Parents' Bill of Rights for Data Privacy and Security
Effective: April 15, 2026 | Pursuant to New York Education Law Section 2-d | KIRUNIVERSE LLC, Brooklyn, New York
This Parents' Bill of Rights applies to KIRUNIVERSE LLC (“kidHQ”) in its capacity as a third-party contractor providing educational technology services to schools and districts under New York Education Law Section 2-d.
1. Student data is protected.
The educational agency — your school or district — has entered into a written agreement with KIRUNIVERSE LLC that requires us to protect the confidentiality, privacy, and security of student data. That agreement prohibits us from using student data for any purpose other than providing the contracted services to your school.
2. Student data will not be sold.
KIRUNIVERSE LLC will never sell student data. We do not sell, lease, trade, or otherwise exchange student data for commercial purposes, and we will not permit any of our subcontractors or subprocessors to do so.
3. Student data will not be used for advertising.
KIRUNIVERSE LLC will not use student data to advertise or market products or services to students or their families, and will not permit any third party to do so using data obtained through kidHQ.
4. Student data will not be used to build unauthorized profiles.
We will not use student data to develop profiles about students for purposes unrelated to their educational instruction, except as otherwise authorized by your school and as permitted by applicable law.
5. You have the right to inspect your child's data.
Parents and guardians have the right to inspect and review any personally identifiable student data maintained by the educational agency. To exercise this right, contact your school or district administrator directly. Requests related to data held by KIRUNIVERSE LLC on behalf of your school should be directed through your school administrator, who is the data controller for your child's education records.
6. You have the right to request correction of inaccurate data.
If you believe that student data maintained by your school or by KIRUNIVERSE LLC on your school's behalf is inaccurate, you have the right to request that it be corrected. Submit correction requests to your school administrator.
7. You have the right to file a complaint.
If you believe your child's data privacy rights under New York Education Law Section 2-d or FERPA have been violated, you have the right to file a complaint with the New York State Education Department at nysed.gov. You may also contact KIRUNIVERSE LLC directly at privacy@kiruniverse.com.
8. Data security measures are in place.
KIRUNIVERSE LLC implements and maintains technical and organizational security measures appropriate to the nature of the student data we process. These measures include encrypted data transmission via TLS, encrypted data storage, role-based access controls, row-level database security, comprehensive audit logging, and regular security reviews. Our infrastructure is hosted on Supabase and Vercel, both of which maintain SOC 2 Type 2 compliance.
9. Data will be returned or deleted upon contract termination.
Upon termination of the agreement between your school and KIRUNIVERSE LLC, all student data will be returned to the school or securely deleted within 60 days, in accordance with the school's instructions and applicable law.
10. Subcontractor obligations.
Any subcontractor or subprocessor engaged by KIRUNIVERSE LLC that may have access to student data is contractually required to comply with the same data privacy and security obligations that apply to KIRUNIVERSE LLC under this Bill of Rights and under applicable law.
11. Contact us.
KIRUNIVERSE LLC | Brooklyn, New York, United States | privacy@kiruniverse.com | kidhq.app
This Parents' Bill of Rights is incorporated by reference into KIRUNIVERSE LLC's Data Processing Agreement with each contracting school. A copy of the Data Processing Agreement is available upon request at privacy@kiruniverse.com.