Children and Student Privacy Notice

1. Current audience and collection boundary

The public website and YSUITS ID are not offered as accounts for children under 13. A YLearn learning service is not currently offered. Do not use an ordinary website inquiry or privacy email to submit a child’s school records, health information, government identifiers, photographs, or recordings.

This boundary does not mean that every organization record can never relate to a child. An organization using a separately available business service must establish its authority and appropriate protections before entrusting such information. The organization’s instructions do not remove responsibilities that apply directly to the service operator.

2. Children’s online privacy

COPPA applies to covered child-directed online services and to covered operators with the relevant actual knowledge that they collect personal information from a child under 13. A statement about an intended adult audience is not permission to disregard actual knowledge or a service’s actual design and use.

Before a covered collection, the operator must provide the required direct and online information and obtain verifiable parental consent unless a particular legal exception applies. Where the rules require separate consent for a third-party disclosure not integral to the service, that choice must remain separate from basic collection and use. A general account agreement, preselected box, or child’s assertion of parental permission is not automatically valid parental consent.

If YSUITS learns of a collection requiring authorization that was not obtained, further use must be restricted and the applicable steps taken to obtain valid authorization or securely remove the information as the law requires. A parent or guardian can report a concern to support@ysuits.com without initially sending the child’s sensitive records.

3. School authorization is limited

For a qualifying school-authorized educational service, a school may sometimes consent on a parent’s behalf within COPPA’s educational limits. That authority concerns collection for the school’s use and benefit, not an operator’s unrelated commercial purposes. The operator must provide the required information and review, deletion, and further-collection choices; it cannot simply transfer its own compliance duties to the school.

A school’s authorization is not permission for unrelated advertising, sale, commercial profiling, general-purpose model training, or public publication. The actual school or district’s authority must be established, rather than accepting a child pretending to be a teacher or assuming every individual teacher can approve every use. This notice does not provide that authorization.

4. Education records and FERPA

FERPA primarily applies to covered educational agencies and institutions receiving relevant U.S. Department of Education funding. It does not automatically make every training business or every certificate provider a covered school. A provider handling a covered school’s education records can nevertheless have contractual and legal restrictions on their use and redisclosure.

If a school relies on the school-official exception, the actual arrangement must meet its requirements, including an outsourced institutional function, the school’s direct control over use and maintenance of the records, legitimate educational interests, and applicable limits on use and redisclosure. A generic vendor label or this public notice is not a substitute for that arrangement.

Where the required school contract, authorization, or additional safeguard has not been established, the corresponding education-record processing must not begin. The available Data Processing Addendum can form part of an actual agreement when lawfully incorporated, but it does not by itself designate a school official or supply every education-law condition.

5. Parent and student requests

Where FERPA applies, parents or eligible students generally exercise education-record rights through the educational institution. Rights may transfer to the student at age 18 or when attending a postsecondary institution, as the law provides. A service provider should assist the school according to the valid agreement and applicable law, rather than independently deciding an academic record dispute.

For information under YSUITS’s own responsibility or a concern about provider processing, contact support@ysuits.com. Identify the relevant school or service and your relationship to the student without sending full records in the initial email. We may request proportionate evidence of authority through an appropriate channel. A request receipt does not mean a school record has already been erased or changed.

6. Public credentials, directory information, and media

A student’s participation, achievement, credential, photograph, voice, or activity can be identifying information. Enrollment or receipt of a credential is not automatically permission to place that information in a public directory, publish a recording, or create a biometric identifier.

If a covered school uses FERPA’s directory-information route, the school must have designated the relevant categories, given the required notice and opportunity to restrict disclosure, and respected applicable restrictions. Calling a credential “verifiable” or information “directory information” does not remove those conditions.

Where a separate publication or verification feature is offered, its information must explain the actual audience and fields and identify the authority for disclosure. Participation in an account or learning activity does not itself make a credential or student record public.

7. Limited purpose, security, and retention

For a covered children’s service, its required retention information must identify the collection purposes, the business need for retaining the information, and the deletion timeframe. Children’s personal information must not be retained indefinitely or used for an unrelated purpose merely because storage remains available.

For an authorized school service, access, return or deletion, backups, and any legally required retained records must follow the actual school agreement and applicable law. Required records and a limited security or legal hold do not justify an unnecessary complete student profile. Before a new child or education feature is offered, its actual data handling and required parental or school information must be supplied.

State student-privacy laws and school contracts may require additional safeguards. Those requirements continue to apply, and a general-purpose privacy notice does not waive them.

8. Contact and reports

Send a child-privacy or student-record concern to support@ysuits.com, naming the relevant service or school where known. Do not include a child’s full identifier, medical record, account password, or complete education file in an initial ordinary email. Any evidence necessary to locate or verify a record should be handled through an appropriate method.

Parents and eligible students may also use the complaint routes available under the law that applies, including the U.S. Department of Education’s student-privacy process where relevant. Contacting YSUITS does not waive those rights or replace a school’s responsibility for its own records.