School Data Processing

School review boundary

The school or governing body owns and approves its own Privacy Impact Assessment (PIA) or equivalent review. Riverun supplies factual vendor information and follow-up answers; it does not complete or approve the school's PIA on the school's behalf.

Purpose

For the bounded School Evidence Pilot, Math.Foundation processes data to provision the approved school tenant/users, run mathematics diagnostic and intervention functions, provide teacher-visible mastery/gap evidence, support and secure the service, administer the school order, and produce agreed pilot/export evidence.

The pilot does not authorise unrelated advertising profiles, data brokerage, public learner profiles or open-ended reuse of school learner data.

Data subjects and categories

Depending on enabled functions, school processing may involve learners in the approved cohort, teachers, the approved SchoolAdmin, school buyer/privacy/support contacts and authorised Riverun service/support actors.

• account identifiers, names and email where used;
• school/class/enrolment relationships and year level;
• diagnostic responses and placement state;
• skill/mastery/review state and misconception/intervention evidence;
• school-scoped consent attestation metadata and authority provenance;
• support/security/incident records;
• subscription/seat/payment references;
• export and deprovisioning receipt metadata.

Schools should not upload unrelated sensitive records, health/counselling notes, full identity documents, or other personal information not required for the agreed service.

Institutional authority

• Authentication proves identity only and cannot create SchoolAdmin or Teacher authority.
• School/SchoolAdmin authority is created only through canonical Math institutional provisioning.
• Teacher authority is downstream of exact SchoolAdmin authority.
• Educator learning writes require enrolment in the educator's exact school and active consent for the same learner/school pair.
• Ambiguous or cross-tenant authority fails closed.
• Riverun Education may coordinate a partnership but does not gain Math learner-data authority merely by doing so.

Consent and minors

The institutional model records school-scoped consent provenance rather than treating a login/domain as consent. The school remains responsible for identifying the authority, notices and approvals required for its cohort and use case.

The separate personal/family age-gating path stores birth year rather than full date of birth. A school should not send full dates of birth merely to establish Math.Foundation school consent.

AI-supported functions

Where AI-supported tutoring or diagnosis is enabled, processing is limited to the documented educational/service purpose and remains within the product's structured mathematics workflow. AI does not independently grant institutional authority or make autonomous high-stakes school decisions.

Schools should review the current AI Safety statement and subprocessor list for the exact deployment.

Subprocessors, locations and cross-border processing

The current public provider list is maintained at Subprocessors. Exact production storage/processing locations and any material cross-border transfers are supplied from current provider/deployment evidence during buyer review.

No storage region should be inferred from an old plan, source comment or non-production proof environment. If a location cannot be verified for the exact deployment, it remains an open buyer-review item.

Security controls

Current source/configuration controls include product-owned tenant/role authority, signed institutional authentication tokens, nonce/state protections, guarded OIDC endpoints, encrypted institutional OIDC client secrets, school-scoped consent and server-side educator access checks.

Operational claims such as penetration-test results, certifications, uptime, restore time or incident-response performance require separate observed evidence and are not implied by source controls. See the Security overview.

Retention, export and deprovisioning

The school and Riverun should agree the applicable pilot retention rule before learner activation. This generic page does not invent a universal retention period.

1. complete any agreed school export at exit;
2. record export receipt/checksum metadata;
3. revoke/remove access and integrations as required;
4. perform the agreed data disposition/deprovisioning procedure;
5. record lifecycle evidence for the deprovisioning action.

The isolated persistence/restore/deprovisioning exercise remains a hard School #1 gate until R33-25 is proved.

Access, correction and portability

Riverun will support authorised school requests relating to access, correction, export or deletion of Math.Foundation records, subject to verified authority and the applicable agreement. The school remains responsible for requests its own policy/legal role assigns to it.

Incident contacts

• Security: security@math.foundation
• Privacy/data processing: privacy@math.foundation
• Operational support: support@math.foundation

Potential cross-tenant access, credential compromise, child-safety risk or unauthorised disclosure may suspend a pilot while the issue is contained and investigated. Notification obligations are assessed against the actual event, agreement and applicable requirements.

Contract schedule

For procurement review Riverun can supply a detailed School Data Processing Schedule covering instructions, data categories, confidentiality/security, subprocessors, AI processing, retention, export, deprovisioning, incident handling and audit evidence. The schedule becomes binding only when incorporated into an executed school agreement/order or otherwise accepted by the parties.