. ProSolve does not independently prompt Children to provide Personal Information beyond what is necessary to participate in Educator-directed activities or to use the Service for authorized educational purposes.

Information Collected Automatically

• Device Information: ProSolve and/or our service providers may collect IP addresses or other unique device identifiers for any device used to access the Service, along with related technical metadata such as ISP, browser type, and referring pages. All device data is stored in secure AWS-hosted environments, encrypted at rest and in transit, with incremental backups retained for 30 days.
• Cookies and Tracking Technologies: ProSolve and/or our service providers may use cookies or similar technologies to enable the technical operation of the Service, enhance performance, and support analytics. Users can disable cookies through their browser or device settings, though some features may become unavailable.

School Property

All Personal Information processed by ProSolve on behalf of a School remains the property of that School. ProSolve does not claim ownership over Personal Information in any form. ProSolve retains rights only to its own platform, tools, and any de-identified or aggregated derivative works that cannot reasonably be used to identify a student.

Parent, Guardian, and Child Access

Schools are responsible for establishing procedures by which parents, legal guardians, or eligible Children may review, request correction of, or request deletion of Personal Information. ProSolve will support Schools in fulfilling these requests by providing reasonable mechanisms to access, correct, and export a Child's Personal Information within 30 days of a verified request. If a parent, guardian, or Child contacts ProSolve directly regarding their data, ProSolve will refer that individual to the applicable School.

Visibility of Personal Information

No Personal Information is made available or visible to the general public through the Service. Depending on the features a School activates, Educators and other users within the same School may view certain information through their connected accounts. ProSolve does not make Personal Information visible to any party outside the School without authorization.

Subprocessor Access

ProSolve may engage vetted third-party subprocessors to support the delivery of the Service. All subprocessors are contractually required to protect Personal Information to a standard no less stringent than ProSolve's own obligations, are prohibited from selling Personal Information, and may only process Personal Information for authorized educational purposes (see Section 10).

ProSolve uses Children's Personal Information solely for purposes authorized by the applicable School and consistent with legitimate educational interests, as described below.

Service Delivery and Support

ProSolve may use a Child's Personal Information to provide and operate the Service as authorized by the School, and to enable features and functionality necessary for the Child's use of the Service.

Compliance, Safety, and Protection

ProSolve may use a Child's Personal Information to comply with applicable laws and legal process, protect the rights and safety of ProSolve, Schools, Children, and others, enforce the terms governing the Service, and prevent, identify, and deter fraudulent, harmful, or unauthorized activity.

Service Operation, Maintenance, and Troubleshooting

ProSolve may use information collected automatically (such as device identifiers, IP addresses, browser metadata, and usage data from cookies and similar technologies) only as reasonably necessary to operate, secure, support, and maintain the Service, including to troubleshoot issues and ensure system reliability.

Product and Service Improvement

ProSolve may create aggregated, anonymized, or de-identified data. This data may be used to analyze and improve the Service for educational purposes, provided that such data cannot reasonably be used to identify a Child. ProSolve does not use data for unrelated general, commercial, or non-educational purposes and does not attempt to re-identify aggregated or de-identified data.

ProSolve does not sell or share Personal Information for commercial or non-educational purposes. Personal Information is shared only in the limited circumstances described below.

With Schools and Educators

ProSolve shares Personal Information with the Child's School and authorized Educators solely as necessary to provide the Service. Schools control what information is visible to Educators and other authorized users within their implementation of the Service. ProSolve does not control, and is not responsible for, how Educators handle Personal Information once it has been shared with them through the Service.

With Service Providers and Subprocessors

ProSolve may share Personal Information with vetted third-party service providers and subprocessors that support the delivery of the Service. All subprocessors are contractually required to protect Personal Information to a standard no less stringent than ProSolve's own obligations, are prohibited from selling Personal Information, and may only process Personal Information for authorized educational purposes (see Section 10).

For Legal Purposes

ProSolve may disclose Personal Information when required by law, lawful court order, subpoena, or government request. Where legally permissible, ProSolve will notify the applicable School prior to any compelled disclosure. In accordance with FERPA 34 CFR §99.36, ProSolve may also disclose Personal Information without prior School notification in the event of a genuine health or safety emergency, where such disclosure is necessary to protect the health or safety of a student or others. Any such disclosure will be limited to the parties and information reasonably necessary to address the emergency, and ProSolve will notify the applicable School of the disclosure as soon as practicable following the event.

In Connection with a Change of Control

In the event of a merger, acquisition, consolidation, or sale of all or substantially all of ProSolve's assets, Personal Information may be transferred to the successor entity. ProSolve will provide written notice to affected Schools no later than 60 days following the closing of any such transaction. Any acquiring entity will be required to honor ProSolve's existing privacy commitments with respect to Personal Information. Schools retain the right to terminate their agreement with ProSolve if they reasonably determine that the successor entity cannot uphold the terms of the applicable Data Privacy Agreement or applicable law.

