Data Security and Privacy Plan

99math OÜ

Version 2.3 Last updated 28 September 2026 Supersedes v1.0 (2025) Contact legal@99math.com

0What data 99math receives

This section is stated first because it bounds everything that follows.

From a student, we hold a first name, the first letter of a last name, a country, a password, a player name chosen inside the game, an approximate grade or age, and the record of their play: which tasks were attempted, which were correct, and how quickly. We do not ask a student for a full last name, an email address, a telephone number or a postal address, and the product has no feature through which a student can supply one.

From a teacher, we hold a title, a name, an email address, a country and state, the name of the school, and the grades taught.

We do not receive annual professional performance review data, and we do not receive teacher or principal data as Education Law §2-d defines that term.

“Agency data” in this Plan

Where this Plan says agency data, it means the personally identifiable information we hold about a student whose 99math account is associated with an educational agency, in either of two ways.

• By creation. The account was created by a teacher acting for the agency. Such an account is agency data from creation until deletion, and remains so even if the class is later archived or the student is removed from it, because the agency’s authority was the basis on which the data was collected and that does not lapse.
• By linkage. A student who signed up independently later joins a teacher’s class. Their account is agency data from the point the link is made, for as long as it lasts.

In both cases agency data includes the student’s record of play. It is agency data wherever the student is: an account a teacher created remains agency data when the student plays at home, including when they are completing homework the teacher assigned. Our systems record whether an account was created by a teacher and which classes, and therefore which teachers and agencies, it is linked to, so this set can be identified.

Agency data does not include the data of students or parents who use 99math outside any school and have no link to a teacher.

A student account may be linked to more than one class, and those classes may belong to different educational agencies. In that case the account is agency data for each of them, and each agency’s rights under this Plan extend to its own relationship with that student. Section 8 explains how that is handled on deletion.

1Implementing contract requirements over the life of the contract

We maintain written policies and procedures for the handling of agency data, covering access control, encryption, employee training, incident response, subprocessor management and data disposal.

Our obligations to an educational agency are those set out in the Data Privacy Agreement executed with that agency, together with the requirements of Education Law §2-d and 8 NYCRR Part 121. Where an educational agency provides us with its own data security and privacy policy, we will review it and confirm in writing whether we can meet its requirements; we ask agencies to send those policies to legal@99math.com so that they can be recorded against the agreement. We do not treat requirements that have not been agreed with us in writing as binding instructions.

Compliance is maintained over the life of each contract, from signing onward. We review this Plan and the underlying practices at least annually, and on any material change to our services, our hosting arrangements or applicable law. This Plan is republished at the URL referenced in Exhibit K whenever it changes, and every version carries a date.

2Alignment with the NIST Cybersecurity Framework

Our safeguards are organised around the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity, Version 1.1 (NIST CSF). 8 NYCRR §121.5(a) adopts that version as the data security and privacy standard, and §121.9(a)(1) requires third party contractors to adopt technologies, safeguards and practices that align with it. The table below maps each Framework function to the controls we operate.

We will provide a more detailed control-by-control mapping to an educational agency, or to the New York State Education Department’s Chief Privacy Officer, on request.

3Administrative, operational and technical safeguards

Encryption

Personally identifiable information is encrypted in transit using TLS 1.2 or higher, and encrypted at rest in both the application database and the caching layer, as required by 8 NYCRR §121.9(a)(7). The caching layer sits on a private network reachable only from our own application servers, and its traffic is encrypted in transit as well.

Access control

Access to production data is restricted to the personnel for whom it is necessary and only to the extent necessary. Access is granted on a role basis and reviewed semi-annually. Access is revoked as part of offboarding. Database servers are separate from application servers and are reachable only from permitted addresses. Multi-factor authentication is required for staff access to production systems and to the Google Cloud console.

End-user authentication

Student accounts are deliberately low-value credentials: an account holds a first name, an initial and a record of game play, and carries no email address, so it cannot be used to reach the student or to reset anything else. Student passwords are stored salted and hashed, never in plain text, and can be reset by the linked teacher or parent. Student passwords have a minimum length of four characters, which reflects the age of the users; the compensating control is rate limiting. Sign-in attempts and other requests are rate limited on the server, per source network address and consistently across all application instances. Limits are applied per address because a class of students commonly shares one address through network address translation, and a per-account lockout would be triggered by ordinary classroom use. We will describe the limits to an educational agency on request.

Teachers and parents may sign in with a password, or through Google, Clever or Sign in with Apple. We never receive a password from those providers.

