Risen for Schools Privacy Policy

This Privacy Policy explains how Risen (“Risen,” “we,” “us,” or “our”) collects, uses, shares, and protects information in connection with Risen for Schools (the “Service”). It is part of the Risen for Schools Terms of Service and uses the same defined terms, including “School,” “Educator,” “Student,” “Student Data,” and “School Agreement.”

Risen for Schools is provided to Catholic schools, dioceses, parishes, and other educational institutions. Students use it only through accounts their School provides. We handle Student Data as a service provider to the School, under the School’s direction, and for no other purpose.

1. Who This Policy Covers

1.1 Schools and Educators. This Policy applies to information we collect about a School and the Educators it designates to use the Service.

1.2 Students. This Policy applies to Student Data collected through the Service. A School decides which Students have accounts and what work is assigned to them. A Student joins only through an invitation link or join code issued by the School, and supplies their own account details when joining.

1.3 Parents and Guardians. Parents and guardians are not users of the Service unless a School grants them access, but they have rights regarding their child’s information, described in Section 9.

2. Information We Collect

2.1 School and Educator Information. Name, School name and role, School email address, log-in credentials, and the content of any support request an Educator sends us.

2.2 Student Data. The Student Data a School provides or that the Service records, which may include:

• First and last name, email address, grade level, graduation year, and Student ID where the Student or School chooses to provide one.
• Class and teacher assignment.
• Log-in credentials.
• Practice session responses, bellwork responses, completion records, and the dates and times of that activity.
• Any text a Student enters into an assignment or response field.

2.3 Technical Information. Device and browser type, operating system, IP address, approximate location derived from IP address at the city or region level, access times, pages viewed, and error and performance logs.

2.4 How We Get It. Account information comes from the School or is entered by the Student when joining with an invitation link or join code the School has issued. Activity and technical information is recorded automatically as the Service is used.

3. What We Do Not Collect

• Social Security numbers or other government identification numbers.
• Payment card or bank account information. Schools are invoiced directly and no one is charged through the Service.
• Biometric identifiers, including face, voice, and fingerprint data.
• Precise geolocation.
• Contacts, camera, microphone, or photo library access.
• Advertising identifiers, and we do not use advertising or cross-site tracking technology in the Service.

4. How We Use Information

We use the information described above only to:

• Provide and operate the Service for the School, including delivering practice sessions, bellwork, and daily cards, and recording Student activity so Educators can see completed work.
• Maintain, secure, troubleshoot, and improve the Service.
• Respond to support requests from Schools and Educators.
• Communicate with a School about its account, including service and billing notices.
• Comply with law and enforce the Terms of Service.

We do not sell Student Data. We do not use it for targeted advertising. We do not build profiles of Students for any purpose other than the educational purposes the School has authorized. We do not use Student Data, or Student or parent contact information obtained through the Service, to market anything to Students or their families, including Risen’s own products.

5. Our Role and the Rules We Follow

5.1 Service Provider to the School. Student Data belongs to the School and, as provided by law, to the Student and the Student’s parents or guardians. We process it only as a service provider, under the School’s direction, and we do not own it.

5.2 Consent. Where a Student is under 13, the School provides consent for the collection of Student Data for school-authorized educational purposes, consistent with Federal Trade Commission guidance under the Children’s Online Privacy Protection Act. We do not knowingly collect personal information from a child under 13 outside of a School relationship.

5.3 Student Privacy Laws. We comply with the California Student Online Personal Information Protection Act (Cal. Bus. & Prof. Code § 22584) and, to the extent they apply to a School, California Education Code § 49073.1, FERPA, and the California Consumer Privacy Act. We apply the protections in this Policy to every School, whether or not a particular statute reaches it.

6. Who We Share Information With

6.1 Service Providers. We use a small number of third-party providers for hosting and database services, authentication, email delivery, and error monitoring. They may process information only as needed to provide those services to us, are bound by written confidentiality and security obligations, and may not use it for their own purposes. A current list of these providers is available to any School on request.

