Data Security and Privacy Plan

Data Security and Privacy Plan for educational agencies · Version 1.2 · 2026-10-06 · prepared to New York Education Law §2-d and 8 NYCRR Part 121

This is the Data Security and Privacy Plan Kudo Kids, LLC issues to the educational agencies it serves. It is published at https://kudokids.org/data-security-plan; each version carries a number and date, and Part 6 governs revisions. In this plan, "the Agency" means the educational agency — a school district or BOCES — party to the agreement under which KudoKids provides the Services, and "the Agreement" means that agreement. Where the Agreement, or the student-privacy law of the Agency's state, is more protective than this plan, that requirement governs. This plan describes KudoKids' practices; it does not expand the Agreement or create rights in any third party.

1.1 What this plan covers. The Services are the school-program services described in the Agreement, which connect the Agency to the KudoKids family app: sponsored access for families, the agency-facing School Hub, and the other services the Agreement describes. The family app itself is a consumer service families obtain directly from KudoKids under its own Terms of Service and Privacy Policy. This plan describes how Kudo Kids, LLC protects the personal information involved in delivering the Services, for the life of the Agreement.

1.2 No Student Data is received from the Agency. KudoKids receives no roster, student identifier, student record, or report keyed to identifiable students from the Agency, and nothing identifying which families participate moves back to the Agency, except at a parent's own election. Families enroll directly; the parent or guardian is the account holder and the consenting party. KudoKids does not request, solicit or knowingly accept personally identifiable information from student records. Information of that kind that arrives anyway is reported to the Agency's named notice recipient promptly on awareness, is not used, and is deleted with written certification within five business days unless the Agency directs otherwise.

1.3 What the safeguards protect. Personal information families give KudoKids directly under their own accounts, described in the published Privacy Policy; program personal information held in connection with the Services, including the association between a family account and the Agency's join link; Agency documents held in the School Hub; and the Agency staff accounts that hold School Hub seats. The safeguards below apply to all of them, and would apply to Student Data from the Agency in the same way. Program personal information that falls within the Agreement's definition of Student Data is treated as Student Data under the Agreement, and the processors that hold it are bound under Part 2(5).

(1) How KudoKids implements the Agreement's data security and privacy requirements over the life of the contract, consistent with the Agency's policy

• Standard. KudoKids adopts the NIST Cybersecurity Framework 2.0 (which carries forward the CSF 1.1 functions) as the organizing standard for its security program for the life of the Agreement, with no exclusions, variations or exemptions. Part 3 maps its practices to all six Framework functions.
• Compliance. KudoKids complies with the data security and privacy requirements of the Agreement, with Education Law §2-d and 8 NYCRR Part 121, and with the Agency's own Data Security and Privacy Policy and Parents' Bill of Rights as attached to or referenced in the Agreement.
• Published, versioned commitments. KudoKids' published Privacy Policy contains its written data-retention policy and its security summary, and KudoKids applies to sponsored families no change to those documents that materially reduces the protections described in the Agreement, except as the Agreement provides and on the terms in Part 6.
• Review. This plan, its written information security program and the processor list are reviewed at least annually by the Security Coordinator, and promptly after a material incident or material change to the Services. A change that affects the Agency is communicated to it in writing.

(2) Administrative, physical, operational and technical safeguards

Administrative. A designated Security Coordinator owns this plan, the written information security program, risk assessment, processor oversight and incident response, and is reachable at security@kudokids.org. Access to personal information is limited to personnel with a business need for it; each is trained before access is granted (Part 2(4)), access is recorded, and access is reviewed quarterly and removed when the need ends. Multi-factor authentication is required on the production infrastructure consoles listed in the WISP. KudoKids maintains a Written Information Security Program, a Written Incident Response Plan and a written data-retention policy, and runs a quarterly risk assessment — data-flow, processor and access review — with findings tracked to resolution and severity driving priority.

Operational. Account credentials are held by a parent or guardian. A child uses the app through a profile inside a parent's or guardian's family account; any child access is configured and controlled by the parent. Credentials are stored in hashed form and authentication is rate-limited. Family data is segregated so that access is limited to that family's account holder, to KudoKids personnel with a business need, and, where a parent enables a sharing feature, to the families that parent has approved; the segregation is enforced in the data platform itself and is covered by automated tests. The School Hub returns program counts and averages, including survey results, not keyed to identifiable students, and Agency documents are held in private storage scoped to the Agency. KudoKids practises data minimization: it does not ask for photographs, video or audio of children, precise geolocation, child contact information, advertising identifiers or biometric templates. Features that use a device's microphone or camera process on the device; KudoKids stores no camera image, audio recording or facial measurement from those features, and holds no data derived from a child's face, body or physiological signals. KudoKids does not use personal information to train artificial-intelligence models. KudoKids uses no advertising networks, analytics SDKs or data brokers in the app, does not sell or rent children's personal information or program personal information, does not use children's personal information or program personal information for any commercial or marketing purpose, and does not use a family's participation or the Agency's name as the basis for an offer to that family. A parent can review their child's information, delete a child profile, delete the family account, export the family's data and pause non-essential collection, in the app or by emailing privacy@kudokids.org; requests are honoured within thirty days, or sooner where an agreement or applicable law requires.

Technical. Personal information held in KudoKids' systems of record is encrypted in transit and at rest, including backups, using industry-standard encryption — at least TLS 1.2 in transit and AES-256 at rest — meeting the definition of encryption at 45 CFR §164.304; private file storage is served through authenticated, short-lived links. Primary storage of program personal information is in the United States and is not moved outside the United States without the Agency's prior written consent. A list of storage locations is available to the Agency on request. Production hosting is with a cloud database, authentication and storage provider that hosts in the United States and maintains an independently audited security program. Credentials and secrets are held in managed secret stores, not in source control, and are rotated when access changes or compromise is suspected. KudoKids runs error and anomaly monitoring with alerting, dependency vulnerability review, and automated test coverage of its authentication and data-access code, including the family-isolation controls.

Physical. KudoKids holds no servers and no paper records. Personal information lives in managed cloud infrastructure whose provider maintains the physical safeguards of its facilities; the devices KudoKids' own personnel use are encrypted, locked when unattended, and governed by the written information security program.

(3) Parents' Bill of Rights — supplemental information (8 NYCRR §121.3(c))

(4) Training

Every employee, contractor and assignee of Kudo Kids, LLC with access to program personal information — and every person who would have access to Student Data from the Agency were any ever received — completes privacy and security training before access is granted and at least annually thereafter, covering COPPA (16 CFR Part 312), FERPA (34 CFR Part 99), the student-privacy and breach-notification law of the Agency's state (for a New York agency, Education Law §2-d and 8 NYCRR Part 121 including the Parents' Bill of Rights), KudoKids' data-handling procedures, incident reporting, and privacy by design. KudoKids requires processors with access to such information to train their personnel before access. Training records are kept for at least three years.

(5) Subprocessors

KudoKids uses processors to deliver the Services. The current list, with each processor's purpose, is published and maintained at kudokids.org/subprocessors; recipients of children's personal information are also named in the published Privacy Policy; where the Agreement attaches a dated processor list, that list governs for the Agency. Each processor is engaged under written data-processing terms requiring it to protect personal information, to use it only to provide its service to KudoKids, to hold no property or licensing rights in it, and to be bound by the restrictions KudoKids accepts. Each is reviewed before engagement and at least annually thereafter, and where a processor fails to meet those requirements, KudoKids notifies the Agency, removes its access, and retrieves or destroys the information it holds.

(6) Managing data security and privacy incidents, and notifying the Agency

KudoKids maintains a Written Incident Response Plan covering detection, containment, notification, remediation and post-incident review; a summary is available to the Agency on request. Its terms:

• Detection and containment. Automated platform and monitoring alerts, internal reports and parent reports through support channels; then immediate revocation of access, disablement of the affected path, preservation of evidence and scope assessment. An incident touching children's information is escalated to the highest severity.
• Notification — within 72 hours, or sooner where the Agreement or applicable law requires — of KudoKids discovering, or having a reasonable basis to believe, that personal information relating to a participating family in KudoKids' or a processor's custody was accessed, acquired, used, disclosed or lost without authorization: an initial written Notice of Data Breach to the Agency's named notice recipient carrying, so far as then known, the information the Agreement requires, then a written incident report as the facts settle. The clock runs from discovery or reasonable belief, not from internal confirmation.
• Parent statement. KudoKids prepares the parent and eligible-student statement under the headings the regulation requires, and gives the Agency the proposed wording and timing with not less than 24 hours to comment before release unless a legal deadline prevents it. A statement naming the Agency requires its prior written approval.
• Regulators under law. Where the law places a notification duty on KudoKids, KudoKids performs it on the statutory timetable and does not wait for anyone's signature.
• Costs and cooperation. Where an incident is attributable to KudoKids or a processor, KudoKids pays or promptly reimburses the Agency's reasonable costs of investigation, containment, remediation and notification, as and to the extent the Agreement provides, and cooperates with the Agency, the education and privacy regulators of the Agency's state (in New York, the State Education Department's Chief Privacy Officer) and law enforcement.
• Post-incident. Root-cause review promptly after resolution; this plan and the written information security program are updated with any resulting change.

(7) Return, transition or deletion of data at termination or expiry

At the end of the Services, or at any time on the Agency's written direction, KudoKids deletes or destroys — or, at the Agency's election, returns in a usable electronic format — all program personal information and all Agency documents in its custody within thirty (30) days, and certifies in writing within five business days of completing it what it did. On transition to a successor contractor, KudoKids provides the Agency with its own documents and its program reporting — counts and averages not keyed to identifiable students — for onward transfer; there is no per-family or per-student dataset to transition, because none is held for the Agency. What the Agency's direction does not reach is personal information parents gave KudoKids directly under their own accounts and consents, which remains governed by the parents' own rights and the published retention policy — stated here rather than when a direction arrives.

Exceptions to deletion, each disclosed on the certificate: the join-link association where the licence renews or the Agency has given notice that renewal is anticipated, and anything under a legal hold. Neither exception reaches any other Student Data. Information parents gave KudoKids directly under their own accounts and consents is not held for the Agency and is governed as stated above, not by these exceptions.

KudoKids' written data-retention policy is published in its Privacy Policy, which sets a retention limit for each category of personal information and is enforced through automated deletion jobs and deletion on request. Deleting a child's profile, deleting the family account, or emailing privacy@kudokids.org removes information sooner. For the Services under the Agreement, program personal information, working files, the join-link association and Agency documents are kept for the periods the Agreement fixes and deleted at the end of the Services under Part 2(7) unless the licence renews; consent records are kept for the period the law requires.

For a New York agency, KudoKids complies with the Agency's Parents' Bill of Rights for Data Privacy and Security, which is deemed incorporated into this plan, and with the supplemental information requirements of 8 NYCRR §121.3(c), answered item by item in Part 2(3); the Agency's Parents' Bill of Rights is attached to or referenced in the Agreement. For an agency in another state, KudoKids complies with the corresponding parent-rights notice that its law or the Agreement provides.

KudoKids may update this plan. Each version carries a number and a date and is published at https://kudokids.org/data-security-plan; prior versions are available on request. A change that strengthens or clarifies a commitment, or that changes how a commitment is carried out — a processor, a facility within the United States, a person, a tool or a technical standard that meets the committed level of protection — takes effect on publication. KudoKids does not apply to the Agency a change that materially reduces the protections described in the Agreement except with the Agency's agreement or, where required by law or a regulator, on thirty days' written notice to its named notice recipient. Where the Agreement or the law of the Agency's state requires notice before a change, KudoKids gives that notice first. Until then, the prior version continues to apply.

New York's model plan asks a provider to show alignment with the NIST Cybersecurity Framework v1.1 category by category. KudoKids organises its practices under CSF 2.0 (Part 3), which carries the v1.1 functions forward. The table points each v1.1 category to the Part of this plan that addresses it; it adds no commitment beyond those Parts.