Data Storage

All Personal Information processed by ProSolve is stored exclusively in secure data centers located in the United States. Data is encrypted both at rest and in transit using industry-standard encryption protocols. ProSolve's technical infrastructure is governed by its Information Security Policy, which is based on the ISO 27001 framework and addresses access control, network security, vulnerability management, and physical and environmental security.

Backups

ProSolve maintains daily incremental backups of data. Backup data is retained for a minimum of 30 days and is subject to the same encryption and access control requirements as production data. Backup restoration procedures are tested at least quarterly to ensure data can be reliably recovered in the event of an incident.

Data Retention

ProSolve retains Personal Information only for as long as necessary to fulfill the educational purposes for which it was collected and as required by applicable law or contract. Retention periods are determined by the nature of the data and the terms of the applicable agreement with the School.

Deletion Upon Contract Termination

Upon termination or expiration of a School or district agreement, ProSolve will, at the direction of the School, delete all Personal Information within 60 days of the termination date. Upon request, ProSolve will provide written certification confirming that deletion has been completed. ProSolve will comply with any verified data deletion request received from an authorized School representative within the same timeframe.

ProSolve's HUB Student Profiles and HUB Benchmark include AI-enabled features. When these AI-enabled features are part of a School's contracted services, ProSolve uses AI to transcribe and process responses generated through educational activities (e.g., a Child recording their answer to an Educator-guided prompt). Responses are analyzed against defined scoring criteria to generate scores and structured insights. These insights are used to provide meaningful feedback to teachers, students, and administrators through ProSolve's reporting tools.

When AI-enabled features are part of a School's contracted services, ProSolve uses AI to transcribe and process responses generated through educational activities (e.g., a Child recording their answer to an Educator-guided prompt). Responses are analyzed against defined scoring criteria to generate scores and structured insights. These insights are used to provide meaningful feedback to teachers, students, and administrators through ProSolve's reporting tools.

ProSolve does not:

• Process video, images, or data types beyond written and audio responses
• Use AI for targeted advertising or commercial decision-making about Children
• Use Children's Personal Information to train, retrain, or improve AI or machine learning models for non-educational purposes
• Sell or share Children's Personal Information for any non-educational or commercial purpose
• Use manipulative or deceptive design practices that pressure or encourage students to share more personal information than is necessary to use the Service
• Use audio recordings for voiceprint matching or any form of biometric identification
• Create or store biometric templates of any kind

This notice applies if your child's school uses HUB Student Profiles and/or the HUB Benchmark. If your child's school uses QUEST, SLED, or the standard HUB, ProSolve does not collect personal information about your child.

Our Commitment to Data Minimization

ProSolve collects only the minimum amount of personal information necessary to provide the Service for the educational purposes authorized by your child's school. We do not collect, process, or retain personal information beyond what is directly required to deliver and support your child's educational experience. If information is no longer needed for those purposes, it is securely deleted in accordance with our data retention practices.

Information We Collect About Your Child

ProSolve collects educational information about your child from your child's school or district, including your child's name, school email address, grade level, and school enrollment information. We also collect educational content your child creates or submits while using the Service, such as written responses, assignment inputs, and other academic work generated through teacher-directed activities. We collect this information only to the extent necessary to provide the Service for authorized educational purposes. ProSolve does not sell, release, or disclose student PII for any commercial or marketing purpose, directly or indirectly.

Why We Collect This Information

We use this information solely to deliver and support your child's educational experience. This information provides access to ProSolve's learning tools, enables teachers to monitor progress, and ensures the Service operates safely and effectively. We do not use your child's information for any commercial purpose.

Who We Share Information With

We share your child's information with their school, district, and authorized educators. We also work with trusted service providers for secure cloud hosting and AI processing. They are contractually required to protect your child's privacy and may only use your child's personal information to support the delivery of the Service.

How Long We Keep Information

ProSolve retains your child's personal information only for as long as necessary to fulfill the educational purposes for which it was collected. When your child's school ends its agreement with ProSolve, the school may direct us to delete all student personal information, which we will complete within 60 days. Written confirmation of deletion is available to the school upon request.

Your Rights as a Parent

You have the right to:

• Review the personal information ProSolve has collected about your child
• Request correction of any inaccuracies in your child's information
• Request deletion of your child's personal information, subject to applicable educational record retention requirements
• Refuse to allow further collection or use of your child's information
• Contact us with any questions about our privacy practices

How to Exercise Your Rights

Contact your child's school district or ProSolve directly at compliance@prosolve.com. We will respond to your inquiry within a reasonable time frame, typically within 10 business days.

Data Security

ProSolve's information security program employs technical, organizational, and physical safeguards designed to protect Personal Information, including but not limited to:

• Encryption of all data at rest and in transit using industry-standard protocols
• System features and configuration settings designed to authorize user access while restricting unauthorized users from accessing information not needed for their role
• Antivirus, anti-malware, and intrusion detection systems to prevent and identify potential security threats
• Regular vulnerability scans and annual penetration testing of the production environment
• Separation of development, testing, and production environments, with Personal Information prohibited from non-production use
• Documented incident response procedures for identifying, managing, and resolving security incidents and breaches

ProSolve undergoes regular independent security assessments. SOC 2 reports are available to Schools and prospective partners upon request by contacting compliance@prosolve.com.

