Privacy Policy

Typing Pal – School Edition: Privacy Policy

Last update: October 5, 2024.

1. Introduction

We, the Typing Pal Team, are deeply committed to making our web application a safe and secure place for students to learn. That is why we make every effort to comply with the most widely recognized standards for safeguarding personal information.

This privacy policy is addressed to you as school administrators and teachers but is relevant to anyone using Typing Pal – School Edition (“Typing Pal”). We describe in simple and clear terms the practices and procedures adopted to ensure that Typing Pal protects your privacy.
 

2. Overview

2.1. Compliance

We comply with the following privacy laws:

  • Act Respecting the Protection of Personal Information in the Private Sector (ARPPIPS—Government of Quebec)
  • Personal Information Protection and Electronic Documents Act (PIPEDA—Government of Canada)
  • Children’s Online Privacy Protection Act (COPPA—United States of America)
  • Student Online Personal Information Protection Act (SOPIPA)
  • AB-1584 Pupil records: privacy: 3rd-party contracts: digital storage services and digital educational software

We support schools and libraries in their compliance with the following laws:

  • Family Educational Rights and Privacy Act (FERPA)
  • Children’s Internet Protection Act (CIPA)
  • NY Education Law 2-d and Part 121 of the regulations of the NY Commissioner of Education

We are a signatory to the K-12 School Service Provider Pledge to Safeguard Student Privacy.

We are resolutely committed to a global and methodical approach to respecting the principles set out in the General Data Protection Regulation (GDPR—European Union).

2.2. What We Do

  • We collect both personal information, which identifies students, and student data, to track their performance. For students, personal information is limited to their full name, their username and, optionally, their email address.
  • We use HTTPS (SSL) to ensure that personal information and student data are transmitted securely from end to end.
  • We enable you to review and delete personal information and student data at any time.
  • We also allow parents or legal guardians to review their child’s personal information and data while the subscription is active and to request that we delete it at any time.
  • We delete student accounts at your request or automatically at the end of the school year (June 30) that follows the school year during which the accounts were used for the last time.
  • We enable you to export your students’ personal information and activity results in a structured, commonly used, machine-readable and interoperable format. This may be done during your subscription, up to the end of the school year (June 30) that follows the school year in which the subscription expired (after which details are automatically deleted).
  • We innovate safely without compromising student privacy by only analyzing de-identified and aggregated data as we develop and improve Typing Pal.

2.3. What We Don’t Do

  • We do not collect or use personal information and student data for non-educational purposes.
  • We do not sell, trade, rent or otherwise provide personal information and student data to any advertisers or third parties.
  • We do not use or disclose any students’ information for behavioral targeting of advertisements.
  • We do not create advertising profiles on students.
  • As Typing Pal is fee-based, we do not expose students to advertisements.
  • We do not provide any messaging system for students to communicate privately with each other.

3. What Information Do We Collect and Why?

3.1. Information Provided by Users

3.1.1. Subscription Manager, School Administrator and Teacher Identification

Contact information — For the subscription account, we collect the subscription manager’s name, phone number and email address. School accounts are associated with a broad location (country, state, city), and with the school administrator’s name, phone number and email address, if different from the subscription manager. Teacher accounts are only associated with their name and email address. On the rare occasions when it is necessary or advisable to do so, we use this contact information for service-related communications, technical support requests and announcements.

Username and password — During the registration process, school administrators and teachers are provided a username and a link to create a password. Subscription managers are assigned a subscription code (instead of a username) and provided a link to create a password. Aside from login purposes, the username (which can also be modified by users) may be required to authenticate users when they request technical support.

3.1.2. Student Identification

Contact information — When a student is registered, we collect minimal personal information: name, username, password, group assigned and school attended. Optionally, we may also collect the student’s email address to facilitate the recovery of lost passwords. This personal information is used by school officials and teachers to manage student accounts. We will never use this information to communicate with students.

Username and password — Once registration is complete, the username cannot be changed by the student. Username modification has to be done by you. However, the password may be changed by the student if the password modification option has been activated for their assigned group. Note that all student passwords are encrypted at all times and can not be exported in plain text. During an export operation, you can only download temporary passwords that expire after 10 days.

3.1.3 Communicating With Us

Support requests — Typing Pal’s support section includes a form to describe a problem, express a comment or share a suggestion. We ask you to provide us with all the information that could help us answer your questions or process your requests. We only use this information to provide the services or support requested.

Feedback — We occasionally ask you to provide us with feedback on your experience with Typing Pal through surveys. The surveys are optional and the information submitted to us will only be used to improve our services. We may use third-party services to collect this information, such as Google Forms or SurveyMonkey.

3.2. Information Collected Automatically

3.2.1. Student data

When students are engaged in a Typing Pal activity, we collect information related to their typing performance. This information allows us to track their progress, calculate game scores, create replay videos and generate performance reports on demand. You can delete all student data by resetting a student’s results.

3.2.2. Single Sign-On

When an account is linked to a single sign-on service, such as Google Single Sign-On (SSO), we only collect the authentication information required by that service. This consists of the username, email address and avatar URL. Please note that the Clever login system also collects the name of the school district. The password, however, is never collected.

3.2.3. Cookies

Cookies are small blocks of data stored on your device (computer, smartphone, tablet) by your web browser. They are a standard technology used by all browser software. Like most online services, we use cookies to enable the functionality of Typing Pal and to evaluate its performance and usability. Some cookies are required for Typing Pal to function properly, while others are optional. Cookies can be deleted, but if they are disabled or blocked, you will be prevented from logging into Typing Pal. To learn more about the cookies we use or to configure them in your Cookies Settings.

3.2.4. Log Information

As an online service, we automatically collect and store certain information in our server logs. The information collected could be related to the device used (operating system, hardware version, browser name, etc.), or how Typing Pal is used (session frequency and duration, which options are enabled, etc.). This information helps us make decisions about future improvements. For example, we can focus on improving Typing Pal’s integration with the most popular browsers.

3.2.5. IP Address

We may collect and process IP addresses. We may use these to find the cause of a technical problem. We do not collect precise geolocation data from students, nor do we store or track any device location.

3.2.6. Web Analytics

To understand the context of a technical issue, to improve our service or to protect it from attacks carried out by automated applications (bots), we may use third-party web analytics providers such as Matomo or Google reCaptcha. Google may use the data collected to contextualize and customize ads for its own advertising network. For more information on Google’s practices in terms of the protection of personal information, please view the page describing its privacy rules.

3.3. What We Don’t Do With the Information We Collect

We do not collect, use or share personal information in any way that is not disclosed in this Privacy Policy. This also means that:

  • We do not collect or use personal information and student data for non-educational purposes.
  • We do not sell, trade, rent or otherwise provide personal information and student data to any advertisers or third parties.
  • We do not use or disclose any personal information or student data for behavioral targeting of advertisements.
  • We do not create advertising profiles on students.
  • As Typing Pal is fee-based, we do not expose students to advertisements.
  • We do not provide any messaging system for students to communicate privately with each other.

4. How Do We Protect Information?

4.1. Security Measures

When it comes to protecting user information, security is our highest concern. We follow industry-recognized standards such as the National Institute of Standards and Technology’s (NIST) Cybersecurity Framework and the Open Worldwide Application Security Project’s (OWASP) Application Security Verification Standard. Here’s what we do to keep Typing Pal secure:

4.1.1. — We use SSL (Secure Sockets Layer) to establish an encrypted link between our web server and a browser. This link ensures that all data transferred remains private and secure.

4.1.2. — We use firewall-protected servers stored in a secured location to prevent any unauthorized access.

4.1.3. — We store and transfer passwords using encryption technologies deemed to be secure.

4.1.4. — We control and limit our employees’ access to the Typing Pal database. The same is true for access to log files containing user and employee interactions with Typing Pal, as well as security events. Only employees who require this information to perform their duties have access to it. In such cases, we apply the principle of least privilege: the access granted is the minimum access required for these employees to perform their duties.

4.1.5. — We regularly educate our employees about information security issues and about how important this information is to our customers. The manner in which this information is handled is set out in a written document read and accepted by all relevant members of our staff.

4.1.6. — We implement control measures to ensure that Typing Pal’s development is secure. These measures include searching for disclosed vulnerabilities in third-party software included in Typing Pal, reviewing code, validating changes before deployment, training technical staff in good development practices, etc.

4.1.7. — We test Typing Pal’s security and fix any detected vulnerabilities presenting a security risk. We periodically appoint external experts to carry out security audits, including vulnerability and penetration testing.

4.1.8. — We use only industry-standard, publisher-supported software and technology infrastructures. We diligently keep them up to date with the latest patches.

4.1.9. — We implement measures for managing all Typing Pal updates, whether or not they are required for security reasons. We take swift and appropriate action to prevent any vulnerability from being exploited, from the moment one is identified to the deployment of the update required to address the situation.

4.1.10. — We periodically review all above security measures and practices.

4.2. In Case of Failure

We strive to protect our users against unauthorized use, disclosure, or access to their personal information. Although we adhere to the best industry standards, we cannot claim that our security system is 100% immune to failure. In the event that we discover a security breach affecting the accounts with your Typing Pal subscription, we will post a notice in your subscription’s management interface and will send an email within 24 hours to the subscription manager.

5. Which Regulations Do We Comply With and How?

5.1. Compliance

We comply with the following privacy laws:

  • Act Respecting the Protection of Personal Information in the Private Sector (ARPPIPS—Government of Quebec)
  • Personal Information Protection and Electronic Documents Act (PIPEDA—Government of Canada)
  • Children’s Online Privacy Protection Act (COPPA—United States of America)
  • Student Online Personal Information Protection Act (SOPIPA)
  • AB-1584 Pupil records: privacy: 3rd-party contracts: digital storage services and digital educational software

We support schools and libraries in their compliance with the following laws:

  • Family Educational Rights and Privacy Act (FERPA)
  • Children’s Internet Protection Act (CIPA)
  • NY Education Law 2-d and Part 121 of the regulations of the NY Commissioner of Education

We are a signatory to the K-12 School Service Provider Pledge to Safeguard Student Privacy. To learn more about the commitments we are sworn to honor, visit https://studentprivacypledge.org.

