99math Privacy Policy

99math is a platform for learning and practicing math, motivated by fun gameplay and friendly competition.

Students can play 99math in school or at home. With their teacher, students play in synchronous or asynchronous multiplayer games with their classmates. Every student can see what went well and which tasks need improvement. At home, they create an account, pick a topic to practice, either alone or with friends, and earn performance badges that motivate them to achieve greater results. Students can create teams and go against players from all over the world. Competition with other players makes kids eager to progress in math.

Teachers can use 99math for engaging math practice in the classroom or to give assignments for homework. Our platform personalizes topics based on the class’ grade for a quick setup. Teachers get a detailed report about every student so they can analyze mistakes and understand what skills need focus. In addition to that, teachers have an option to see the progress their class or individual students have made over time: their effort, mistakes and improvements. Practical and personalized data helps educators make informed decisions faster and boost students’ progress.

Parents can create accounts to play 99math with their kids and link accounts together to see their child’s performance data. Similarly to teachers, parents get reports on effort, activity, and progress, also the struggles and achievements of the student.

This Privacy Policy is the document where we lay out for you the following: - What kind of data we collect - How we collect it - Why we collect it - How we use it - Who has access to it - How you are able to request access and removal of your data - How to contact us or data protection authorities

We give this information so that you may decide whether you want to use 99math or not. We are committed to following the rules laid out in this document. We only ask you to accept these rules and principles of how we collect and process your personal data. You accept by creating an account. If you are unhappy with some of the Privacy Policy, you unfortunately cannot use 99math.

Personal data or personal information is any information relating to you that can identify you, directly or indirectly. Our platform is accessed through accounts. Having an account helps you keep track of your progress, personalize your own experience, save settings for multiple visits and compare your progress with other players. If you are a parent or a teacher, an account is necessary to keep track of the progress your child or student has made. Collecting some personal data is therefore necessary for people to use 99math as intended.

99math’s referral system also allows teachers and parents to send invites to other teachers and parents through our platform. 99math will collect the email address that you share with us and where the invite will be sent to. This email address will only be used for sending this one-time message. If the addressee wishes to accept the invite, then and only then will we use this data to track a successful referral back to your account. Despite the foregoing, you should only provide the email address of a person who has given you their consent to share their personal data and you must not share students’ email addresses.

We follow that all data collection and processing must be fair and lawful. This means that you have a right to understand how your data is collected and used and that there is a legal basis to the collection of your data. We also follow that data should only be collected if it is necessary for either you or our platform. Even when collecting your data is necessary for our platform, we will not collect it, if it infringes your interest in privacy. Since we collect and process personal data, we have an obligation to keep that data private and secure. We use all necessary legal mechanisms, up-to-date technology and best practices of data protection to ensure that your data is kept safe after its collection.

Since our company is based in Estonia, a member state of the European Union, we have taken all necessary steps to be compliant with the rules of the General Data Protection Regulation (GDPR). Since our platform is also used in the USA and many of our users are children under the age of 13, we comply with the Children's Online Privacy Protection Act (COPPA). Where 99math is used by a school or district, we act as a school official under the Family Educational Rights and Privacy Act (FERPA), and we support schools in meeting their obligations under the student data privacy laws of their state. We sign state and district data privacy agreements where they are required, and where we have signed one, it governs our handling of that school's student data. Section 3.7 explains how this works.

There are three different types of an account which you can create to use 99math: a student’s account, a parent’s account and a teacher’s account. For more information about what each of these accounts can do, please also see our Terms of Use.

We emphasize that our Privacy Policy and the rules herein apply to all these accounts in the same manner. We keep in mind that our average user is a child, whose data needs more vigorous protection, and we have created this Privacy Policy on the basis of that knowledge. Even so, we treat a parent’s/teacher’s data with the same care. We do however collect different data from you, depending whether you use 99math as a student, a parent or a teacher.

We only collect the minimum amount of personal data needed. To create an account, we ask you for the following information:

- Your first name and the initial of your last name - Password - Player name - Grade or age

Your first name and initial of your last name are used to automatically create a unique username just for you. This username and your password are your login information, which will be hidden from other people. Your player name is a name that you create and which can be seen by other users on our public leaderboards. We ask for your grade or age so that you may see math content that is suitable for students at the same age/grade, not too hard and not too easy. Therefore, the grade we ask you about is an approximation of your skill level, not the specific grade in the school you study at. Also your grade/age enables you to see how you compete against others at your age/grade on the leaderboards.

