School and District Terms

What these cover

These terms apply where a school, district or other educational organisation authorises RodriMath for its students. They sit alongside the Terms of Service and the Privacy Policy, and where they differ about student information, these govern.

They are written to be read by the person who has to sign something. Where a district and RodriMath sign the district's own data privacy agreement, that agreement governs; then these terms; then the quote and purchase order; then the Terms of Service.

RodriMath as a school official

RodriMath performs an institutional service the school would otherwise provide itself, has a legitimate educational interest in the education records it receives, is under the school's direct control with respect to the use and maintenance of those records, and uses them only for the authorised educational purpose. We do not redisclose personally identifiable information from education records without the school's instruction or as the law requires.

This is the arrangement described in the Family Educational Rights and Privacy Act at 34 CFR 99.31(a)(1)(i)(B), and it is the basis on which student information may be shared with us without separate parental consent.

What Florida asks of this agreement

Rule 6A-1.09550, Florida Administrative Code, paragraph (4)(a), sets what an agreement under which a Florida district discloses student information to a vendor must contain. Each is a term of this agreement:

• We comply with the Family Educational Rights and Privacy Act and with section 1002.22, Florida Statutes.
• We comply with the Children’s Online Privacy Protection Act.
• We comply with section 1006.1494, Florida Statutes, the Student Online Personal Information Protection Act: no targeted advertising, no profile except for the school’s purpose, no sale, rental or sharing, no disclosure except as it allows, collection of no more than is reasonably necessary, and reasonable security.
• We receive only the student information the service needs; the next section lists it.
• We do not disclose or re-disclose student information except as rule 6A-1.09550(4)(b) allows: where FERPA and 34 CFR 99.31 authorise it, under the district’s directory-information policy, or with written consent.

Exactly what is disclosed to us

Only what the service needs: a student's display name, username, year group and settings; what they have chosen or earned for themselves — a character, a colour, a companion and a name for it selected from an authored list, and their own world, including what they build, plant, bake and wear in it and their best runs in its games; the answers they give and when; their sessions and daily missions; the classes they are in; the stickers they leave and receive; and the estimates the engine derives from their answers.

Every one of those choices is made from options the product offers. No surface available to a student accepts free text, so a student cannot enter their own name, a classmate's, or anything else about themselves beyond the display name the school or parent set.

No email address, date of birth, home address, telephone number, photograph, voice recording, biometric identifier or location is collected, because the system has nowhere to hold one. We collect no political affiliation, voting history, religious affiliation or biometric information about a student or their parents or siblings — the information section 1002.222, Florida Statutes, forbids a Florida school, and those acting for it, to collect.

Purpose limitation

RodriMath will not:

• Engage in targeted advertising of any kind, on the service or anywhere else, using information obtained from it.
• Use covered information to build a profile of a student except in furtherance of the authorised K-12 school purpose. Adapting what a student is taught to what they understand is that purpose.
• Sell, rent, trade or otherwise disclose covered information, except as these terms permit.
• Use covered information for its own commercial purposes, for product development outside this agreement, or to train any model.

Who owns the records

The school retains ownership and control of its students' education records. We hold them on the school's behalf and act on the school's instructions.

Parents exercise their rights of access, review and correction through the school. A school administrator can download the record of any student who is or was in one of the school's classes, as a machine-readable file, from their own dashboard: their learning whole, and what was recorded in the school's own classes, leaving out only what belongs to the child's household or to another school. We will support the school in answering any request.

Consent, and its limits

Where a school authorises RodriMath, the school provides consent on behalf of parents for the educational context it has authorised, and for nothing else. We provide the Privacy Policy and the Notice to Parents to the school so the school can make them available to families, as the Children's Online Privacy Protection Rule contemplates.

Authorisation is given by an administrator of the school or district, not by a teacher, and only a school or district can give it. We record it as a record rather than an assumption: who gave it, in what role, on what date, and against which version of these terms. A consent record that cannot name the person who gave it is not a record.

A parent's withdrawal of consent takes precedence over a school's authorisation for that child. The product enforces this: where a parent has withdrawn, the child cannot sign in and nothing further is collected, regardless of the school's authorisation.

Where a teacher turns visiting on for a class, its students can visit the worlds of classmates whose doors are open, see their first names and the drawings of their worlds, and leave one of six drawn stickers. Nothing from a student's learning is shown to another student.

Security

We maintain a written information security programme with safeguards appropriate to the sensitivity of the information and the scale of the service, reviewed at least annually and whenever the product changes materially. It is available to a district on request.

Information is encrypted in transit and at rest. Credentials are stored only as hashes. Access is decided by a permission matrix enforced in code, and every administrative action writes to an append-only audit log the school may inspect.

If something goes wrong

If personal information belonging to the school's students is exposed, we will notify the school within 72 hours of confirming it, and in any case no later than the 10 days section 501.171(6), Florida Statutes, allows; give the school what it needs to meet its own notification duties; and cooperate fully in the response and any investigation. The school decides who tells its families, and we will do it for the school if it asks.

We maintain a written incident-response procedure covering this, and it is available to a district on request.

Service providers

RodriMath uses five service providers: four companies in the United States, and the speech engine of the device a student is using. Supabase, Resend and Stripe each process information only on our instructions, under a data-processing agreement that forbids any use of their own. Vercel runs the software under its standard terms of service.

