Student Data Notice

Who does what

Your school owns the student and family information in Fish and decides how it's used. Attack Penguin provides Fish to you and handles that information only on your instructions. Where FERPA applies to your school, we act as a "school official" with a legitimate educational interest, under your direct control. Under Michigan's Student Online Personal Protection Act and similar laws in other states, we are the "operator" of a service designed and marketed for K-12 school purposes, and we meet those laws' duties whether or not they reach your school.

What we commit to

• School purposes only. We use student information to provide Fish to your school and for nothing else.
• No sale, no advertising, no profiling. We never sell or rent student information, never use it for targeted advertising, and never build a profile of a student except for your school's purposes.
• Security. We keep reasonable, written security measures, described on our security page.
• Deletion on request. When you ask us to delete a student's information, we delete it. When you stop using Fish, we return your data if you ask, then delete it within 60 days.
• Sub-processors. Every service that handles your data on our behalf is listed here, bound to protect it at least as well as we do, and we tell you 30 days before we add one.
• Breach notice. If student information is exposed, we tell you within 72 hours of confirming it, and help you notify families and anyone else the law requires.
• Support access you control. Our staff only view Fish as one of your people when you've turned on support access, for as long as you choose, and every session is recorded in a log you can read under Manage › Privacy & security.
• Research and improvement use only information that doesn't identify a student.

Data privacy agreements

We sign the Student Data Privacy Consortium's National Data Privacy Agreement, including the Michigan version used through the Michigan Student Data Privacy Alliance, and we offer the same terms to private and religious schools. Write to hello@attackpenguin.com to start one.

What's yours to do

• Directory information. If your school must publish the uses of directory information and offer an opt-out each year, that notice is yours to send. Fish's family directory lists each parent's name and their children's by default, with contact details only if the parent chooses; any parent can take themselves out at any time. You choose whether families see their own children's classes or the whole school. Include it in your directory-information notice.
• Consent for young children. For students under 13 with their own accounts, you consent on parents' behalf for school use; tell families what student accounts are used for.
• Requests from families. Requests to see, correct or delete a child's information come to you. Send them to us and we carry them out.
• Requests to delete an account. People can't delete their own Fish accounts; they ask you from their profile, and you delete or keep each one under Manage › Privacy & security. Please answer within 30 days.
• A privacy contact. Name one under Manage › Privacy & security, so we know who to call.

Sending us a request

Write to hello@attackpenguin.com from your school's privacy contact. We confirm within two business days and complete deletion and copy requests within 30 days, sooner where we can.