Parents' Bill of Rights

iCode Technologies LLC, operator of the RevolutionEd platform (“RevolutionEd,” “we,” “us”) is committed to safeguarding the personally identifiable information (“PII”) of students, parents, teachers, and principals collected, maintained, or used in the course of providing the RevolutionEd educational platform (the “Service”) to New York City Public Schools (“NYCPS”) and other educational agencies in New York State. This Parents' Bill of Rights is issued in accordance with New York State Education Law § 2-d and the regulations of the Commissioner of Education (8 NYCRR Part 121), and is written in plain language for parents, legal guardians, and eligible students (students 18 years of age or older).

Part I — Your Rights (the five elements required by Education Law § 2-d)

1. Student data will not be sold or used for marketing

A student's PII cannot be sold, and cannot be released for any commercial or marketing purpose, by RevolutionEd or any other educational-agency contractor.

2. You can inspect and review your child's education record

Parents, and eligible students, have the right to inspect and review the complete contents of their child's education record stored or maintained by RevolutionEd. Requests are made through the student's educational agency (school or district), which will coordinate with us; we support inspection within the timeframes required by FERPA and applicable law.

3. Confidentiality is protected by law and by safeguards

State and federal laws — including FERPA and New York Education Law § 2-d — protect the confidentiality of student PII. Safeguards associated with industry standards and best practices, including encryption, firewalls, and password protection, are in place whenever data is stored or transferred. Our safeguards include:

Encryption of data at rest using AES-256, and in transit using TLS 1.2 or higher
Network firewalls and edge protection (Google Cloud Armor)
Strong password protection (scrypt hashing with unique salts)
Role-based access controls and the principle of least privilege
Multi-factor authentication for all administrative access
Continuous logging, monitoring, and intrusion detection
Annual data-privacy-and-security training for all personnel with access to student data

4. A complete list of student data elements is available for public review

A complete list of all student data elements collected by the State is available for public review at the New York State Education Department website, nysed.gov/data-privacy-security/student-data-inventory, or by writing to the Office of Information and Reporting Services, New York State Education Department, Room 863 EBA, 89 Washington Avenue, Albany, NY 12234. The categories of student data that RevolutionEd itself collects are described in Part II, Section 6 below.

5. You can have complaints about data privacy and security addressed

Complaints about a possible breach or improper disclosure of student PII may be submitted to any of the following:

Your school or district (your educational agency), at the contact in your school's notice of complaint procedures;
The New York State Education Department, Chief Privacy Officer — 89 Washington Avenue, Albany, NY 12234; email privacy@nysed.gov; telephone 518-474-0937; web nysed.gov/data-privacy-security;
RevolutionEd directly at registration@revolutioned.ai. We will acknowledge receipt within seven (7) calendar days and respond substantively within sixty (60) calendar days.

Part II — Supplemental Information (8 NYCRR § 121.3 and NYC DOE DPA Attachment C)

6. What student data RevolutionEd collects

Depending on the features a school enables, RevolutionEd may collect:

Roster and identity data — first and last name, school-assigned student identifier, school email address, grade level, class/section, and enrollment (typically provided by the school or synced via Clever, ClassLink, or Google Classroom).
Educational activity — quiz and assessment responses and scores, lesson and activity interactions, and student-submitted interests.
AI interactions — student messages in moderated AI chat / scene-chat features.
Voice / audio — short voice recordings created when a student uses pronunciation-practice or read-aloud features.
Images — photographs or images where a teacher or student uploads them as part of an activity or profile.

RevolutionEd does not knowingly collect more student data than is reasonably necessary to provide the educational service the school has authorized.

7. The exclusive purposes for which the data will be used

RevolutionEd uses student PII solely to provide and support the educational service set out in our contract with the educational agency. We do not use student PII for targeted advertising, do not build student profiles for any non-educational purpose, do not sell student data, and do not disclose it to third parties except as authorized by the agency or as required by law.

8. How we ensure our subcontractors protect data

Where RevolutionEd uses subcontractors or sub-processors (for example, cloud hosting and AI processing), each is bound by a written agreement that requires it to protect student data with safeguards no less protective than ours, and to comply with FERPA and Education Law § 2-d. A current list of our sub-processors is available to your school or district on request.

9. The duration of the contract and what happens to data when it ends

Data is processed for the duration of the agreement between RevolutionEd and the educational agency. When that agreement expires or is terminated, or upon the agency's written request, RevolutionEd will return and/or securely delete all student PII within thirty (30) days — including from backups after the backup-retention window — and will provide a certificate of destruction on request.

10. How to challenge the accuracy of data

Parents, eligible students, teachers, and principals may challenge the accuracy of student PII. Challenges are submitted to the educational agency, which is the records custodian; RevolutionEd will make any correction the agency directs and keeps an audit trail of corrections.

11. Where data is stored and how it is protected

Student PII is stored within the United States, in Google Cloud Platform data centers (us-central1 region), with US-based backups. No student PII is processed or stored outside the United States. Data is protected by the safeguards described in Part I, Section 3.

12. How data is encrypted in motion and at rest

All student PII is encrypted when stored (“at rest”, AES-256) and when transmitted (“in motion”, TLS 1.2 or higher), using methods consistent with the NIST Cybersecurity Framework and NIST SP 800-175B.

13. How you will be notified of a breach

If there is an unauthorized release, disclosure, or acquisition of student PII, RevolutionEd will notify the affected educational agency in the most expedient way possible and without unreasonable delay, and no later than seven (7) calendar days after discovery. The educational agency will then notify affected parents and eligible students as required by Education Law § 2-d(6).

14. Training

RevolutionEd personnel, and any sub-processors with access to student PII, complete annual data-privacy-and-security training aligned with FERPA and the NIST Cybersecurity Framework.

Contact

iCode Technologies LLC — Data Protection / Privacy Officer
Arsenios Scrivens, Chief Privacy & Compliance Officer
Email: registration@revolutioned.ai
Telephone: (972) 654-0412
Mailing address: iCode Technologies LLC, 3201 Dallas Pkwy St. 810, Frisco, TX 75034