Student education records belong to the school — and the family.
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. Schools and districts that use ReadSprout maintain ownership and control of their students' education records at all times.
ReadSprout acts as a School Official with a legitimate educational interest — we access student records only to provide the educational service your school has contracted for, and for no other purpose.
Who FERPA protects — and what it covers
Who is protected
Students of all ages at schools that receive federal funding — from PreK through post-secondary
What is protected
Education records: grades, assessments, progress data, attendance, and any directly identifiable student information
Who has rights
Parents of students under 18; students themselves once they turn 18 or attend post-secondary school
What rights exist
Right to inspect records, request corrections, and control disclosure of records to third parties
1. ReadSprout's Role Under FERPA
When a school or district deploys ReadSprout, ReadSprout functions as a "School Official" under FERPA (34 C.F.R. § 99.31(a)(1)). This means:
- ReadSprout has a legitimate educational interest in accessing student education records — specifically, to provide adaptive literacy instruction
- ReadSprout is subject to the same conditions governing use and re-disclosure of education records as other school officials
- The school remains the data controller — ReadSprout processes student data on the school's behalf
- ReadSprout does not use student education records for any purpose other than the educational service contracted by the school
Important: The school's Data Processing Agreement (DPA) with ReadSprout formally establishes this School Official relationship and governs all processing of student education records. Schools must execute a DPA before deploying ReadSprout to students.
Request our DPA →
2. Our FERPA Commitments to Schools
Educational purpose only
Student education records are used solely to provide and improve the ReadSprout literacy service. Never for advertising, marketing, or commercial gain.
No unauthorized disclosure
We do not disclose student education records to any third party without the school's written consent, except as required by law.
School retains ownership
The school owns student education records at all times. ReadSprout is a processor, not an owner. Records are returned or deleted upon contract termination.
Role-based access
Teachers see only their own students. Administrators see only their school or district. ReadSprout staff access student data only for technical support.
Secure deletion on exit
Upon contract termination, ReadSprout will return all student education records in a machine-readable format or securely delete them within 60 days.
Breach notification
In the event of a data breach affecting student education records, ReadSprout will notify the school within 72 hours of discovering the breach.
🚫 What ReadSprout will never do with student education records
- Sell student education records to any party for any reason
- Use student education records to build advertising profiles
- Share student education records with marketing, data broker, or analytics companies
- Use student education records for any purpose beyond the school's contracted educational service
- Retain student education records after the contract ends (beyond the 60-day secure deletion window)
3. What Student Data ReadSprout Accesses
| Data category | Purpose | Who can see it | Shared externally? |
|---|
| Student username and grade level |
Account identification and level placement |
Teacher, school admin, parent |
No |
| Lesson completions and assessment scores |
Adaptive learning path and progress reports |
Teacher, school admin, parent |
No |
| Skill mastery data |
Personalization and reporting |
Teacher, school admin, parent |
No |
| Voice recordings (fluency coach) |
Real-time fluency scoring only |
Processed automatically — not viewable by humans |
No — deleted immediately after scoring |
| Session and usage data |
Progress tracking and product improvement |
ReadSprout technical team (anonymized) |
No |
4. School and Parent Rights Under FERPA
School administrator rights
As a school or district administrator, you can:
- Access all student education records in your school or district at any time through the admin dashboard
- Export all student data in CSV or JSON format for your records
- Request deletion of any student's data at any time
- Request that ReadSprout return all student education records within 30 days of contract termination
- Review ReadSprout's sub-processor list and data handling practices
- Require ReadSprout to correct inaccurate student education records
Parent rights (students under 18)
Parents and guardians of students under 18 have the right under FERPA to inspect and review their child's education records. For ReadSprout records:
- Parents with family accounts can view their child's progress data directly in the parent dashboard
- Parents of students in school accounts should contact their school to request access to their child's ReadSprout education records — the school will facilitate the request
- Parents may request corrections to inaccurate records through the school
5. State Student Privacy Laws
In addition to FERPA, many states have enacted their own student data privacy laws. ReadSprout is designed to comply with the most stringent state requirements, including:
- SOPIPA (California): Student Online Personal Information Protection Act — we do not use student data for targeted advertising and do not sell student data
- New York Education Law § 2-d: Operators must sign a Parent Bill of Rights for Data Privacy and Security — available upon request
- Illinois SOPPA: Student Online Personal Protection Act — ReadSprout complies with all operator obligations
- Other state laws: If your state has specific requirements, contact us and we will review our compliance for your jurisdiction
Schools are responsible for ensuring their use of ReadSprout complies with their specific state laws. We will provide documentation to support your compliance review upon request.
6. Annual FERPA Notification
Under FERPA, schools must include vendors with School Official access in their annual notification to parents. We recommend that schools include ReadSprout in their annual FERPA notification with language similar to:
"ReadSprout Education LLC has been designated as a School Official with a legitimate educational interest in student education records for the purpose of providing adaptive literacy instruction. ReadSprout may access student education records only as necessary to provide this service and is subject to the same conditions governing use and re-disclosure as school employees."
7. Data Processing Agreement
Every school and district that deploys ReadSprout to students must execute a Data Processing Agreement (DPA) with ReadSprout. The DPA formally establishes the School Official relationship, specifies permitted and prohibited uses of student data, sets retention and deletion timelines, and defines both parties' security obligations.
To request our standard DPA or to discuss custom DPA requirements for your district: