Data Security & Privacy Plan

Puppet Pals 1 School Edition is a creative animation app developed by Polished Play LLC, designed for use in K-12 educational settings. It can be deployed via Apple School Manager or Mobile Device Management (MDM) solutions.

This plan describes how we protect data associated with the app over the life of any contract with an educational agency. It addresses data practices relevant to the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and the General Data Protection Regulation (GDPR), and maps our current controls to the NIST Cybersecurity Framework (CSF) 1.1.

The School Edition is designed with minimal data collection. No student PII is collected, stored, or transmitted. Its limited server interactions are described below:

First-party usage analytics

Our own endpoint records event types and properties, app and app version, timestamps, and general country/region and device type context. Country, region, and device type may come from request headers when the app does not provide them. A random session ID connects events within a session. The School Edition client does not submit names, contact information, advertising IDs, account identifiers, or a School Edition user ID with these events.

Parent emails (optional)

Behind a parent gate, parents may provide an email for app update notifications. The address is stored separately from School Edition usage analytics.

Feedback (optional)

Behind a parent gate, parents may submit a message and optional contact details. Feedback follows the separate review and support path described in section 05.

• All Polished Play employees and contractors with access to any stored data are bound by confidentiality agreements.
• Access to production systems is restricted to authorized personnel on a least-privilege basis.
• Polished Play personnel are trained on applicable privacy laws including FERPA, COPPA, and GDPR.
• We do not sell, rent, or share user data with third parties for marketing or advertising purposes.
• We do not use student data for targeted advertising or to build student profiles for non-educational purposes.

• All data transmitted between the app and our servers is encrypted using TLS 1.2 or higher.
• Server infrastructure is hosted on Vercel with industry-standard security controls.
• Server access requires multi-factor authentication.
• First-party usage analytics are stored as session and event records. A random session ID connects events within a session; School Edition events do not include names, contact information, advertising IDs, account identifiers, or a School Edition user ID.
• No third-party analytics or tracking SDKs are used in the app.
• User ID tracking is disabled in the School Edition client.
• AI image features are not just absent from the School Edition client — they are blocked at our API boundary. Requests originating from the School Edition source identifier are rejected at validation time before any forwarding occurs. This is enforced server-side and is not a client-toggleable setting. This restriction applies to creative image generation; the optional parent feedback form uses a separate spam-classification process described in section 05.

School Edition does not include third-party analytics or tracking SDKs. Its first-party analytics and the separate, optional parent-gated email and feedback flows use the following infrastructure and service providers:

Vercel

Hosts the API routes that receive first-party School Edition usage analytics and optional parent email and feedback submissions.

Database host

Hosts the application’s PostgreSQL database, which stores usage-session and event records, optional parent email signups, optional feedback, and related delivery or review records.

Google Gemini

Classifies optional parent feedback for spam before it is stored. The classifier receives the submitted name, email, subject, and a limited portion of the message when those fields are provided. If an administrator requests an AI-assisted reply draft, Gemini also receives the feedback message, name, category, and app source. These are support workflows, not creative features available to students.

Slack

Receives a private support notification containing feedback classified as clean, including the submitted message and any name, email, or subject the parent chose to provide.

Resend

Delivers app update notices when Polished Play sends them to parents who opted in. Email delivery and suppression results are recorded in the application database.

Google Gmail

Creates or sends a reply only when an administrator chooses to respond to feedback that includes an email address.

Student-created puppet shows, recordings, and images are not uploaded or shared through any of these flows. Parent email and feedback submissions are voluntary and behind a parent gate. The app does not embed third-party analytics, advertising, or tracking services.

In the event of an unauthorized release, disclosure, or acquisition of data:

• Polished Play will investigate the incident immediately upon discovery.
• Affected educational agencies will be notified within 72 hours of confirmation of the incident.
• The notification will include a description of the incident, the types of data involved, the date or estimated date of the incident, and contact information.
• Polished Play will take immediate steps to contain and remediate the incident.
• Polished Play will cooperate with affected educational agencies and any regulatory bodies as required by law.
• Polished Play maintains a written incident response plan consistent with industry standards and applicable law, and will provide a summary upon request.

• First-party usage-session and event records are retained for product improvement. They contain a random session ID but no School Edition user ID, name, contact information, account identifier, or advertising ID. Administrators can prune these records; no automatic fixed retention period is currently configured.
• Parent email addresses are retained until a deletion request is received.
• Optional feedback is retained for support and product improvement until it is no longer useful or a deletion request is fulfilled.
• Upon written request from an educational agency, Polished Play will dispose of or transfer any data associated with the agency within 60 days.
• Upon termination of a data privacy agreement, Polished Play will dispose of all applicable data after providing reasonable prior notice.
• Deletion requests can be made at any time by contacting privacy@polishedplay.com.

Since Puppet Pals 1 School Edition does not collect or store student PII, there is no student data to transition back to the educational agency upon contract termination. All student-created content resides on the device and is fully under the control of the school and student at all times.

Polished Play is committed to aligning its data security and privacy practices with applicable educational agency policies. Our minimal data collection approach is intended to simplify review against institutional data privacy policies. We will cooperate with any educational agency to address specific policy requirements.

When a district's procurement process requires a Data Processing Agreement (DPA), a vendor questionnaire, or another written agreement, contact privacy@polishedplay.com to discuss. Polished Play evaluates these requests on a case-by-case basis depending on scope, proposed terms, and the deployment size.

Polished Play's security practices are aligned with the five-function structure of the NIST Cybersecurity Framework (CSF) 1.1. Given that no student PII is collected, our alignment is summarized below:

IDIdentify

We maintain an inventory of all data processed by our systems. Our data collection is minimal by design — no student PII, no user accounts, and no School Edition user IDs. First-party usage events are connected within a session by a random session ID. Risk assessments are conducted relative to the limited data we hold, with particular attention to privacy regulations affecting educational technology.

PRProtect

Access to production systems requires multi-factor authentication and is restricted to authorized personnel on a least-privilege basis. All data in transit is encrypted via TLS. No third-party tracking SDKs are embedded in the app. Personnel are trained on FERPA, COPPA, and applicable state privacy laws.

DEDetect

We monitor our server infrastructure for anomalous activity. Vercel provides logging and alerting capabilities for unauthorized access attempts and unusual patterns.

RSRespond

Our incident response process includes identification, containment, notification to affected educational agencies within 72 hours, and remediation. We maintain a written incident response plan and will cooperate with affected parties and regulatory bodies as required.

RCRecover

Given the minimal data collected and absence of student PII, recovery primarily involves restoring service availability. Lessons learned from any incident are incorporated into our security practices and shared with affected educational agencies as appropriate.

For questions about this Data Security & Privacy Plan or our data practices, contact us at privacy@polishedplay.com.