6.2 At the School’s Direction. We share information with the School itself and with anyone the School directs us to share it with.

6.3 Legal Process. If we receive a subpoena, court order, or similar demand for Student Data, we will notify the School before responding unless the law prohibits it, so the School may object or seek protection.

6.4 Successors. If Risen is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. Any successor will be bound by the commitments in this Policy and in the Terms of Service, and we will notify affected Schools.

6.5 No Sale or Advertising. We do not sell, rent, or trade personal information, and we do not disclose it to advertising networks or data brokers.

7. How Long We Keep Information

We keep information only as long as it is needed for the purposes described in this Policy:

• Student Data is kept for the term of the School Agreement. When the Agreement ends, or when a School removes a Student or asks us to delete a Student’s information, we delete or de-identify the applicable Student Data within thirty (30) days.
• School and Educator account information is kept for the term of the School Agreement and deleted or de-identified within thirty (30) days after it ends.
• Support communications are kept for up to two (2) years after the request is resolved.
• Technical and error logs are kept for up to twelve (12) months.
• Routine backups are overwritten in the ordinary course and any copy of deleted data in a backup is removed within sixty (60) days.
• De-identified data may be kept indefinitely, as described in Section 10.

We keep information longer only where the law requires it. Schools should export anything they wish to keep before their Agreement ends.

8. Security

We maintain administrative and technical safeguards intended to protect information against unauthorized access, destruction, use, modification, and disclosure. Access to Student Data is limited to the Educators of the School it belongs to and, within Risen, to the people who need it to operate or support the Service. Every provider that processes information for us is bound by written confidentiality and security obligations. A School may request a description of our current security practices at any time.

While we work to protect the information entrusted to us, no system can be made entirely secure.

9. Security Incidents

If we confirm unauthorized access to or disclosure of Student Data, we will notify the affected School without undue delay and no later than seventy-two (72) hours after confirming the incident. The notice will describe what happened, what information was involved, what we are doing in response, and what we recommend the School do. We will cooperate with the School’s response, including any notifications the School must make to parents or authorities.

10. Parent and Student Rights

10.1 How to Exercise Them. Parents, guardians, and eligible Students may review their child’s Student Data, ask for corrections, or ask that it be deleted by contacting their School. The School will coordinate with us.

10.2 Our Response. We respond to School requests promptly and in time for the School to meet its own legal deadlines, and in no case later than thirty (30) days.

10.3 Why Requests Go Through the School. Student Data belongs to the School, and the School is the party able to verify who is making a request. We do not act on a request about a Student from anyone other than the School unless the law requires it.

11. De-Identified Data

We may use data that has been de-identified so that it cannot reasonably identify any Student or School to operate, evaluate, and improve the Service and to develop new features. We will not attempt to re-identify it and will not share it in a form that could reasonably identify a Student or School.

12. No Artificial Intelligence

The Service does not include any artificial-intelligence, machine-learning, chatbot, or automated question-answering feature. We do not send Student Data to any artificial-intelligence service and we do not use Student Data to train any model.

13. Third-Party Links

The Service may link to third-party websites or resources, such as Scripture or Church resources. This Policy does not apply to those sites, and we are not responsible for their privacy practices.

14. Changes to This Policy

We may update this Policy. We will post the updated Policy, update the “Last Updated” date above, and notify Schools of material changes by email or in-product notice. Where a change would materially reduce the protection of Student Data, we will give Schools advance notice.

15. Contact Us

Questions about this Policy or about a Student’s information may be directed to:

Risen
Email: contact@risenforschools.com

Parents and guardians with questions about their child’s information should contact their School first, which will coordinate with us. For requests relating to California privacy rights, please include “California Privacy Rights” in the subject line.

This Privacy Policy is effective as of the date last updated above.