Breach Notification

In the event of a confirmed data breach affecting Personal Information, ProSolve will notify the affected School within 72 hours of confirmation, unless notification is delayed at the direction of law enforcement. Notification will include a description of the breach, the categories of data affected, the estimated date of occurrence, and identification of impacted individuals to the extent known. Schools are responsible for notifying affected parents and eligible students in the most expedient manner possible. ProSolve maintains a written Data Breach Response Plan consistent with applicable federal and state law, and will provide a summary of that plan to Schools upon reasonable written request.

ProSolve may engage vetted third-party subprocessors to support the delivery of the Service. ProSolve maintains a current list of subprocessors with access to Personal Information and will provide advance notice to Schools of any material changes.

ProSolve requires all subprocessors to:

• Process Child Personal Information only for authorized educational purposes and solely on ProSolve's instructions
• Limit access to Child Personal Information to what is strictly necessary to perform their designated function
• Implement privacy, confidentiality, and security protections no less stringent than those required of ProSolve under applicable law and its agreements with Schools, including compliance with COPPA and applicable state student data privacy laws
• Notify ProSolve promptly of any security incident or breach involving Child Personal Information

Our trusted subprocessors are:

• Amazon Web Services (AWS): Cloud hosting and infrastructure services
• Ednition: Student Information System data sourcing
• Soefia: Data analytics and AI processing platform

ProSolve reserves the right to modify this Policy from time to time. If we make material changes that affect how Personal Information is collected, used, or shared, we will provide advance notice to the applicable School before such changes take effect, unless a shorter notice period is required to address legal, security, or operational obligations. We will also update the effective date at the top of this Policy.

Material changes will become effective on the date specified in the notice provided to Schools. Continued use of the Service by a School after the effective date constitutes acceptance of the updated Policy on behalf of its users. Nothing in this section limits or modifies a School's rights or remedies under an applicable agreement with ProSolve or under applicable law.

This section applies only to California residents. It describes how ProSolve collects, uses, and shares Personal Information in our role as a business, and the rights applicable to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). For purposes of this section, "Personal Information" has the meaning given in the CCPA. ProSolve may collect the following categories of Personal Information:

• Identifiers: Name, school email address, IP address, device identifiers, and school enrollment information such as grade level and School ID
• Education Information: Student educational records, written responses, assignment inputs, academic work, assessment results, and learning progress data generated through teacher-directed activities
• Geolocation Data: General location information derived from IP addresses collected from your device
• Usage and Technical Data: Browser type, referring pages, ISP, and interaction data collected through cookies and similar technologies
• Inferences: Aggregated or de-identified conclusions drawn from educational data to analyze and improve the effectiveness of the Service

As a California resident, you have the following rights regarding the Personal Information we collect or maintain about you. Please note these rights are not absolute, and there may be cases where we decline your request as permitted by law.

• Right to Know: You have the right to request that ProSolve disclose the categories and specific pieces of Personal Information we have collected about you, the categories of sources from which it was collected, the purposes for which we use it, the categories of third parties with whom we share it, and the categories of information we sell or disclose to third parties. You may make this request up to twice per year, free of charge.
• Right to Delete: You have the right to request that ProSolve delete Personal Information we have collected from you and direct our service providers to do the same, subject to certain exceptions such as legal requirements to maintain educational records under FERPA or applicable state law.
• Right to Opt-Out of Sale or Sharing: ProSolve does not sell Personal Information. ProSolve does not share Personal Information for cross-context behavioral advertising. As such, there is no sale or sharing of your Personal Information to opt out of. If this practice changes, we will update this Policy and provide you with the right to opt out before doing so.
• Right to Correct: You have the right to request that ProSolve correct inaccurate Personal Information we maintain about you. For student information, correction requests should be directed to your child's school or district in the first instance, as Schools control the accuracy of education records.
• Right to Limit Use and Disclosure of Sensitive Personal Information: You have the right to direct ProSolve to limit its use and disclosure of sensitive Personal Information to only what is necessary to provide the Service. ProSolve does not use sensitive Personal Information beyond what is required to deliver the educational services authorized by your child's school.
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising any of your rights under the CCPA. ProSolve will not deny you services, charge different prices, or provide a different level of service because you exercised a privacy right.

How to Exercise Your Rights

California residents may exercise their rights by contacting ProSolve directly at compliance@prosolve.com. For student information, parents and eligible students may also exercise these rights through their child's school or district. To protect your Personal Information, ProSolve will verify your identity using a method appropriate to the type of request before fulfilling it. You may also designate an authorized agent to make requests on your behalf, provided that agent has written permission from you and can verify their identity to ProSolve's satisfaction.

For questions about your California privacy rights or ProSolve's data practices, please contact us at compliance@prosolve.com.

If you have any questions or concerns regarding this Policy, please contact ProSolve via compliance@prosolve.com. We will respond to your inquiry within a reasonable time frame, typically within 10 business days.