You can also create an account or sign in through another service instead of choosing a password with us.- Google. Google sends us your email address, name and Google profile picture.- Clever, if your school uses it. Clever sends us the account information your school has chosen to share with us.- Apple, in our iOS app. Apple sends us your name and an email address. If you choose Apple's "Hide My Email", we receive a forwarding address rather than your real one, and that is all we ever hold.
We do not receive your password from any of these services, and we cannot use them to see anything in your account with them.
The legal basis for processing all this data is our legitimate interest to process. It is in our interest to provide people access to our platform. Login data is necessary to create a permanent and secure account. An important part of 99math, something that makes us different from other similar platforms, is that our users can see how their skills are compared to other players in their country or grade/age group.
We also provide a service to teachers who can use 99math as an educational tool. Where a student account is created by a teacher for school use, we process this data on behalf of and on the instructions of the school, on the basis of the school's consent given under COPPA and, in the EU/EEA, the school's own legal basis as controller. See section 3.7.

A student account can also be created through a parent’s or a teacher’s account. In this case we only ask for your username.

In addition to all the data mentioned above, our platform also collects some data automatically from all users (see below for automatically collected data).

We do not demand, request or prompt you to give us any other personal data during your use of 99math. Our platform does not have any features where you are able to give out additional personal data yourself.
We deliberately ask students for as little as possible. We do not ask a student for their full last name, an email address, a phone number or an address, and we have no feature that lets a student give us any of these. A student account is created from a first name, a single initial and a password, which is the minimum needed to keep an account secure and to tell two classmates apart.

We ask you for the following personal data when you sign up for an account:

- Your full name - Email address - Password

You can also create an account or sign in through another service instead of choosing a password with us.- Google. Google sends us your email address, name and Google profile picture.- Clever, if your school uses it. Clever sends us the account information your school has chosen to share with us.- Apple, in our iOS app. Apple sends us your name and an email address. If you choose Apple's "Hide My Email", we receive a forwarding address rather than your real one, and that is all we ever hold.
We do not receive your password from any of these services, and we cannot use them to see anything in your account with them.

This data is needed to provide you with secure login information and for identification purposes. We may also use your email address to send you important information about our platform and service (e.g. updates to the games, Privacy Policy or Terms of Use) and your child’s progress (if you choose to receive this information). Your email address can also be used as an additional login option in case you have forgotten your password. The legal basis for processing this data is your consent and our legitimate interest to provide a secure way to use the platform and communicate with the user if it is necessary for the user’s interests.

If you sign up for a paid membership to 99math, we ask you for your credit card number, postal/zip code, card expiration date and Card Verification Code (CVC), in addition to all of the information listed above. This information is used by 99math to apply the appropriate charges to your credit card and to ensure that the membership is applied to the correct student account. 99math does not store any credit card information directly - all credit card information and transactions are stored by our payment provider, Stripe. Please click here for more information about how Stripe secures customer information. The legal basis for processing this data is performance of a contract.

In addition to all the data mentioned above, our platform also collects some data automatically from all users (see below for automatically collected data).

We ask you for the following personal data when you sign up for an account:

- Your title (Mrs., Miss, Ms., Mr., Dr. or Mx.)- Your full name - Email address - Password- Country, and in the USA your state- The name of your school and the grades you teach, which you can add in your settings
You can also create an account or sign in through another service instead of choosing a password with us.- Google. Google sends us your email address, name and Google profile picture.- Clever, if your school uses it. Clever sends us the account information your school has chosen to share with us.- Apple, in our iOS app. Apple sends us your name and an email address. If you choose Apple's "Hide My Email", we receive a forwarding address rather than your real one, and that is all we ever hold.
We do not receive your password from any of these services, and we cannot use them to see anything in your account with them.
This data is needed to provide you with secure login information and for identification purposes. We may also use your email address to send you important information about our platform and service (e.g. updates to the games, Privacy Policy or Terms of Use) and your student’s progress (if you choose to receive this information). Your email address can also be used as an additional login option in case you have forgotten your password. Information about your school district and school is needed to check whether we have an agreement with your school. The legal basis for processing this data is your consent and our legitimate interest to provide a secure way to use the platform and communicate with the user if it is necessary for the user’s interests.

In addition to all the data mentioned above, our platform also collects data automatically from any user (see below for automatically collected data).

We also collect data related to your performance in the games (‘Game Data’). This Game Data includes your progress on our platform, how many games you have played, what mistakes you made when playing etc. This data is shown to you in an aggregated form as experience and as badges for reaching certain achievements. The purpose of collecting, saving and aggregating Game Data is to provide users an optimal experience - when you know your skill level, we can recommend and you can choose games that fit your skill level, that are not too easy or too difficult. It also helps us improve our educational algorithms — the rules that decide which task to show a student next. We do this on aggregated, de-identified data, and as stated in section 5.1 we do not use personal data to train AI models. Saving and showing Game Data is helpful to incentivise students to progress in the game, which in turn means that they get better at math.

