Student Data Commitments for Schools
Gallop Learning Academy, operated by Lotus Farm LLC · Version 1.0 · Last updated 23 August 2026
What this document is. These are the commitments Gallop makes to a school, district, charter school or homeschool program that uses the classroom side of the product. They are written to be read by an educator, a data-privacy officer and a lawyer, and they become contractually binding when both parties sign — either by countersigning this document or by executing your own agreement, which we are glad to do instead. Nothing here is legal advice to you; your counsel should read it as they would any vendor agreement.
The short version
- The school owns the records. We hold them to run the service for you and for nothing else.
- We never sell student data, never advertise to students, and never build a profile for any purpose other than teaching that student.
- We collect very little — a first name, a grade, an avatar, a hashed 4-digit PIN, and the learning activity the student generates.
- You can export everything at any time, as CSV, at class or school level, with no request and no fee.
- You can delete everything at any time, and we will confirm it.
- Children cannot type free text to anyone — not to another user and not to an AI.
- We will sign your paperwork, including state addenda, rather than insisting on ours.
1. Who this applies to, and when
This document governs Student Data generated on the classroom side of Gallop: accounts created as school or teacher accounts, classes created within them, and the learner profiles that belong to those classes.
It does not govern family accounts. When a parent signs up directly and creates a learner profile for their own child, that relationship is governed by our Privacy Policy and Terms, and the parent — not a school — is the one who consents and controls the data.
2. Definitions
- School — the school, district, charter school, homeschool program, co-op or other educational organization using the classroom tools.
- Student Data — information relating to an identified or identifiable student that the School or its students provide to Gallop, or that Gallop generates about a student in the course of providing the service. This includes education records as defined by FERPA.
- Educational Purpose — providing, maintaining, supporting and improving the learning service for the School and its students, and producing the reports the School uses to teach them. Nothing else.
- Sub-processor — a third party engaged by Gallop that processes Student Data in the course of running the service.
3. Our role under FERPA
When Gallop processes Student Data for a School, Gallop acts as a school official with a legitimate educational interest under the FERPA school-official exception (34 CFR § 99.31(a)(1)). Accordingly:
- Gallop performs a function the School would otherwise use its own employees for.
- Gallop is under the direct control of the School with respect to the use and maintenance of education records.
- Gallop uses Student Data only for the Educational Purpose and does not redisclose it except as this document permits or the law requires.
- The School determines who within its organization may access the records. Reads across a school are scoped to that school; a teacher sees their own classes.
4. Our role under COPPA
COPPA permits a school to provide consent on a parent's behalf for the collection of personal information from students under 13, where the information is used solely for an educational purpose and for no commercial purpose. Gallop relies on that mechanism for classroom accounts, and in exchange commits that:
- Student Data is used solely for the Educational Purpose;
- Student Data is never used for advertising, marketing to students, behavioural profiling, or any commercial purpose;
- Student Data is never sold, rented, or licensed;
- Gallop will, on request, give the School the means to review and to delete a student's information;
- Gallop will not change these practices for classroom accounts without written notice to the School.
The School is responsible for providing parents with notice of the services it has authorized, consistent with its own obligations and policies. We will supply whatever description of the service you need in order to do that, and we would rather you over-inform parents than under-inform them.
5. What we collect about a student — the whole list
| Collected | Why |
|---|---|
| First name (or whatever name the teacher enters) | So the student can find their own profile and the teacher can read the roster |
| Grade level | The floor and starting point for placement |
| Avatar choice | Recognition for young children who cannot yet read a roster |
| 4-digit PIN, stored hashed | So one student cannot open another's profile |
| Learning activity — questions answered, right or wrong, skill mastery, time on task, badges, game scores | The service itself: placement, adaptation, and the reports the teacher reads |
We do not collect a student's email address, phone number, home address, precise geolocation, photographs, biometric data, health data, disciplinary records, free-form writing, or any social media identifier. We do not ask for a last name and do not need one.
6. Use limitations — what we will never do
- We will never sell, rent or license Student Data.
- We will never use Student Data for advertising, or to build a profile of a student for any purpose other than teaching that student inside Gallop.
- We will never disclose Student Data to an advertising network, data broker or analytics platform. The product refuses to fire a marketing tag while a learner is signed in — a boundary implemented in the code, not only stated in a policy.
- We will never allow a child to send free-form text to another person or to any AI, anywhere in the product.
- We will never send children's learning data to a third-party AI service.
- We will never use Student Data to train a third-party machine-learning model.
- We will never require a School to accept advertising, sponsorship or upsell shown to students as a condition of use.
7. Ownership, access and control
Student Data remains the property of the School (or of the parent and student, as your state law provides). Gallop claims no ownership of it and acquires no right to use it beyond the Educational Purpose.
- Access — an authorized teacher sees their classes; an authorized head of school sees every class in the school. Reads are scoped; writes stay with the teacher who owns the class, so an administrator can review without silently altering a roster.
- Export — CSV export of roster and progress at class level and at school level, available in the product at any time, with no request to file and no fee. Printable per-student and whole-class reports are available on the same terms.
- Correction — a teacher can correct a student's name or grade, reset a PIN, or reset a student's progress directly.
8. Retention and deletion
- We retain Student Data only while the School's account is active and the student is enrolled in a class.
- A teacher can delete a student's learner profile and its associated learning data from within the product at any time. Deletion is immediate in the live system.
- On written request from an authorized representative of the School, we will delete all Student Data for the School and confirm in writing within 30 days.
- On termination, we will delete all Student Data within 60 days unless you ask us in writing to hold it longer for a transition, or to return it first.
- Deleted data is removed from live systems immediately and expires from encrypted backups on the ordinary backup rotation, which does not exceed 90 days.
- Limited billing and correspondence records may be retained where required by law. Those contain no Student Data.
9. Security
- All traffic is encrypted in transit (HTTPS/TLS).
- Parent and teacher passwords are hashed with scrypt. Student PINs are stored hashed. Neither is recoverable by us in plaintext.
- Backups are encrypted, and the encryption passphrase is never transmitted with a backup.
- Access to production data is limited to the people who operate the service, which today is the two founders.
- Data is hosted in the United States.
- Children cannot make purchases, cannot communicate with other users, and cannot reach any part of the product that is not learning material.
10. Sub-processors
We keep this list short on purpose. Student Data is processed only by:
| Purpose | What they see |
|---|---|
| Cloud hosting and database | The application data, encrypted in transit and at rest in backups |
| Transactional email delivery | Adult recipient addresses and the content of the emails we send to teachers and parents. Reports name students to the adult who is already entitled to see them. |
| Payment processing | No Student Data at all. Billing is between Gallop and the paying adult or organization. |
We will give the School written notice before adding a Sub-processor that would process Student Data, and we will provide the current list on request.
11. Incident and breach notification
If we become aware of an unauthorized acquisition of, or access to, Student Data, we will:
- notify the School's designated contact without unreasonable delay, and in any case within 72 hours of confirming the incident;
- describe what happened, what data was involved, and what we are doing about it;
- cooperate with the School's own notification obligations, and not make a public statement naming the School without consulting it first, except where the law requires;
- bear our own remediation costs.
12. Parent and student rights
On the classroom path, the School is the point of contact for parents. A parent who asks us directly about a classroom learner will be directed to the School, because the School — not Gallop — decides what is disclosed from its own education records. We will support the School promptly in responding to any request to inspect, correct, or delete a student's data.
13. Accessibility
Gallop is built to WCAG 2.1 Level AA and Section 508, and that scope explicitly includes the classroom tools. Our accessibility statement is written to be the honest basis for a VPAT and includes a section naming what we have not yet verified — including testing with real assistive-technology users. Ask and we will send it as it stands rather than a version tidied up for procurement.
14. What we cannot yet claim
A vendor page that only lists strengths is not much use to a data-privacy officer, so here is the other side, in writing:
- No SOC 2, ISO 27001 or third-party security audit. We are a two-person company and have not been through one. If your district requires a current SOC 2 report, we will not pass that gate this year.
- No SIS rostering integration — no Clever, ClassLink or OneRoster sync today. Rostering is paste-a-list or a self-join code, and export is CSV.
- No single sign-on with Google or Microsoft. Students use a first name and a 4-digit PIN.
- No published third-party efficacy study. We will not describe Gallop as evidence-based under ESSA, because we have not earned that description.
- No signed state-specific addendum on file by default. We complete them per district, on request, during the pilot.
If any of these is a hard requirement for your purchase, tell us on the first call. We would rather lose the sale than be a platform your teachers cannot actually use.
15. Term, termination and transition
These commitments apply for as long as Gallop holds Student Data for the School, and the obligations in sections 6, 8, 9, 10 and 11 survive termination until the data is deleted. Either party may terminate a pilot at any time. On termination the School may export everything first, and we delete on the timetable in section 8.
16. Your agreement instead of ours
We will review, complete and sign your district's data privacy agreement, your state's addendum, or a standard framework agreement, rather than insisting on this document. Send it with your pilot request and we will work through it while the pilot runs. Where your agreement and this document conflict, yours governs.
17. Changes to these commitments
We will not weaken these commitments for an existing School without written notice and a reasonable opportunity to terminate and take your data with you. We will post the version and date at the top of this page whenever it changes.
18. How to put this in place
Email support@learnwithgallop.com with your school name, the name and title of your authorized signer, and either your own agreement or a request to countersign this one. We will return a signed copy. If you are still evaluating, you do not need any of this to start — ask us for a pilot and the paperwork can run alongside it.
Contact
Gallop Learning Academy · Lotus Farm LLC · support@learnwithgallop.com
For privacy and data-protection questions, use the same address and put “data protection” in the subject line; it routes to the founders directly.