Privacy Policy

2.1 Categories of Personal Information

The Personal Information we process includes a child’s first/last name, the user’s (parent’s, teacher’s or school administrator’s) e-mail, the user’s (parent’s, teacher’s or school administrator’s) name, the child’s grade level, school, school address (or any other preferred mailing address for communications with school and teachers), the school administrator’s (or teacher’s, in rare cases) telephone number, username, password, data on students’ performance, and IP address.

District and school officials may provide a child’s first/last name, child’s grade level, teacher’s name, and e-mails, as well as the school, to monitor progress and identify students. Personal Information disclosed to us by districts and schools may be subject to additional regulation and protection measures set in the agreements signed with such districts and schools.

2.2 Accuracy of Personal Information and Account Names

Personal Information must be accurate and complete. Users are responsible for ensuring that all information provided to Happy Numbers is current, accurate, and truthful.

Regarding usernames and display names: If nicknames or fictitious names are used instead of legal names, they must:

• Not contain offensive, discriminatory, or inappropriate language

• Not impersonate another person

• Not contain profanity, hate speech, or references to violence

• Be appropriate for an educational environment

• Not violate any third-party rights

We reserve the right to: require users to change usernames or display names that violate these guidelines, suspend or delete accounts that use inappropriate names, delete accounts where deliberately false information has been provided, and request identity verification if we suspect inaccurate information has been provided.

Parents, guardians, and school officials must ensure that children's accounts comply with these requirements.

2.3 Data Ownership and Use Limitations

We don't claim ownership over your data and won't exploit it for unrelated marketing endeavors. Additionally, we uphold strict guidelines regarding children's data, refraining from collecting additional Personal Information from them or using your data to market products to minors.

6.1. Administrative and Operational Safeguards we use to protect your Personal Information:

Minimizing the Use, Collection, and Retention of Personal Information: We store the minimum information required for the proper functioning of our services. We collect minimum information from single sign-on (SSO) systems such as ClassLink and Clever.

Anonymizing Information: We use a unique tool to prepare databases for test and development environments with complete anonymization of Personal Information. Developers and QA engineers cannot access real personal data throughout the development lifecycle.

Access Enforcement: All employees have personal auditable accounts in all our systems. We use Single Sign-On to grant access to all internal systems. Critical applications, such as the admin panel, have role-based access control for different access levels.

Separation of Duties: We adhere to the principle of minimizing access, which means that, for instance, a content manager can access the BI system with de-identified student problem-solving logs, but they do not have access to the admin panel with Personal Information.

Least Privilege: Our internal systems use a role-based access control model to grant each employee the minimum required access level.

Remote Access: All communication with our servers and systems is encrypted using battle-tested protocols, such as enforced HTTPS with TLS 1.2, SSH, and OpenVPN.

Auditable Events: We collect all change events in our SSO system and admin panel and store them in a database without making any modifications.

Protection of Information at Rest: We store our backups in AWS S3 using the pgBackRest tool with AES-256-CBC encryption. Furthermore, our application servers transparently encrypt Personal Information using a symmetric cipher before storing it in an encrypted database.

Data Backup and Recovery: We continuously back up all production PostgreSQL databases using the pgBackRest tool and retain data for 30 days, including four weekly full backups.

Change Management: Our infrastructure is entirely managed by Infrastructure as Code (IaaC) tools, including a custom in-house CLI tool, Terraform, and Ansible. This means that all the changes can be reviewed through standard development procedures and stored in GitHub.

Employee Training: All employees complete mandatory security and privacy training upon hire and annual refresher training. Employees with access to Personal Information complete additional FERPA and COPPA compliance training.

Vendor Security Assessment: We conduct security assessments of all subcontractors who process Personal Information, including security questionnaires and data processing agreements.

6.2. Password Guidelines

We strive to ensure that your experience with Happy Numbers is one of utmost security and confidence. Your Personal Information is kept safe with a strong password. To ensure no one unauthorized gets into your account or accesses your Personal Information, you should choose a strong password, be careful about who has access to your computer and browser, and always remember to sign off when you are done using your account.

6.3 What We Will Do in Case of a Data Breach

In the event that we become aware of an unauthorized disclosure or data breach:

The district, school officials, and teachers will be notified within 24 hours by email if the teacher account or any related student accounts are affected. The appropriate person in the school or school district who has purchased the valid school-wide or district-wide Happy Numbers access will be notified by phone. The notification will include the date of the breach, the types of information that were subject to the breach, a general description of what occurred, and steps we are taking to address the breach.

8.1 Verification Process

Please note that to fulfill your request, we may need to obtain further information and documentation, including Personal Information, to confirm your identity and handle your request accordingly. Any additional information provided will be securely stored for legal purposes, specifically as evidence of the individual who submitted the request.

8.2 Access and Correction Rights

You may review, correct, update, or change your Personal Information anytime by accessing your Happy Numbers.com account settings. You can also contact your school or district administrator (for student accounts), email us at support@happynumbers.com, or call us at +1-800-815-1574 if you wish to update your data or have any questions about our privacy practices and your rights.

8.3 Deletion Rights and Account Termination

When Accounts May Be Deleted:

We may suspend or delete accounts under the following circumstances:

• Upon request by the account holder, parent/guardian, or authorized school official, we will delete any Personal Information within 7 business days from our website and within 30 days from our trusted third parties

• For violation of our Terms of Service, including use of inappropriate usernames or providing false information

• For prolonged inactivity (accounts inactive for at least one (1) school year)

• If we discover the account was created without proper parental/guardian consent

• For security reasons, such as a compromised account

• Upon termination of a school or district's subscription or contract termination

Deletion Process:

If you would like us to delete your account and your Personal Information from our system, please contact us using the information at the bottom of this page. Upon receiving a valid deletion request, we will:

• Immediately disable account access

• Delete Personal Information from our active systems within seven (7) business days

• Delete Personal Information from backups and third-party systems within 30 days

• Send confirmation of deletion to the requester

• Retain only minimal information required for legal compliance (such as records of the deletion request itself, transaction records for tax purposes, and records necessary to comply with FERPA requirements)

Exception: We may retain Personal Information if we have a legal obligation to retain the record, if retention is necessary to resolve disputes or enforce our agreements, or if required by a school or district agreement.

8.4 Data Retention

During Active Use: We store your Personal Information as long as it is necessary to provide the Services. Personal Information linked to your account will be retained until you decide to delete your account or until we no longer require the data to offer our Services.

After Service Termination: As soon as the Services are no longer in use by the district or school:

• Default deletion: We will delete all Personal Information, including the backups we and our trusted third parties hold, within 60 days after June 30th of the current calendar year

• Upon request: We will delete any Personal Information within seven (7) business days from our website and within 30 days from our trusted third parties

Data Portability: Upon request by the school or district, we can transfer any children's Personal Information to the school, district, or their designated third party.

9.1 Our Marketing Practices

Happy Numbers is committed to responsible and transparent marketing practices, particularly given our work with children and educational institutions.

We market our services exclusively to teachers, school administrators, parents, and school districts through professional development events, educational conferences, email campaigns, social media advertising (Facebook, Instagram, TikTok), search engine marketing (Google Ads), direct sales outreach including outbound calls to schools and districts (Sales Development Representatives may contact publicly available school and district contacts), display advertising on educational and parenting websites, content marketing through our blog, conference participation, educational webinars and workshops, and partnership programs with schools and educational organizations. We NEVER market directly to children under 18 years of age.

9.2 What We Advertise

Our marketing communications may include information about our educational programs and curriculum offerings, updates to features and new learning content, success stories and case studies (with permission and anonymized data), professional development opportunities for educators, pricing information and subscription offers, educational tips and best practices, and free trial opportunities.

For marketing purposes, we may use contact information you've provided (with consent), aggregated de-identified usage data to improve our marketing messages, demographic information to target appropriate audiences, and website analytics to understand how visitors interact with our marketing content.

We do NOT use student Personal Information for marketing purposes, student performance data for marketing or advertising, or any Personal Information from children for targeted advertising.

9.3 Opt-Out Rights

You can opt out of marketing communications at any time by clicking the "unsubscribe" link at the bottom of any marketing email, adjusting your communication preferences in your account settings, contacting us at support@happynumbers.com, or calling us at +1- 800-815-1574. Please note that even if you opt out of marketing communications, you will still receive transactional emails (account creation, password resets), service announcements and critical updates, legally required communications, and billing and subscription notifications.

9.4 Third-Party Marketing

We do not sell or rent your Personal Information to third parties for their marketing purposes. We do not allow third-party advertising on our educational platform or student-facing interfaces.

12.1. Personal Information We Collect:

In the last 12 months, we collected the following categories of Personal Information from our users (as described in Section 2 of our Privacy Policy):

• Identifiers (such as the child’s first/last name, the user’s (parent’s, teacher’s, school administrator’s) e-mail, the user’s (parent’s or teacher’s, the child’s grade level, school, school address, username, password), school administrator’s (or teacher’s, in rare cases) telephone number

• Internet or other electronic network activity information (such as browsing history, IP address)

• Inferences drawn from personal information (such as user preferences)

• Inferences drawn from personal information (such as user preferences)

• Education information regarding the child’s grade level

• Data on students’ performance

12.2. Purpose of Collection:

In the last 12 months, we used the Personal Information we collected for the purposes described in Section 5 of our Privacy Policy

12.3. Disclosure of Personal Information:

In the last 12 months, we disclosed the personal information we collected to the recipients in the way described in Section 7 of our Privacy Policy.

12.4. Your CCPA Rights:

As a California resident, you have the following rights under the CCPA:

• Right to know: You have the right to request information about Personal Information we may collect, use, and disclose;

• Right to delete: You have the right to request the deletion of your Personal Information;

• Right to opt-out: You have the right to opt out of the sale of your Personal Information. We do not sell personal data of California residents under 18 years old without their opt-in authorization or their parent/guardian's authorization. Opted-in residents can opt out of future sales at any time;

• Right to non-discrimination: We will not discriminate against you for exercising your CCPA rights.

12.5. FERPA and COPPA Compliance:

In addition to CCPA, we comply with the Family Educational Rights and Privacy Act (FERPA) and the Children's Online Privacy Protection Act (COPPA). We take appropriate measures to protect the privacy and security of personal information collected from children under the age of 13 by COPPA requirements. For educational records protected under FERPA, we ensure compliance with the applicable regulations.

We do NOT sell Personal Information. We have not sold personal information in the last 12 months and do not sell personal information of minors under 18 years of age.

We do NOT share Personal Information for cross-context behavioral advertising purposes.

12.6. Contact Us:

If you have any questions or concerns regarding our data privacy practices or wish to exercise your CCPA rights, please get in touch with us at:

Happy Numbers Inc.,
2261 Market Street STE 22178
San Francisco, CA 94114
USA
support@happynumbers.com
Phone: +1-800-815-1574
Fax: +1-650-618-8611

Please note that we may require certain information to verify your identity before processing your requests.

We reserve the right to update or modify this CCPA Notice for Data Privacy Policy at any time. Any changes will be posted on our website with the updated effective date.

14.1 Dispute Resolution

For Consumer Users: Before initiating any legal proceeding, we encourage you to contact us to attempt to resolve any disputes informally.

For School and District Agreements: Dispute resolution procedures may be governed by separate agreements between Happy Numbers and educational institutions.

14.2 Class Action Waiver

To the extent permitted by applicable law, you agree that any dispute resolution proceedings will be conducted on an individual basis and not in a class, consolidated, or representative action.

Exception: This class action waiver does not apply where prohibited by law or for claims that cannot be waived under consumer protection laws.