Children's Privacy (COPPA & FERPA)

1. Direct Notice to Parents

The Children's Online Privacy Protection Act requires online services to provide direct notice to parents regarding the collection, use, and disclosure of personal information from children under 13 (16 CFR § 312.4).

1.1 Categories of Personal Information Collected

We practice strict data minimization. We collect only what is strictly required to deliver adaptive educational instruction:

• Student Name & Date of Birth: Used solely for account identification, age-gating, and developmental curriculum band placement.
• Learning Interaction Records: Answers to questions, scoring accuracy, timestamped response latencies, and prerequisite completion states.
• Presentation Preferences: Learner skin choices (e.g., Space, Fantasy, Nature realms) and vocabulary reading level configurations.

Strict Exclusion: Cognitano strictly prohibits the collection or storage of biometric data, facial recognition scans, audio recordings of children, real-time GPS geolocation, racial or ethnic origin, religious beliefs, or payment card data from minors.

1.2 Zero Advertising & Commercial Exploitation

Cognitano is fundamentally an educational space. We maintain an uncompromising policy regarding student data commercialization:

• We never sell, rent, or lease student personal information to third parties under any circumstances.
• We never display behavioral or targeted advertisements to students.
• We never build marketing profiles or track students across external applications or websites.

2. Five-Layer Architecture & AI Boundaries

In compliance with educational governance guidelines, Generative AI (LLMs) is strictly partitioned from authoritative decision engines:

Layers 1–4: Deterministic Core (Authoritative)

All item scoring, mastery calculations (M = decay × weighted accuracy), prerequisite gating, and track readiness classifications are 100% deterministic, mathematically verifiable, and run without AI.

Layer 5: AI Assist (Non-Authoritative)

Generative AI operates exclusively as an assistive scaffolding tutor providing hints and conceptual explanations. Prompts are completely anonymized before submission to LLM providers. Parents may toggle AI assistance off at any time.

3. Parental Rights to Inspect & Delete

Federal law grants parents continuous, unencumbered rights to oversee and control their child's educational footprint (16 CFR § 312.6):

• Right to Review (COPPA § 312.6(a)(1)): Parents can review every question attempt, response latency, accuracy score, and reflection entry submitted by their child through the Parent Dashboard.
• Right to Machine-Readable Portability (GDPR Art. 20 / COPPA § 312.6): Parents can trigger an automated export generating a structured, complete JSON archive containing all student profile records, capabilities, mastery histories, and journal entries.
• Right to Refuse & Delete (COPPA § 312.6(a)(2)): Parents can revoke consent at any time to freeze account activity, or initiate permanent hard cascade erasure wiping all personal records from the primary database and audit caches.

4. Institutional FERPA Framework

When deployed across K-12 public, charter, or private school environments, Cognitano adheres to the Family Educational Rights and Privacy Act (34 CFR Part 99) and federal student privacy regulations:

4.1 The School Official Exception (34 CFR § 99.31(a)(1)(i))

Cognitano qualifies and acts as an authorized “School Official” with legitimate educational interests:

• Institutional Service: We perform an institutional adaptive learning and formative assessment function for which the school would otherwise employ its own staff.
• Direct Control: Cognitano operates under the direct administrative control and supervision of the school or district with respect to the use, maintenance, and destruction of education records.
• Prohibited Redisclosure: Student education records are accessed exclusively for the designated educational purpose and are never redisclosed without prior written school or parental consent.

4.2 Student Data Privacy Consortium (SDPC) Alignment

We execute standard Student Data Privacy Agreements (National Data Privacy Agreement / NDPA Version 2.0 or state-specific equivalents) committing to:

• Data minimization, breach notification within 72 hours, and annual third-party security audits.
• Zero algorithmic bias or discriminatory profiling based on protected student attributes.
• Immediate data return and certified shredding upon termination of the institutional service contract.

5. Parental Actions & Contact

Parents and institutional partners can access designated controls directly:

• Parent Consent Portal — Review and grant verifiable consent for your child under 13 with granular AI scaffolding toggles.
• Parent Data Dashboard — Download complete JSON learning archives or manage data retention settings.
• Request Institutional DPA — Execute a standard Student Data Privacy Agreement aligned with FERPA and state regulations.
• General Privacy Policy — View our comprehensive global platform privacy documentation.

For compliance questions or data requests, contact FORNITO at info@fornito.com.