Privacy Policy

Version: v1.0 Effective Date: May 13, 2026 Last Reviewed: May 13, 2026

Section 1 — Overview and Scope

Rushing Waters Consulting LLC ("Rushing Waters," "we," "our") operates the Wise Zebra platform. This Privacy Policy governs our collection, use, storage, and deletion of all user data, including student Personally Identifiable Information (PII). We operate on a strict Data Minimization framework — we collect only what is necessary to deliver our core educational services: homework completion support, executive function coaching, and personalized learning intervention.

Section 2 — Data We Collect

We collect only the following categories of data:

  • Parent/guardian name and email address (for account creation and Verifiable Parental Consent)
  • Student first name and age range (for personalized instruction delivery)
  • Assignment text and uploaded files submitted by the student during tutoring sessions
  • AI-generated Learning Profile observations (synthesized educator notes — never raw session transcripts)
  • Submission records (assignment title, submission timestamp, LMS destination)

We do not collect Social Security numbers, financial information, biometric data, or location data.

Section 3 — How We Use Data

Data is used exclusively to:

  • Deliver personalized homework tutoring through the Wise Zebra AI
  • Generate the Student Learning Profile (synthesized educator observations across sessions)
  • Provide parents and educators with progress reports through the Command Center dashboard
  • Comply with legal obligations

We do not use student data for advertising, marketing profiling, or any commercial purpose unrelated to direct educational service delivery.

Section 4 — AI Processing Disclosure

The Wise Zebra platform uses Google's Gemini API to process session data for Learning Profile summarization. Specifically: at the end of each tutoring session, synthesized observations (not raw session transcripts) are sent to the Gemini API for structured analysis. This data is transmitted securely, is not retained by Google for AI model training under our enterprise data processing agreement, and is processed solely to generate the Student Learning Profile stored in our secure database. Raw session messages are never stored or transmitted in full.

Section 5 — Data Sharing

We do not sell, lease, rent, or monetize student data under any circumstances. We do not share student data with third parties for advertising or commercial profiling. We share data only with:

  • Vetted sub-processors under strict Data Processing Agreements (DPAs) required to operate the platform (including Firebase/Google Cloud for secure hosting and database services)
  • Authorized school or district partners under signed Data Sharing Agreements, where applicable
  • Law enforcement only when required by valid legal process

Section 6 — Data Retention

We retain student data only for the duration of the active subscription. Upon account cancellation, all student PII is permanently and irrecoverably deleted within 30 days. Parents, guardians, and partner LEAs may request immediate deletion at any time through the Parent Dashboard or by contacting us directly.

Section 7 — Security

Student data is protected via AES-256 encryption at rest and TLS 1.3 in transit. Access to student records is restricted to authenticated account holders only. We conduct regular security reviews and maintain an incident response plan.

Section 8 — State Privacy Law Compliance

In addition to federal COPPA compliance, Rushing Waters is designed to meet the requirements of applicable state student privacy laws, including California's Student Online Personal Information Protection Act (SOPIPA) as the applicable benchmark for our operational standards. We do not sell student PII, do not use student data for targeted advertising, and do not build commercial profiles on students — regardless of the student's state of residence.

Section 9 — GDPR

Rushing Waters is designed with GDPR compliance principles in mind for current and future operations serving users in the European Union and European Economic Area. EU/EEA users have the right to access, rectify, and erase their personal data, and to restrict or object to processing. Contact us at founders@rushingwatersconsulting.com to exercise these rights.

Section 10 — Contact and Policy Updates

Privacy inquiries and data deletion requests: founders@rushingwatersconsulting.com. We will notify users of material changes to this policy via email at least 30 days before changes take effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.