Supabase (Supabase Pte. Ltd.) — the database, and adult sign-in with its own emails that confirm an address or reset a password. It holds everything described in the Privacy Policy. The data is stored in the United States, in Ohio.

Vercel, Inc. — application hosting, and the scheduled jobs that delete expired records and send the progress emails. Requests pass through it; nothing is stored beyond short-lived operational logs. United States: the software runs in Cleveland, Ohio.

Resend (Plus Five Five, Inc.) — delivery of the email RodriMath itself sends, all of it to adults: decisions about an account, invitations, notices that somebody is waiting for an answer, consent and erasure receipts, replies to support questions and enquiries, a school's authorisation request, purchase orders and invoices for a school's office, the notices about a plan — its confirmation, the notices before it renews, the yearly reminder on a monthly plan, a change of price, the receipt when a child comes back from a break, and the end of the free days — and the progress emails: the weekly summary, and alerts when a child masters something or is stuck on the same thing. Progress emails are on unless the adult turns them off in their settings. Resend receives the recipient's address and the message. A message about a child carries that child's first name, and a progress email says what they mastered or where they are stuck. It receives no answer a child gave and no identifier beyond the first name in the text. Open and click tracking are switched off, and the product will not send if it can see that they are on. United States.

Stripe, Inc. — payments. A parent or a tutor who chooses a plan is sent to Stripe’s own page, and RodriMath never sees the card: Stripe receives the paying adult’s email address, the amount, a household or account reference and, for a household, the number of children the plan covers. A school that pays an invoice by card or bank debit does so on Stripe’s page too, and Stripe receives the school’s name, its billing email address and the purchase-order references. It receives no child’s name and nothing else about a child. Stripe tells RodriMath what happened — paid, failed, stopped — and RodriMath keeps one sentence per event, never the payload. United States.

The viewer’s own browser speech engine — the words on the screen, when read-aloud is used: questions, lesson steps, stories and the world’s moments. Provided by the device or its browser maker. We ask for a voice that runs on the device wherever one exists; on some devices the only voice is one the browser maker provides over the network. A child’s name is never read out, and nothing identifying the child accompanies the words.

The current list is published at rodrimath.com/legal/subprocessors. We will tell the school before it changes, not afterwards.

What it costs, and how the term ends

A school or district pays by invoice, for a term agreed in writing, at the rate on the published schedule for its K–5 enrolment. The licence covers every child at the organization for that term — including the ones who arrive in March — and every teacher and administrator, who are never counted. There is no seat counting and no mid-year true-up. An invoice can be paid by check, or by card or bank debit on our payment processor's page.

Nothing renews by itself. We hold no card for a school and raise no charge without an invoice your office has agreed to, so continuing is a new agreement between us rather than something that happens unless you stop it. If you renew a one-year term, the rate for the next term is the list rate plus 4%, as the quote says; a three-year term locks the rate for all three. If enrolment has fallen a band by the time the term ends, the renewal falls with it.

A contract never reaches a child. In every state there is — running, late, or ended — every child already enrolled carries on exactly as before and every teacher keeps their classes. What an ended contract stops is enrolling *new* children and opening new classes. A late invoice is a conversation with a business office and stops nothing at all.

What does shape a student's access is the school year. A student learns through RodriMath during the dates the school sets on its calendar; outside them — over the summer, say — only where their own family's plan covers them.

Deletion, and the end of the agreement

The school may direct us to delete any student's information at any time, and we will do so within 30 days. In practice it happens at once.

In Florida, when the school tells us a student has left — by archiving them — we delete their information no later than 90 days later, unless a parent has expressly consented to it being kept, as section 1006.1494(3)(c), Florida Statutes, requires. The school may direct deletion sooner, including at the end of a course.

At the end of the agreement we will, at the school's election, return the school's student information in a machine-readable form or delete it, or return it and then delete it, and confirm in writing when deletion is complete.

What remains afterwards is the audit log: entries that identify a student only by an internal number, never by name, kept for at least seven years and unalterable by anyone, because a school reviewing an incident depends on it.

Absent any instruction, the published retention periods in the Privacy Policy apply.

Public records

Where a Florida district's contract includes the public-records clause section 119.0701, Florida Statutes, requires, we will keep and produce the records it covers as that section provides, and treat as confidential what the law makes confidential.

Accessibility

RodriMath is built to conform to WCAG 2.1 Level AA — the standard the Department of Justice's rule under Title II of the Americans with Disabilities Act sets for the web content public entities provide, including through a vendor.

Every page, the child's and the grown-ups', was audited against it in September 2026, and an accessibility conformance report for the whole product is available on request at hello@rodrimath.com.

Standards alignment

Every lesson is mapped to Florida's B.E.S.T. Standards for Mathematics, and every Kindergarten to Grade 5 benchmark is taught. Skills are also mapped to the Common Core State Standards. The mapping is shown on every skill and lesson.

RodriMath is not affiliated with or endorsed by the Florida Department of Education or by the authors of the Common Core State Standards.

Artificial intelligence

RodriMath uses no artificial intelligence with students — no generative, conversational or agentic system of any kind — and no student's information is used to train a model. The provisions of rule 6A-1.0957, Florida Administrative Code, on artificial-intelligence instructional tools therefore do not apply to it.