We are resolutely committed to a global and methodical approach to respecting the principles set out in the General Data Protection Regulation (GDPR—European Union).

5.2. General Measures

While the privacy laws and regulations above were adopted by different jurisdictions which may have specific local objectives, they contain similar overall requirements. To avoid redundancies in this Privacy Policy, the following text presents what we do to comply with these various privacy laws and regulations.

5.2.1. Information From Children Under 16

We are committed to protecting the information of all users—especially children under age of 16. We will not require them to disclose more personal information than necessary, and will collect it solely for educational purposes.

Should you become aware that we have inadvertently collected personal information from children—for example, if a child requested access to the demo version—we will take action to promptly delete such information. To report to us that a child’s personal information has been inadvertently collected outside the boundaries of this Privacy Policy or provided without the parent’s or legal guardian’s consent, please contact us to privacy@typingpal.com.

Please note that a parent or legal guardian can review their child’s personal information through the child’s student account and may direct us to delete it. You also can review and delete any student account yourself with Typing Pal’s management tools.

5.2.2. Deletion and Right to Be Forgotten

You are able to delete school, teacher and student accounts and all associated information by using your management tools. In addition, student accounts are deleted automatically at the end of the school year (June 30) that follows the school year during which the accounts were used for the last time. Deletion is permanent and no information can be restored. An option allows automatic deletion to be suspended while the subscription is in effect.

When the subscription is no longer in effect, the automatic deletion of student accounts cannot be suspended. School, teacher and student accounts are deleted automatically two years after the subscription expires. An option allows you to shorten or even eliminate this delay. Only the subscription manager’s information and business-related notes are archived. You can also exercise your right to be forgotten by submitting a request to us.

5.2.3. Educational Records and Right to Correction

Some of the information collected by Typing Pal may be considered part of an “academic record”. We use such academic records only to provide services to you. We do not sell, rent or disclose this information to any third parties. In addition, students and their parents can access and review their academic records at any time, and they may request that we correct any erroneous information.

5.2.4. Data Ownership, Control and Portability

Academic records are the property of the students; they are under your control for the duration of your subscription. We do not claim any right of ownership or control over any academic records. When your subscription has expired, you may delete your students’ academic records or export them in a structured, commonly used, machine-readable and interoperable format.

5.2.5. Parental Consent

COPPA mandates obtaining parents’ verifiable consent before collecting information from their children and describes different accepted ways to do so. We consider that you are acting as the parent’s agent in consenting to our collection of students’ information and therefore assume that you have obtained parental consent to this. However, as a best practice, you should consider keeping a record of the parents’ verifiable consent to such collection and consider allowing parents to review the personal information collected.

5.2.6. Preventing Access to Inappropriate Content

There is no embedded link in Typing Pal that would lead minors to access obscene, defamatory or otherwise objectionable content over the Internet. We provide original content free of obscene, defamatory or otherwise objectionable elements. In addition, we do not provide students with any messaging systems, chat rooms or other forms of direct electronic communication.

5.2.7. Disclaimer for Added Content

You can add your own training texts in Typing Pal, which will only be accessible to users at your school. However, you warrant that any such added content will be free of obscene, defamatory or otherwise objectionable elements. You also warrant that it will not infringe upon any intellectual property rights and that no royalties or other compensation will be required.

5.2.8. Legal Requirements

We may disclose personal information when required to do so by law or by a court.

5.2.9. Merger or Acquisition

In the case of our merger with another entity or an acquisition, we expect that the personal information that we have collected would be transferred to the acquiring entity or to the surviving entity, in a merger. Any such transfer shall be subject to our commitments set forth in this Privacy Policy.

6. About This Privacy Policy

6.1. Modifications

This document will occasionally be updated to keep pace with improvements to Typing Pal, to security technology and with changes to privacy legislation. We expect that such updates will be minor amendments. However, if any modification materially changes the protections outlined in this document, we will notify the subscription manager to obtain consent, either through an email or by a prominent notice in the management interface.

6.2. General Consent

We advise you to carefully read the latest version of our Privacy Policy, because your use of Typing Pal implies your consent to its terms. Should you disagree with any terms of this Privacy Policy, you should immediately cease using Typing Pal.

6.3. Contact

We strive to make our Privacy Policy as easy to understand as possible. If you have any questions about it or would like to make a request relating to the protection of your personal information, please send an email to privacy@typingpal.com or write to us at:

Druide informatique inc.
Data Protection Officer
1435 Saint-Alexandre Street, Suite 1040
Montreal (Quebec) H3A 2G4
Canada

6.4. Recourse

If you are not satisfied with the way in which we use your personal information, you can appeal to the supervisory authority with jurisdiction over such matters in your country. For example, the Office of the Privacy Commissioner of Canada is authorized to oversee matters relating to the handling of personal information in Canada, while the Commission nationale de l’informatique et des libertés (CNIL) has jurisdiction in France. If you reside in a European Union country, please visit the site of the European Data Protection Supervisor to find the relevant authority in your country.

The Typing Pal Team