Privacy Policy

1. Scope and Updates to This Privacy Policy

This Privacy Policy applies to personal information we process about adult users of our Services, including teachers, literacy coaches, school and district administrators, prospects, business contacts, newsletter subscribers, event attendees, and job applicants. It also describes the pseudonymous student assessment records that teachers enter into the Assessment Portal.

The Assessment Portal is a separate platform with its own Terms of Service, which you must accept before using it. This single Privacy Policy governs both the main RAVE-O services and the Assessment Portal. Student-related records exist only in the Assessment Portal; our other websites and the teacher portal contain no student data of any kind.

We may update this Privacy Policy from time to time. If we make material changes, we will notify affected users as required by applicable law, for example by email to the address on your account or by posting a prominent notice on our website, and we will update the "Last Updated" date above. Prior versions of this policy are available on request. Your continued use of the Services after an updated policy takes effect constitutes acceptance of the updated policy, to the extent permitted by law.

2. Personal Information We Collect

The categories of personal information we collect depend on how you interact with us. We collect information you provide directly, information collected automatically when you use our Services, and information from other sources.

A. Information You Provide Directly

• Teacher Portal accounts (raveoreading.com and teachraveo.com). Name, school email address, school or district affiliation, and password credentials.
• Assessment Portal accounts (assess.raveoreading.com). Email address, an optional display name, your role (teacher, coach, or administrator), and school affiliation if you join a school. The Assessment Portal is passwordless: you sign in with a single-use email link that expires after 15 minutes, or with Google single sign-on. We never store a password for the Assessment Portal.
• School invitations. If a coach or administrator invites a colleague to the Assessment Portal, we store the invitee's email address before that person has an account, solely to deliver and honor the invitation.
• Communications with us. When you contact us, for example to request a demo, submit a support request, register for our newsletter, or respond to outreach, we may collect your name, email address, phone number, job title, school or district name, and the content of your message.
• Events and conferences. Business contact information collected at our booth or sessions, typically through a badge scan or business card exchange.
• Surveys and research. Information you choose to share in a voluntary survey, focus group, or implementation research study.
• Business development. Contact and business information from prospective partners, vendors, investors, and other counterparties.
• Job applications. Application materials, including resume or CV, cover letter, work history, references, and any other information you choose to provide.

B. Information Collected Automatically

When you visit our marketing websites or the teacher portal, we and our service providers may automatically collect IP address, device identifiers, browser type and version, operating system, general location derived from IP address, and usage information such as pages viewed, links clicked, referring URLs, and visit timestamps.

The Assessment Portal collects less. It does not run analytics, session replay, or any third-party scripts. It keeps an append-only security audit log of account actions (for example sign-ins and class changes). Where audit entries are tied to a web request, they record a one-way cryptographic hash (a fingerprint) of the IP address and browser user-agent rather than the raw values. Our hosting provider also keeps standard server access logs, which include IP addresses, under its own retention practices.

C. Cookies and Similar Technologies

• Strictly necessary. Cookies that enable core functionality, including authentication and security. The Assessment Portal sets only two cookies: a session cookie that expires within 12 hours and a security (CSRF) cookie. It sets no analytics, advertising, or tracking cookies of any kind.
• Functional. On our marketing websites and teacher portal, cookies that remember your preferences.
• Analytics. We use Google Analytics on our marketing pages only, to understand how visitors use those pages. We do not use behavioral analytics, session replay, or similar tools on the teacher portal or the Assessment Portal.

We do not use cookies or similar technologies to deliver targeted or interest-based advertising anywhere on the Services. You may control cookies through your browser settings; disabling strictly necessary cookies will prevent sign-in.

Do Not Track. Because there is no consistent industry standard for responding to "Do Not Track" signals, we do not currently respond to them. We honor browser-based privacy preferences and opt-out mechanisms where required by applicable law, such as the Global Privacy Control signal where applicable.

D. Information From Other Sources

• School and district administrators who provide contact lists for the teachers they would like to onboard.
• Business contact databases, professional networking sites, and publicly available sources used to identify prospective educator and district contacts.
• Conference and event organizers who share attendee lists with sponsors, where permitted.
• Google, if you choose Google single sign-on for the Assessment Portal. We receive your email address and display name from Google. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google sign-in also results in our storage of authentication tokens issued by Google for your account; we use them only to operate sign-in.
• Job referrals and recruiters, for applicants.

E. Assessment Records in the Assessment Portal (Pseudonymous)

Teachers, not students, enter the following records into the Assessment Portal. These records describe student performance but are identified only by a teacher-chosen code:

• Pseudonymous student code. A label of at most four characters, such as "S1." The portal rejects labels that look like real names, email addresses, phone numbers, birth dates, or ID numbers. The list matching each code to a child stays in the teacher's own school records and never enters our systems.
• Grade level. An optional grade level (2 through 5) for each student code, used to apply the correct placement thresholds.
• Assessment results. Unit assessment scores (words correct, time, words correct per minute, and per-strand points) and placement test results, with timestamps.
• Class context. A teacher-entered class name and school year. Classes are private to the teacher unless the teacher explicitly shares them with their school. Sharing is off by default.

The Assessment Portal has no fields for student names, birth dates, addresses, photos, demographic information, disability or IEP status, or free-text notes about students, and students have no logins. Our handling of these records is governed by Section 9.

3. How We Use Personal Information

A. To Provide and Operate the Services

• Create and maintain educator accounts and authenticate users.
• Deliver curriculum materials, lesson resources, and program updates to teachers.
• Score, store, and display the assessment results teachers enter, and generate placement recommendations and progress views for the teacher's own students.
• Provide customer support and respond to inquiries.
• Communicate about implementation, training, and program updates.
• Process job applications.

B. To Improve and Develop the Services

• Understand how educators use our products so we can improve them.
• Diagnose and fix technical issues.

C. To Communicate With Educators, Prospects, and Customers

• Send service-related communications, including transactional emails, security notices, and policy updates.
• Send marketing emails about RAVE-O, new resources, professional development opportunities, and Nido Learning news, with the ability to unsubscribe at any time. We do not send marketing based on assessment records.
• Respond to demo requests, schedule meetings, and conduct outreach to prospective district customers.

D. For Security, Legal, and Compliance Purposes

• Protect the security and integrity of our Services, including maintaining audit logs, rate limiting, and detecting and preventing fraud and abuse.
• Comply with legal obligations, court orders, and lawful requests from government authorities.
• Establish, exercise, or defend legal claims, and enforce our terms and policies.

E. With Your Consent

We may use personal information for other purposes described to you at the time of collection or with your consent.

What we never do. We do not sell personal information or assessment records. We do not share personal information for cross-context behavioral advertising or targeted advertising. We do not build advertising profiles of our users, and we do not build profiles of students for any purpose other than displaying a student's assessment progress to their own teacher and school.

4. How We Share Personal Information

We share personal information only in the limited circumstances described below.

A. Service Providers

We share personal information with vendors who perform services on our behalf and who are contractually obligated to use it only to provide services to us and to protect it appropriately. For the Assessment Portal specifically, the current service providers are:

• Vercel (United States): application hosting. Handles all portal data in transit and keeps standard server access logs.
• Neon (United States, AWS us-east-1): database hosting. Stores portal data at rest.
• Resend (United States): transactional email delivery, including sign-in links. Processes recipient email addresses.
• Google (United States): optional single sign-on, as described in Section 2.D.
• Error monitoring (Sentry, United States): if and when enabled, receives server error reports consisting of the error, technical stack trace, and route path. Our configuration strips request contents, cookies, headers, query strings, and user identity from every report before it is sent, and suppresses diagnostic breadcrumbs on score-entry routes. It has no presence in your browser and records no sessions.

We will keep this list current. Schools may request notice of subprocessor changes as part of a data privacy agreement (see Section 9).

B. Business Partners

We may share information about adult users with research collaborators, implementation partners, and affiliates where necessary to deliver the Services or jointly offered programs, subject to appropriate confidentiality and data protection commitments. We do not share Assessment Portal records under this paragraph.

C. Legal and Safety

We may disclose personal information when we believe in good faith that disclosure is necessary to comply with applicable law, respond to lawful requests from public authorities, protect the rights, property, or safety of Nido Learning or others, or enforce our agreements. Where legally permitted, we will notify the affected school before disclosing Assessment Portal records in response to legal process.

D. Business Transfers

If Nido Learning is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of that transaction. Any successor must honor the commitments in this Privacy Policy, including the student data commitments in Section 9, or provide affected users and schools with notice and a meaningful opportunity to object or delete their data, as required by applicable law.

E. With Your Direction or Consent

We share personal information with other third parties when you direct us to or otherwise consent. Within the Assessment Portal, a teacher's classes are visible to their school's coaches and administrators only if the teacher explicitly turns on school sharing for that class.

5. Your Privacy Choices

• Marketing communications. Opt out of marketing emails at any time using the unsubscribe link in each message or by contacting us (Section 12). You will continue to receive transactional and service communications such as sign-in links, security alerts, and policy updates.
• Cookies. Manage cookie preferences through your browser settings. Disabling the Assessment Portal's strictly necessary cookies will prevent sign-in.
• Your account and data. Teachers can update account information by signing in. In the Assessment Portal, teachers can delete individual students, classes, and scores at any time; deletions cascade so that a deleted student's scores are deleted with them. To delete your account entirely, contact us at the address in Section 12 and we will complete the deletion, subject to Section 6's note on security audit records.

6. Your Privacy Rights

Depending on where you live, you may have rights with respect to your personal information, including the right to access, correct, delete, and receive a portable copy of your personal information, the right to opt out of certain processing, the right to withdraw consent, and the right not to be discriminated against for exercising these rights. We do not sell personal information and do not engage in targeted advertising or profiling that produces legal or similarly significant effects.

To exercise any of these rights, contact us using the information in Section 12. You may submit a request by email or by mail. We will verify your identity before fulfilling a request and will respond within the timeframe required by applicable law. You may use an authorized agent, subject to verification. If you are unsatisfied with our response, you may lodge a complaint with the data protection authority or attorney general in your jurisdiction.

A note on security audit records. For security and accountability, the Assessment Portal keeps an append-only log of account actions. These records persist after account deletion so that the history of changes to school data remains trustworthy. They identify people by internal account ID and hashed fingerprints rather than by email address or raw IP address, and we do not use them for any purpose other than security, integrity, and legal compliance.

7. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. For the Assessment Portal these include:

• Passwordless sign-in, so there is no password database to breach. Sign-in links are single use and expire after 15 minutes, and sessions expire within 12 hours.
• Encryption in transit (TLS) for all connections, including to the database, and strict browser protections that block all third-party scripts.
• Server-side access controls so every request is checked against the signed-in user's own classes and school before any data is returned or changed.
• An append-only audit log of all changes, rate limiting on sensitive actions, and caps on account resources.
• A production database isolated in its own project with its own credentials.

No system is completely secure, and we cannot guarantee the security of personal information. If we become aware of a security incident affecting personal information or Assessment Portal records, we will notify affected users and schools without undue delay and as required by applicable law.

8. Data Retention

We retain personal information for as long as needed to provide the Services, fulfill the purposes described in this Privacy Policy, comply with legal and contractual obligations, resolve disputes, and enforce agreements. When personal information is no longer needed, we delete or anonymize it.

For the Assessment Portal: records a teacher deletes are deleted immediately. Archived classes and their scores are retained for 18 months after archiving and then deleted. When an account is deleted, its classes, students, and scores are deleted; security audit records are retained as described in Section 6. When a school asks us to delete its data under a data privacy agreement, we honor the timeline in that agreement.

9. Students and Student Data

This section explains, in plain language, exactly what student-related information exists in our systems and the commitments we make to schools about it.

A. What students never do

• Students do not create accounts, log in to, or use any Nido Learning service.
• Students do not submit assignments, answers, assessments, or any other information to us.
• We do not use cookies, pixels, or other tracking technologies that collect information about students, and no Nido Learning software runs on a student's device.

B. What the Assessment Portal stores about students

Teachers administer RAVE-O assessments orally or on paper and enter the results into the Assessment Portal. Each student exists in our systems only as a teacher-chosen code of at most four characters, optionally tagged with a grade level, together with that student's assessment scores and placement results, as detailed in Section 2.E. The portal is built so that student names, birth dates, ID numbers, demographics, disability status, and free-text notes cannot be stored: there are no fields for them, and input validation rejects labels that resemble names or identifiers. The list matching codes to children stays in the teacher's own school records and never enters our systems. Without that list, we cannot identify any student from the records we hold.

C. Teacher responsibilities

Teachers must use only pseudonymous codes and must keep the code list in their school's own records. The input validation is a safety net, not permission to test it. Please do not include student names, IDs, or other student personal information in class names, support requests, surveys, or any communication with us. If student personal information is inadvertently shared with us, contact us promptly and we will delete it.

D. Our commitments under student privacy laws

Because teachers enter these records on behalf of their schools, and because a school can connect its own code list to its own students, some laws may treat these pseudonymized records as regulated student data even though we cannot identify anyone. Rather than argue the point, we commit to the protections those laws require. When a school or district uses the Assessment Portal:

• Assessment records belong to the school. We act as a service provider at the school's direction and claim no ownership of the records. We are prepared to serve as a "school official" under FERPA, performing an institutional service subject to the school's direct control and the terms of a signed data privacy agreement.
• We use assessment records only to provide, maintain, secure, and improve the Assessment Portal. We never use them for advertising or marketing of any kind, never sell them, and never build student profiles for any purpose other than showing a teacher and their school the progress of their own students.
• We do not re-disclose assessment records to third parties except the service providers listed in Section 4.A, who are bound to the same limits.
• We delete a school's or teacher's records on request, and teachers can delete their own records at any time within the portal.
• We will notify affected schools of any breach involving their records, as described in Section 7.
• We will sign a data privacy agreement (DPA), including state-required terms such as those under New York Education Law Section 2-d, Illinois SOPPA, California AB 1584, or the standard national/SDPC form, on request. Contact us using the information in Section 12.

The Assessment Portal is not directed to children under 13, and we do not collect personal information from children. All information in the portal is entered by adult educators.

10. Supplemental Notices for U.S. State Residents

A. California Residents (CCPA/CPRA)

California residents have the rights described in Section 6, including the right to know, delete, and correct, and the right to opt out of the sale or sharing of personal information. We do not sell personal information and do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act.

Categories collected in the preceding 12 months: identifiers (name, email, IP address); professional or employment-related information (employer, job title, school or district affiliation, and, for job applicants, work history and references); education information (for job applicants, degrees and institutions attended); internet activity information (usage logs on marketing sites and the teacher portal; hashed security logs on the Assessment Portal); and inferences drawn from marketing-site analytics. We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months.

Sensitive personal information. The only sensitive personal information we collect is the log-in and password combination for teacher portal accounts. We use it solely to authenticate users and secure accounts. We do not use or disclose sensitive personal information to infer characteristics about anyone or for any purpose beyond those permitted by the CCPA regulations, so we do not offer a "Limit the Use of My Sensitive Personal Information" link.

California Shine the Light. We do not share personal information with third parties for those parties' own direct marketing purposes.

Minors. California residents under 18 who have posted content on the Services may request removal by contacting us.

B. Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and Other State Residents

Residents of states with comprehensive consumer privacy laws have the rights described in Section 6, subject to applicable thresholds and exceptions. To exercise your rights or appeal a denial, contact us using the information in Section 12. If we deny your request, you may appeal by replying to our response, and you may also contact your state attorney general.

C. Nevada Residents

We do not sell personal information as defined under Nevada Revised Statutes Chapter 603A. To submit a Nevada Do Not Sell request, contact us at the email address in Section 12 with the subject line "Nevada Do Not Sell Request."

11. Other Important Information

International users. Nido Learning is based in the United States and the Services are offered to U.S. schools. If you access the Services from outside the United States, your information will be processed in the United States, where data protection laws may differ from those in your country. We take steps to ensure such transfers comply with applicable law.

Third-party websites. Our Services may link to third-party websites we do not control. This Privacy Policy does not apply to those sites, and we encourage you to review their privacy policies.

Children under 13 (marketing websites). Our marketing websites are directed to educators and other adults, not to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us and we will delete it.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise a privacy right, or would like to request a data privacy agreement or a written description of our student data practices for your district, contact us at: