State Data Privacy Compliance
ThinkKits processes only publicly available federal education data sourced from NCES, CRDC, SAIPE, E-Rate, and EdFacts. We do not access, store, or process protected student records. As a result, most student data privacy laws (FERPA, COPPA, and state-level student data privacy statutes) do not apply to our core platform. However, we maintain compliance readiness for any district or state that requires it as part of procurement.
1. Our Data Model
ThinkKits processes only publicly available education data. The following clarifies what we do and do not handle.
What We Process
- Publicly available school-level data from federal agencies (NCES, ED, FCC/USAC)
- Aggregated school demographics (enrollment, FRL %, race/ethnicity distributions)
- Federal funding allocations and expenditure data
- Standards frameworks and curriculum alignment data
- Published research and evidence from IES/WWC/ERIC
What We Do NOT Process
- Individual student records or grades
- Student names, addresses, or contact information
- Parent/guardian information
- Behavioral or disciplinary records
- Health or medical information
- Special education IEP details for individual students
2. Federal Compliance
| Law | Applicability | Rationale |
|---|---|---|
| FERPA (20 USC §1232g) | Exempt | ThinkKits does not receive education records from educational institutions. All data is publicly available. |
| COPPA (15 USC §6501) | Exempt | ThinkKits is not directed at children under 13 and does not collect personal information from children. |
| PPRA (20 USC §1232h) | Not Applicable | ThinkKits does not conduct surveys of students. |
3. Illinois — Student Online Personal Protection Act (SOPPA)
105 ILCS 85
Purpose: Protects student data collected by school technology operators
Our Position: ThinkKits does not qualify as a school "operator" under SOPPA because we do not operate a website, online service, or mobile application that is: (a) used primarily for K-12 school purposes, (b) designed and marketed for K-12 school purposes, or (c) used at the direction of a school or teacher. Our platform serves school administrators, district leaders, and vendors — not students.
DPA Readiness: We can sign a SOPPA-compliant DPA addendum if required by an Illinois district for procurement, with explicit scope limitation noting our exemption.
4. New York — Education Law 2-d
NY Education Law §2-d
Purpose: Requires educational agencies and third-party contractors to protect student PII
Our Position: ThinkKits is not a "third-party contractor" under Ed Law 2-d because we do not receive student PII from educational agencies. All data we process is from publicly available federal sources.
NIST CSF Alignment: Despite exemption, ThinkKits' security practices align with the NIST Cybersecurity Framework as referenced in NY Ed Law 2-d:
- Identify: Asset inventory, data classification, risk assessment
- Protect: Access controls, encryption, security training
- Detect: Continuous monitoring (Sentry, UptimeRobot), anomaly detection
- Respond: Documented incident response plan
- Recover: Backup strategy, disaster recovery procedures
Parents' Bill of Rights: We can provide a supplemental disclosure statement upon request.
5. California — AB 1584
Education Code §49073.1
Purpose: Governs contracts between LEAs and third parties for digital education services
Our Position: AB 1584 applies to contracts where a third party has access to student records. ThinkKits does not access student records. Our data sources are entirely federal/public.
Contract Readiness: We can include AB 1584 contract language addenda for California districts, explicitly documenting our public-data-only scope.
CCPA/CPRA: For user account data (adult users only), ThinkKits complies with the California Consumer Privacy Act. Users can request data access, deletion, and opt-out.
6. Colorado — Student Data Transparency and Security Act
HB 16-1423
Purpose: Requires transparency about student data collection and security practices
Our Position: ThinkKits does not collect student data. Our transparency commitment is demonstrated through this public compliance documentation and our methodology whitepaper.
7. Connecticut — Student Data Privacy Act
PA 16-189
Purpose: Restricts use of student information by operators of education technology
Our Position: We are not an "operator" as defined, since we do not operate technology used by students. We serve adult professionals (administrators, vendors, researchers).
8. General State DPA Readiness
ThinkKits maintains template Data Processing Agreement language that can be customized per state requirements. We proactively sign the state Student Data Privacy Consortium (SDPC) National DPA where applicable. For states with specific DPA registries (e.g., New York's Data Privacy and Security page), we will register upon request. Contact legal@thinkkits.com for DPA execution.
9. Procurement FAQ
Do we need to sign a DPA with ThinkKits?
Because ThinkKits processes only publicly available data and does not handle student PII, a DPA is typically not required. However, we are happy to sign one for procurement compliance if your district requires it.
Is ThinkKits FERPA compliant?
FERPA does not apply to ThinkKits because we do not receive education records from schools. We only use publicly available federal datasets. This simplifies procurement and eliminates the need for individual school directory information opt-in.
Does ThinkKits collect data about my students?
No. ThinkKits uses publicly available school-level aggregate data from federal sources. We never see, collect, or process data about individual students.
Can ThinkKits operate in our state?
Yes. Because we process only public federal data, ThinkKits is compatible with all state student data privacy laws. We maintain compliance documentation for major states and can provide custom addenda on request.
What user data does ThinkKits collect?
For adult users only: email address, name, and organization (for account purposes). Payment data is handled entirely by Stripe and never touches our systems.
10. Contact
Compliance & Security Inquiries
For compliance inquiries: legal@thinkkits.com
For security questions: security@thinkkits.com
Phone: (267) 936-0332