Privacy Policy

ReadBase operates in strict compliance with federal and state student data privacy laws, including:

Under FERPA, ReadBase operates as a "school official" — a service provider acting on behalf of the School with a legitimate educational interest. All student education records entered into the Platform remain the property of the School. ReadBase does not disclose student records to any third party without written consent from the School, except as required by law.

Under COPPA, students never interact with the Platform directly and ReadBase does not knowingly collect personal information from children under 13. All data is entered exclusively by authorized adult school personnel.

Under NY Education Law § 2-d, ReadBase implements data security protections appropriate for a covered educational entity and does not use student data for any commercial purpose.

ReadBase does not allow direct student self-registration or student logins. All student data is entered exclusively by authorized school administrators, Rebbis, teachers, or reading specialists. We collect:

• Educator Account Information — Name, email address, school affiliation, and a secure numeric access PIN created during registration.
• Parent Contact Information — Parent or guardian email addresses provided by the School from its own institutional records and uploaded on the parent's behalf. Where a school has activated the Parent Portal (see Section 3), parents may also interact directly with the Platform using their email address as their login credential.
• Roster & Assessment Data — Student first and last names, grade level, assigned class, assessment dates, and Hebrew reading performance metrics — including words correct per minute (WCPM), error logs, and self-correction tallies.
• Audio Recordings — If explicitly enabled by school administration, the application utilizes the device microphone to capture audio clips of Hebrew reading assessments for educator review. Audio recordings are stored in the School's isolated cloud environment and are deleted in accordance with Section 6 of this Policy.
• Technical & Session Data — Browser type, device type, and session state stored locally on the educator's or parent's device (via browser localStorage) to maintain login sessions. This data is never shared with third parties.

Schools may optionally activate the ReadBase Parent Portal, which allows parents and guardians to view their child's Kriah progress and engage with assigned homework activities. The following terms apply when the Parent Portal is in use:

• School-Initiated Access — Parent Portal accounts are created exclusively by the School. A parent cannot self-register. The School inputs the parent's email address and issues an invitation; the parent activates their account via that invitation link.
• What Parents Can Access — Once enrolled, a parent can view their child's Kriah assessment results and progress over time, nightly homework assignments posted by the teacher, and communications or notes sent by the Rebbi or reading specialist.
• Student Interaction — The Parent Portal is designed so that the student does not log in or interact with the Platform directly. A parent or guardian navigates the portal on behalf of their child, including any assigned homework activities. The student's device interaction, if any, occurs under the parent's active supervision and authenticated session.
• Data Collected from Parents — When a parent uses the Portal, we collect login activity (timestamp and session duration) and any actions taken within the portal (e.g., marking homework as completed). We do not collect any additional personal information beyond what the School has already provided.
• Parent Data Rights — A parent may request removal from the Parent Portal at any time by contacting their school administrator or emailing support@readbase.org. Removal from the portal does not affect the underlying student assessment records held by the School.

We use collected data strictly to provide the educational functionalities of ReadBase — including student progress charts, class benchmark analyses, and color-coded reporting dashboards.

All data managed by ReadBase is protected using industry-standard administrative, physical, and technical safeguards:

• In Transit — All data transmission is encrypted via secure HTTPS/TLS connections.
• At Rest — Databases and file storage are securely isolated and encrypted at rest, utilizing certified enterprise cloud infrastructure operating under strict data processing agreements.
• Isolation — Multi-tenant access controls ensure that data from one school is strictly inaccessible to any other school on the Platform.
• Role-Based Access — Teachers, specialists, and administrators each access only the data their assigned role permits.

No system can guarantee absolute security. The School is responsible for maintaining the confidentiality of access PINs and promptly reporting any suspected unauthorized access to support@readbase.org.

Data is retained only for the duration of the school's active service agreement. Upon termination or expiration of a subscription, ReadBase will preserve the School's records for a grace period of thirty (30) days, during which a data export may be requested. Following this window, all student personal data will be securely and permanently purged from production servers.

Upon written request by an authorized school official, ReadBase will securely export or purge all student personal data within thirty (30) days of receiving the request. To submit a deletion request, contact support@readbase.org.

Service Providers. ReadBase engages certified enterprise cloud infrastructure providers to store and process data on our behalf, under strict data processing agreements that prohibit those providers from using school or student data for their own purposes. We do not share data with any other third parties.

Legal Disclosures. We may disclose information if required by law, valid court order, or governmental regulation, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of ReadBase, its users, or the public.

Business Transfers. In the event of a merger, acquisition, or sale of assets, school and student data would only be transferred to a successor entity that agrees in writing to honor this Privacy Policy and all applicable legal obligations regarding student data.

ReadBase may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. If we make material changes, we will notify registered school administrators via the email address on file at least thirty (30) days before the updated Policy takes effect. Your continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

For questions regarding this Policy, to exercise data review rights, or to submit a deletion request, please contact us: