FERPA Statement

1. Our role

When a school, district, or institution uses Rigorous Reasoning, we act as a "school official" with a "legitimate educational interest" under 34 CFR § 99.31(a)(1) for the purpose of providing the curriculum, feedback, and progress tracking services described in the institution's contract. We handle student records under the direct control of the institution.

2. Educational records

Education records processed by Rigorous Reasoning on behalf of an institution typically include:

• Student name and institutional email address
• Course enrollment and roster membership
• Lesson responses and AI-generated feedback
• Assignment completion percentages and scores
• Instructor-assigned gradebook rollups

3. Use limitation

We will not use student educational records for any purpose other than providing the Service to the institution. We do not disclose personally identifiable information from education records to third parties without consent, except to sub-processors (hosting, database, AI feedback, and error reporting) bound by contracts that mirror our commitments to the institution.

4. Parental and eligible student rights

Under FERPA, parents (or eligible students 18 and older) have the right to inspect and review education records, request correction of inaccurate records, and consent to disclosures beyond those permitted by FERPA. These rights are exercised through the institution, which maintains control over the records.

5. Data deletion at institutional request

Upon written request from an authorized institutional contact, we will delete or return all student records associated with the institution within 30 days. Backups containing student records are cycled out within 90 days.

6. Sub-processors

We engage the following categories of sub-processors to deliver the Service: cloud hosting and database infrastructure, a large language model provider for activity feedback, Stripe for billing (institutional plans only), and an error monitoring provider. A current list of named sub-processors is available to institutional customers upon request.

7. Directory information

Rigorous Reasoning does not publicly display student directory information. Student profiles are visible only to the student themselves and to instructors of courses in which the student is enrolled.

8. Data security incident response

In the event of a security incident affecting institutional records, we will notify the institution's designated contact within 72 hours of confirmed discovery, consistent with reasonable notification practices.

9. Institutional Data Processing Agreement

Institutions requiring a signed Data Processing Agreement (DPA), Student Data Privacy Agreement (SDPA), or NIST 800-171 / state privacy rider can request one through institutional@rigorousreasoning.com.

10. Contact

FERPA and institutional privacy inquiries can be sent to privacy@rigorousreasoning.com.