Student Data Privacy Notice

Cashy Classroom provides teachers with live financial education games and presentations for use in class, self-paced lessons that students complete individually, printable worksheets, and a class view in which the teacher sees progress and scores. Students access the product on Cashy's domain (play.cashygame.com or an Institution-branded Cashy subdomain) using a browser; no software is installed on student devices. Where a sponsoring Institution's branding appears, it is a static acknowledgment of the sponsor and contains no offers, product links, or calls to action.

Cashy Classroom contains no surveys, no advertising, no in-product purchases, no social features, no public profiles, and no messaging between students. Students are never asked for an email address or any other information to play a live game.

• To operate live games and presentations and display results in the classroom.
• To save self-paced lesson progress and present it to the student's teacher in the class view.
• To maintain the security and integrity of the platform.
• To measure, in aggregate and without identifying any student, which lessons and games are used, so that Cashy can improve the product.

Cashy does not use Student information for advertising or marketing of any kind, does not build profiles of Students for any purpose other than providing the educational service, and does not sell or rent Student information.

Cashy may use de-identified Student information, from which all direct and indirect identifiers have been removed such that no Student can reasonably be identified, to develop and improve the educational service and to report aggregate usage. Cashy will not attempt to re-identify such information and prohibits any recipient from doing so. Cashy does not use Student information, in identifiable or de-identified form, to train artificial intelligence or machine learning models, and does not permit any subprocessor to do so.

• The student's teacher and school see the student's progress, scores, and completion in the class view.
• A sponsoring bank or credit union, where one funds the school's access, sees only aggregate usage for the schools it sponsors (for example, the number of sessions run and students reached). It does not see individual student names, email addresses, scores, or responses.
• Cashy's subprocessors, each bound by written confidentiality and security obligations and processing Student information solely to operate the platform, are:

  Amazon Web Services, Inc.	Hosting, database, and backups. All Student information. United States (US East region).
  PostHog, Inc.	Product analytics and masked session replay. Account identifier, usage, and technical information. United States.
  Functional Software, Inc. (Sentry)	Error monitoring. Account identifier, IP address, and technical information. United States.

  Cashy gives Institutions at least 30 days' written notice before adding a subprocessor that will process Student information, and provides an updated list on request and at the start of each school year. No other third party receives Student information.
• Cashy does not disclose student information to any other party except as required by law or as directed by the school.

Cashy Classroom can be connected to Google Classroom so that a teacher can share an activity to a class and have students join from their Google Classroom stream. The connection is optional and is enabled by the teacher or school, not by Cashy.

• What Cashy receives from Google: the class name and, for each student on the roster, the student's name and school Google account email address. Cashy requests only the Google Classroom permissions needed for rostering, sharing activities, and, where the teacher requests it, returning grades.
• How it is used: to show the Teacher the class roster inside Cashy, to record each Student's progress against the correct Student, and to return grades to Google Classroom when the Teacher chooses. Google user data is used for no other purpose.
• Storage and writes. Roster information received from Google is stored on Amazon Web Services in the United States, encrypted at rest. Where a Teacher chooses to return grades, Cashy writes the Student's score to the corresponding Google Classroom assignment; no other information is written to Google.
• Limited Use. Cashy's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the roster, progress, and grade features described above, is never used for advertising, is never sold, and is transferred only to the subprocessors listed in Section 4 as needed to operate the service, or as required by law. Cashy personnel do not read Google user data except for security, abuse investigation, legal compliance, or with the Institution's consent.
• Deletion. Roster information received from Google is deleted when the teacher or school disconnects the integration, when the student account is deleted, or within 60 days after the school's or sponsor's license ends, whichever is first.
• Students who join a live game from Google Classroom still play under a nickname; the live game does not display or use their Google account information.

• FERPA. Where a school provides student information to Cashy, Cashy acts as a school official with a legitimate educational interest, uses the information only for the purposes the school authorizes, remains under the school's direct control with respect to that information, and does not redisclose it except as directed by the school or required by law.
• COPPA. Cashy Classroom is licensed to Institutions and is not offered directly to children. For Students under 13, the Institution provides consent on behalf of parents, which Cashy relies on only because Student information is collected solely for the Institution's educational purpose and for no other commercial purpose. Students under 13 do not create accounts themselves; a Teacher or the Institution enrolls them using a school-issued email address. Cashy provides this Notice to the Institution as its description of practices, permits the Institution to review and delete any Student's information at any time, and collects no more than is reasonably necessary. Live games collect only a nickname, which is not linked to any persistent identifier.
• Ownership. Student information is and remains the property of the Institution. Cashy acquires no rights in it other than the limited right to process it as described in this Notice.
• State student privacy laws. Cashy's practices are designed to comply with California's Student Online Personal Information Protection Act (SOPIPA), the Illinois Student Online Personal Protection Act (SOPPA), New York Education Law 2-d and Part 121, and comparable state laws: no targeted advertising, no profiling for non-educational purposes, no sale of Student information, deletion at the Institution's request, and no surveys of Students, consistent with the Protection of Pupil Rights Amendment.
• District agreements. Cashy will sign the Student Data Privacy Consortium National Data Privacy Agreement, a state alliance version of it, or an Institution's own data privacy agreement, and will complete the Institution's vendor security review. Cashy does not currently hold a SOC 2 report.

• Nicknames and responses from live games are retained only for the duration of the session and its results display. Aggregate results are retained for the teacher's class view.
• Self-paced lesson accounts and learning activity are retained while the school's or sponsor's license is in force and deleted within 60 days after it ends.
• A school or Teacher may request deletion of a Student's information at any time by emailing cashy@cashygame.com. Deletion is completed within 30 days, and Cashy provides written certification of deletion on request.
• Before deletion, an Institution may request an export of its Students' progress and completion records in a standard format.
• Deleted information ages out of encrypted backups within 60 days.

Parents and guardians may review the information Cashy holds about their child, request correction, or request deletion. Because student information is provided to Cashy under the school's authority, requests should be directed to the school in the first instance; parents may also contact Cashy at cashy@cashygame.com. Parents may challenge the accuracy of their child's information through the Institution, which may correct it in the class view or direct Cashy to do so. Cashy verifies requests with the Institution before acting on them and responds within 30 days.

Student information is hosted on Amazon Web Services in the United States, encrypted in transit using HTTPS/TLS and at rest using AWS-managed encryption, and backed up nightly in encrypted form. Product analytics and session replay data are also stored in the United States. Access is restricted to authorized Cashy personnel and contractors on a least-privilege basis, each bound by written confidentiality obligations and trained annually on security awareness and on the student privacy obligations described in this Notice. Cashy will notify affected Institutions without undue delay, and in any event within 72 hours of discovering a security incident affecting Student information, will describe the information involved and the steps taken, and will not notify parents directly except as the Institution directs or the law requires. Additional technical documentation is available to school technology offices on request.

School network administrators who filter web access should allow the following domains for Cashy Classroom to function: cashygame.com and all subdomains (including play.cashygame.com and sponsor-branded subdomains), and api.cashygame.com. Cashy does not load advertising, cross-site tracking, or social media resources on Student-facing pages.

Cashy will notify Institutions through the administrative contact on file before any material change to the practices described in this Notice takes effect. Questions may be directed to Cashy Technology, Inc., Attn: Privacy, 8 The Green, Suite #14776, Dover, DE 19901, United States; cashy@cashygame.com; +1 (813) 785-2215.