Vulnerability management

Application dependencies are scanned automatically for known vulnerabilities as part of our development pipeline. Container images running in our production Google Kubernetes Engine cluster are scanned with Trivy, deployed as a cluster operator: it produces a vulnerability report for every running workload, and rescans each time a new version is deployed and at least every twenty-four hours. Results are surfaced on an internal dashboard and findings are triaged against their severity and their exploitability in our environment.

We run on managed platforms, Google Kubernetes Engine and MongoDB Atlas, which apply security patches to the underlying infrastructure; we take those updates as they are released and keep the platform versions we run within their supported range.

Beyond our own scanning, the product is tested by AppCheck, an independent third-party vulnerability scanning and penetration testing service. Testing covers the production web application and its API, and runs on a recurring schedule. Testing is carried out against synthetic test accounts, so no student data is exposed to the testing process. Findings are triaged and remediated according to severity. We will describe the current scope, and our response to findings, to an educational agency on request.

Organisational

We maintain a written internal data security policy. Employees and contractors are contractually bound to confidentiality. Security practices are reviewed against industry standards and updated as those standards change. Responsibility for this Plan and for data protection questions rests with our Chief Technology Officer, who can be reached at legal@99math.com.

4Where data is stored

Agency data is stored in the United States. The application runs on Google Cloud Platform in the us-central1 region (Iowa), and the primary database is MongoDB Atlas, which runs on Google Cloud in the same region. The caching layer is in the same region.

Backups of production data are managed by MongoDB Atlas and held in the same United States region (us-central1) as the primary database. They are retained for up to twelve months before being overwritten, consistent with our public Privacy Policy.

99math is an Estonian company and members of our team work outside the United States. Personnel access to production systems for support, maintenance and incident response may therefore take place from outside the United States, under the same access controls, confidentiality obligations and logging described above. We disclose this so that educational agencies can assess it; we will provide a current list of storage locations on request.

5Training

Officers, employees and contractors who have access to, or receive, agency data are trained on the federal and state laws governing the confidentiality of that data. Personnel joining 99math complete this training before they are granted access to agency data; all personnel in post at the time this programme was introduced completed it by 14 September 2026. Training covers FERPA, COPPA and applicable state student-privacy law, our internal handling requirements, and the technical safeguards described in this Plan. Training is repeated at least annually and when requirements change. We maintain records of training completion and will confirm completion to an educational agency on request.

6Subprocessors

We use a limited number of third-party service providers (“subprocessors”). Each is vetted before engagement, is bound by a written agreement imposing data protection obligations no less protective than those we owe to the educational agency, and is granted access only where necessary for the internal operations of the 99math platform and only to the extent required. Subprocessors have no property, licensing or ownership rights in, or claims to, agency data, and are contractually required to comply with the educational agency’s data privacy and security policy.

Our complete list of subprocessors is published and dated at legal.99math.com/third-party-services. For each provider it states what the provider does and whether it receives student personally identifiable information (marked SP), teacher and parent information only (TPP), or no personal information (NO). That page is the authoritative list for the purposes of this Plan and of our agreements, and it is kept current as providers are added or removed.

Analytics providers are used to understand how the product is used so that we can maintain and improve it. They are not used for advertising, for marketing, or to build a profile of any student for any purpose other than providing 99math. Advertising and marketing tags are not loaded in student sessions.

The list is reviewed and republished at least quarterly, and whenever a subprocessor is added or removed. Where we have an agreement with an educational agency, we notify that agency before any new subprocessor with access to its students’ data begins processing, so that the agency has the opportunity to object.

7Incident management and breach notification

Monitoring and access controls are in place to detect unauthorised access. On identifying a data privacy or security incident we follow a documented procedure covering containment, investigation, mitigation and notification, and we record each incident and its resolution.

We notify the affected educational agency of any breach or unauthorised release of personally identifiable information in the most expedient way possible and without unreasonable delay, and in any event within 24 hours of discovering it, even where our investigation is still under way. This is within the seven calendar days required by 8 NYCRR §121.10. Our notification states what happened, when, which data elements were involved and what we are doing about it, in the detail the agency needs to meet its own notification obligations, and we update it as we learn more. We cooperate with the educational agency in those obligations and, where required, with the New York State Education Department’s Chief Privacy Officer. We do not charge educational agencies for our part in this.

Where a signed agreement with an educational agency sets a specific procedure, that agreement applies.

8Return, transition, deletion and destruction of data

On expiry or termination of an agreement, we delete the educational agency’s data at its direction. We act on a written request from a contact authorised by the agency. Where no written request is received, we dispose of the data after giving the educational agency ninety (90) days’ prior notice. The duty to dispose does not extend to data that has been de-identified, or that has been placed in a separate student account at the request of an eligible student.

