Privacy Policy

Who We Are

My Progress Report ("Progress Report," "we," "our," or "us") is an educational technology platform operated by 8P3P, Inc., a company incorporated in the United States. Progress Report provides K–12 educators, schools, and districts with AI-assisted instructional intelligence — including individualized learning plans across Math, English Language Arts, Science, and Social Studies — along with IEP/504 support tools and bilingual (English/Spanish) delivery.

This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our platform, website (myprogressreport.com), and any associated applications or services (collectively, the "Service"). It applies to all users: educators, school administrators, students, parents or guardians, and visitors to our website.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please discontinue use of the Service.

Information We Collect

Information You Provide Directly

• Account registration: Name, email address, role (teacher, administrator, parent/guardian), school or organization name, and a password or SSO credential.
• Student records: Educators or school administrators may upload or enter student names, grade levels, subject enrollment, IEP/504 plan details, assessment results, and instructional notes on behalf of their school or district.
• Communications: Information you provide when you contact our support team, submit a waitlist form, or respond to surveys.

Information Collected Automatically

• Usage data: Pages visited, features used, time spent, click paths, and error logs — collected to improve the Service and diagnose issues.
• Device and browser data: Browser type, operating system, screen resolution, and IP address (used for security and fraud prevention; not linked to student identity).
• Language preference: Your selected language (English or Spanish), stored in a first-party cookie and localStorage for consistent delivery across sessions.

Information We Do Not Collect

How We Use Information

We use the information we collect solely for educational and operational purposes:

• Delivering the Service: Generating individualized learning plans, instructional recommendations, decision histories, and IEP/504 support outputs for each enrolled student.
• Personalization: Adapting content language (English or Spanish) and subject tracks to match educator and student settings.
• Platform improvement: Analyzing aggregate, de-identified usage patterns to improve accuracy, reliability, and new features. We do not use individually identifiable student data to train machine-learning models.
• Security and integrity: Detecting and preventing unauthorized access, fraud, and abuse.
• Legal compliance: Meeting obligations under applicable federal and state law, including FERPA, COPPA, and applicable state student privacy statutes.
• Communications: Sending account-related notices, product updates, and (where you have opted in) pilot or waitlist notifications. You may opt out of non-essential communications at any time.

How We Share Information

We do not sell student data. We share information only in the following limited circumstances:

With Your School or District

Educators, administrators, and other authorized school personnel within your institution can access student records for students enrolled in their classrooms or under their supervisory authority. Access is role-controlled and logged.

With Service Providers (Sub-processors)

We engage carefully vetted third-party technology providers to operate and improve the Service — including cloud hosting, authentication, and infrastructure services. Each sub-processor is bound by data processing agreements that:

• Prohibit use of student data for any purpose beyond operating the contracted service
• Require the same level of data protection we provide
• Mandate deletion or return of data upon contract termination

Our primary sub-processors include: Cloudflare, Inc. (infrastructure and edge delivery) and Clerk, Inc. (authentication). We maintain an up-to-date sub-processor list and notify schools of material changes.

Legal Requirements

We may disclose information when required by law, court order, or government authority — or when necessary to protect the rights, property, or safety of 8P3P, Inc., our users, or the public. We will notify affected schools or users where legally permitted before any such disclosure.

Business Transfers

In the event of a merger, acquisition, or sale of substantially all assets, student data will not be transferred unless the successor entity agrees in writing to be bound by this Privacy Policy and all applicable student privacy laws. Schools will be notified at least 30 days before any such transfer and may request data deletion prior to transfer.

Student Privacy — Federal and State Law

FERPA — Family Educational Rights and Privacy Act

Progress Report operates as a "school official" under FERPA (34 C.F.R. § 99.31(a)(1)). Schools and districts provide student education records to us under a formal Data Processing Agreement. We use those records only to perform contracted educational services, operate under the direct control of the school, and do not re-disclose records without authorization. Schools retain ownership and control of all student education records at all times.

COPPA — Children's Online Privacy Protection Act (2025 Rule)

For students under 13, Progress Report relies on school-provided consent obtained through our Data Processing Agreement, which schools execute on behalf of parents for educational purposes only. In compliance with the FTC's 2025 COPPA Rule (effective April 2026):

• We do not collect biometric identifiers from students under 13
• We do not share personal information of students under 13 with advertising networks or third-party data brokers
• We maintain documented consent records and justify all data we retain beyond immediate educational purposes
• Student data is deleted within 30 days of contract termination or upon verified parent/guardian request

State Student Privacy Laws

Progress Report is designed to meet or exceed the requirements of major state student privacy statutes, including:

• California SOPIPA (SB 1177) and AB 1584: No targeted advertising to students; no sale, use, or disclosure of student data for non-educational purposes; no AI training on identifiable student data (California AB 1159); mandatory data deletion on request; school retains full data ownership.
• New York Education Law 2-d: We provide a plain-language Parents' Bill of Rights upon request; we maintain alignment with the NIST Cybersecurity Framework; a designated data protection contact is available (see Contact Us).
• Texas SCOPE Act: We do not share, disclose, or sell personal identifying information of minors under 18 without school-authorized consent. We cooperate fully with Texas AG inquiries.
• Illinois SOPPA: We do not use student data for advertising, do not build profiles on students for non-educational purposes, and provide timely data deletion.

AI and Deterministic Decision-Making

Progress Report uses AI to generate instructional recommendations, not to make autonomous high-stakes decisions about student placement, discipline, or advancement. Every recommendation is reviewed and approved by a licensed educator before it takes effect. We do not use individually identifiable student data to train, fine-tune, or improve underlying AI models without explicit school authorization and full de-identification. Human oversight is built into every decision workflow.

Data Security

We implement administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction. These safeguards include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS enforced site-wide).
• Encryption at rest: Student records and PII are encrypted at rest using industry-standard AES-256 encryption.
• Access controls: Role-based access control (RBAC) ensures only authorized personnel with a legitimate educational need can access student data. Access is logged and auditable.
• Authentication: Multi-factor authentication (MFA) is available for all accounts and required for administrative roles.
• Infrastructure: We operate on Cloudflare's globally distributed edge infrastructure, which provides DDoS protection, WAF (Web Application Firewall), and continuous availability monitoring.
• Security assessments: We conduct periodic security reviews and vulnerability assessments. We perform annual cybersecurity assessments in compliance with the 2025 COPPA Rule.

In the event of a security incident affecting student data, we will notify affected schools within 72 hours of confirmed discovery, consistent with California, Illinois, and best-practice breach notification standards. We will provide a clear description of the incident, the data affected, remediation steps taken, and guidance for parents and guardians.

Data Retention and Deletion

We retain student data only as long as necessary to fulfill the educational purposes for which it was collected and as required by applicable law.

• Active contracts: Student data is retained for the duration of the school's active subscription or Data Processing Agreement.
• Contract termination: Upon expiration or termination of a school's agreement, we will securely delete or anonymize all associated student data within 30 days, unless a longer period is required by law or the school requests an export.
• Parent or guardian requests: Verified parents or guardians may request deletion of their child's data by contacting the school, which will coordinate the request with us. We will complete deletion within 30 days of a verified request.
• Educator accounts: Educator account data is retained for 12 months after account closure and then deleted, unless required by law.
• De-identified aggregate data: We may retain statistical, de-identified, non-personally-identifiable aggregate data (e.g., subject-level performance trends across a grade level with no individual identifiers) for research and platform improvement indefinitely.

Your Rights and Choices

Educator and Administrator Rights

• Access and correction: You may view and update your account information at any time from your account settings page.
• Data export: Authorized school administrators may request an export of all student data associated with their school or district at any time.
• Account deletion: You may close your account and request deletion of your personal data by contacting privacy@8p3p.io. We will complete deletion within 30 days.

Parent and Guardian Rights (FERPA)

Under FERPA, parents and guardians have the right to inspect and review their child's education records, request corrections, and consent to or opt out of certain disclosures. Because Progress Report receives student data from schools acting as data controllers, parents should direct FERPA requests to their child's school. We will cooperate fully with all verified school-directed requests.

California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA, including the right to know what personal information we collect, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise CCPA rights, contact us at privacy@8p3p.io.

Language and Communication Preferences

You may switch the platform language between English and Spanish at any time using the language toggle on any page. This preference is stored in a first-party cookie and local browser storage — not associated with your account identity unless you are signed in.

Cookies and Tracking Technologies

We use a limited set of first-party cookies and browser storage to operate the Service. We do not use third-party advertising cookies or cross-site tracking technologies.

Cookies We Use

• Authentication session (essential): Required to keep you signed in. Expires at session end or after 30 days if "Remember me" is selected.
• Language preference (mpr_lang, essential): Stores your English/Spanish preference for consistent delivery across page visits. Expires after 1 year.
• Platform analytics (first-party, operational): Anonymous session-level data to measure feature usage and diagnose errors. No personal identifiers. Cloudflare edge analytics only — data stays within our infrastructure.

You may disable non-essential cookies through your browser settings. Disabling the authentication cookie will prevent sign-in. Disabling the language cookie means your language preference will reset on each visit.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the features of the Service. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to the primary contact on file for each school or district account
• Display a banner notice on the platform for at least 14 days following the change

Continued use of the Service after the effective date of a revised Policy constitutes acceptance of the changes. If you do not agree with material changes, you may close your account by contacting us at privacy@8p3p.io.

Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, request a Data Processing Agreement, or report a privacy concern, please contact our Data Protection team: