Student Data Privacy | Lemonade Stand Business Plan
Back to home
For Schools, Districts & Families

Student Data Privacy

Plain-language commitments to parents, educators, and district reviewers about how we handle student information.

We never sell student data — full stop.

We do not use student data to train AI models.

We minimize what we collect — name, email, lesson responses. That's it.

We sign your district's Student Data Privacy Agreement on request.

FERPA

When a school or district uses the Lemonade Stand Business Plan, we operate as a "school official" under FERPA (34 CFR § 99.31(a)(1)). That means the school directs how student education records are used, we only use them to deliver the service the school requested, and we don't disclose them to anyone the school hasn't authorized.

  • Schools can export student records on demand (CSV / PDF).
  • Schools can request deletion; we complete it within 30 days.
  • We will sign your district's Data Privacy Agreement (DPA) — including SDPC/NDPA standard contracts — at no cost.

COPPA (under 13)

For students under 13, we require verifiable consent from a parent, legal guardian, or school acting under FERPA. We collect only the information necessary to deliver the lesson:

  • Name (first name is fine)
  • Email (a parent's or school-provisioned address)
  • Lesson responses and Mini Business Plan content

Our Elementary preview pathway (grades 2-5) does not currently collect any data — all progress is stored locally in the child's own browser.

Responsible AI

LemonBot is our AI coach (OpenAI GPT-4o under the hood). It's designed to ask questions — not write a student's answers for them. Key safeguards:

  • Conversations run under OpenAI's enterprise terms (no training on customer data).
  • We do not use student chats to train any AI model.
  • Educators can disable LemonBot for any class with one click.
  • Daily per-user quotas (100 chats / 40 voice replies) keep classroom use focused.

Where data lives

  • Hosting: Emergent Cloud (U.S. Kubernetes).
  • Database: MongoDB Atlas (U.S. region).
  • AI: OpenAI Enterprise API.
  • Email: SendGrid (transactional only).

See our full Subprocessors list for current vendors.

Security at a glance

  • HTTPS / TLS 1.2+ on every connection.
  • bcrypt password hashing.
  • Rate-limiting against brute-force login attempts.
  • JWT-based session tokens with rotation.
  • Sentry error tracking with PII redaction.
  • Annual security review (next review due Q3 2026).

Need a DPA or vendor questionnaire?

Email privacy@thewementality.com. We respond to district vendor-review requests within 2 business days.

Related documents