Where a student account is linked to more than one educational agency, deletion at the direction of one agency removes that agency’s link and its access to the student’s records, and deletes the data held for that agency, but does not delete the account itself while another agency’s link remains. We confirm to the directing agency what was deleted and what remains, and why. Where the account exists only because of the directing agency, it is deleted in full.

Deletion uses industry-standard secure erasure; physical media, where applicable, is destroyed. Copies within encrypted backups are overwritten on the backup cycle described in section 4. We record the date, method and responsible personnel for each disposal and provide a certification of disposal to the educational agency on request.

9Data retention

We retain agency data only for as long as it is needed to provide the service to the educational agency. The schedule below is the same one published in our Privacy Policy, and applies to accounts in ordinary use as well as on termination.

Beyond that, data is retained only where a specific legal basis requires it, for example accounting records preserved for seven years under Estonian law, or records preserved for the defence of a legal claim. Retained data remains subject to the safeguards in this Plan, and no less protective ones, for as long as it is held.

10Exclusive purposes for data use

Agency data is used exclusively to provide access to and use of the 99math platform, an interactive web and mobile mathematics game, including creating and maintaining user accounts and delivering the educational functionality the educational agency has contracted for. We additionally process the minimum data necessary to maintain the technical resilience, safety and security of the service.

We do not sell agency data. We do not use it for advertising or targeted advertising, we do not use it to market to students, and we do not create a commercial profile of any student.

Paid content

99math is free for schools and teachers. Some content is available only through a paid membership or through mBucks, our in-game currency. Paid content is never needed for classroom use and is not offered during teacher-hosted or teacher-assigned sessions.

A student whose account is agency data (section 0) may encounter references to paid content when using 99math at home, for example when they open something the free version does not include. For these accounts, in every state, those references are contextual: they are triggered by the content being opened and by whether the account has a paid plan, and by nothing we know or infer about the student. They do not show the student’s name, progress or any other agency data. Before any price is shown, the student is asked to involve a parent.

We disclose this so that an educational agency can assess it before entering an agreement. Where an agency’s executed agreement addresses paid content or in-game references to it, that agreement governs.

11Artificial intelligence and machine learning

We do not use agency data to train, fine-tune or otherwise develop artificial intelligence or machine-learning models, whether our own or a third party’s, and our AI service providers are not permitted to train their models on data we send them. We will not do so without the prior written consent of the educational agency.

We use one AI service, and for one purpose: screening the player names students choose for inappropriate content, using Anthropic's API. Only a player's public nickname is sent, for review of profanity and vulgarity, so that it is safe to show to other players. No other feature of 99math sends agency data to an AI service, and no AI feature is offered to students.

12Mobile applications

99math is available as native applications for iOS and Android in addition to the web. The applications process the same data described in section 0 and are covered by every safeguard in this Plan. They are distributed through the Apple App Store and Google Play, which handle app distribution and any purchases made inside the app; those stores receive purchaser details but no student educational records from us.

Our published App Store privacy labels declare no data used to track users. The data declared as linked to a user is contact information (name and email address), a user identifier and purchase history, which are teacher and parent account details and purchase records; as section 0 states, we do not collect an email address or a full last name from a student. Product interaction data and diagnostic data (crash and performance information) are declared as not linked to a user. Our Google Play Data safety declaration states that data is encrypted in transit and that users can request deletion, and 99math is committed to the Play Families Policy.

13Contract lifecycle

An agreement remains in effect until cancelled or terminated by either party, unless the agreement provides otherwise. On cancellation or termination, data handling follows sections 8 and 9. Where an eligible student wishes to continue using 99math independently after an agreement ends, their data may be retained in a separate personal account, outside the scope of the educational agency’s agreement, until they or their parent requests closure and deletion.

14Challenging the accuracy of data

A parent, eligible student, teacher or principal may challenge the accuracy of data held about them by writing to legal@99math.com. Where the data originates from the educational agency, we refer the request to that agency, which controls the record, and we correct our copy once the agency confirms the correction. We acknowledge such requests within five business days and respond substantively within 30 days.

15Contact

Questions about this Plan, requests for our NIST CSF control mapping, storage-location lists, disposal certifications, or any data privacy matter should be sent to legal@99math.com.

16Relationship to the executed 2021 Plan

The Data Security and Privacy Plan executed with educational agencies from 2021 is a contract addendum: seven numbered clauses, followed by five items of Supplemental Information for the Parents' Bill of Rights. This Plan is a description of practice, published at a stable URL and referenced from Exhibit K, and its numbering is unrelated. Where an executed agreement cites the older document by number, this table gives the equivalent here. The executed agreement continues to govern; nothing in this Plan narrows it.