Some components of Game Data will be reported to a parent or teacher account that is linked to a student account. A student account will be linked with a teacher’s account when your teacher gives you a unique class code for your accounts to be linked. A student account will be linked with a parent’s account, if the parent enters their child’s username and password into the appropriate form on their account.

A linked parent or teacher account can see your progress in games: how many games you have played, how many correct answers you got, what mistakes you made and so on. Although 99math is not primarily intended to be a tool for assessing someone’s skill, we have created these features so that a teacher can use 99math as part of a curriculum. By accessing this Game Data, a teacher or parent can see what the child/student already knows well and where individual teaching is needed for improvement.

When a school, district or other education agency decides to use 99math, the relationship works differently from a parent or a student signing up at home. The rules below apply in addition to the rest of this Privacy Policy.
The school decides, and the school stays in control. A teacher creates classes and student accounts under the authority of their school or district. For that use, the school or district is the controller of the student data and 99math is its processor and service provider. We process student data only for the purposes set out in this Privacy Policy and in any agreement we have signed with the school, and in line with the settings and choices the school makes in the product. Where we have signed an agreement with a school, that agreement is the school's instructions to us. We are not bound by school policies, requirements or instructions that have not been agreed with us in writing.
Returning or deleting a school's data. A school may ask us to return or delete the student data we hold for it. We act on a written request from a contact authorised by the school, within a reasonable period and in any event within the time set by any agreement we have signed with that school, except where the law requires us to keep something for longer.
Consent under COPPA. COPPA allows a school to consent on behalf of parents to the collection of a student's personal information, where that information is used for an educational purpose and for no commercial purpose. Teachers who create student accounts do so on the basis that they act for their school and within the authority their school has given them. Schools remain responsible for telling parents which services they use; we support them by publishing this policy and by giving them the information they need.
FERPA and the school official exception. To the extent that the student data we hold forms part of a student's education records, 99math acts as a "school official" with a "legitimate educational interest" under FERPA, 34 CFR § 99.31(a)(1)(i)(B). We are under the direct control of the school with respect to the use and maintenance of that data, we use it only for the purpose for which the school engaged us, and we do not re-disclose it except as this policy allows or the law requires.
What we never do with student data. We do not sell student data. We do not use it for advertising or targeted advertising, or share it with anyone for that purpose. We do not build a commercial profile of a student for any purpose other than providing 99math. We do not use student data to train AI models, and our AI service providers are not permitted to train their models on the data we send them.
If we have signed an agreement with your school. Where 99math has entered into a data privacy agreement with a school, district, education agency, or a consortium or purchasing cooperative acting for them, that agreement governs our handling of that school's student data and prevails over this Privacy Policy to the extent of any conflict.
Parents of students at a participating school. If your child uses 99math through their school, please contact the school or district first with questions about the data, or with requests to see, correct or delete it. Under FERPA and state student privacy laws those requests are handled by the school, and we support the school in answering them.

99math may also collect your personal data automatically from your computer or mobile device when you use our platform. This automatically collected data includes the following:

- Your internet browser - Your IP-address and mobile network information - Device information such as operating system - Geolocation data (which may identify your country and city but not your street) - Information about sites you have visited before and after - Server log information, e.g login times and site navigation - Other information collected through cookies, web beacons, and pixel tags

Cookies are small bits of information stored on your device. You may use your internet browser’s (mobile app’s) settings to change whether you accept cookies and if so, which cookies. If you do not accept cookies, you may not be able to use 99math or some of its features. 99math uses cookies to temporarily store data. This includes such data as your email address, username, settings and preferences.

We automatically collect your personal data for the internal operations of this website. This involves activities necessary for the maintenance and functioning of the website, saving your data, authenticating users, protecting our platform and keeping its users secure, ensuring legal compliance and other internal uses. We also use this data to analyse how users use 99math, so that we may improve the user experience, and from what websites people reach 99math, so that we may improve our marketing strategies. The legal basis for this processing is our legitimate interest in the following: providing safety for our platform and our users, improving and optimizing the user experience, maintaining and growing our userbase.

We may share your personal data with our service providers who we have contracted to perform certain functions or services on our behalf, such as hosting the platform, creating and managing accounts, managing databases, performing analytics and site metrics, logging errors etc. The third-party service providers may also use cookies, web beacons, pixel tags and other technologies to collect data in the form of persistent identifiers such as your device number and online activity, for example the pages you viewed, links you clicked and time you spent on our page.

99math’s team will review any third party’s privacy policy before contracting them to ensure that they are also compliant with the same regulations we are and that they will keep your data safe and secure. We share data with and allow it to be used by third parties only when and to the extent it is necessary for the specific task that the third party was contracted to do.

You can see a full list of all our third-party service providers here. We have also added information on what each third party does for us and links to their privacy policies. As our platform grows and changes, we will likely be contracting more service providers in the future. The list is thus updated periodically.

Other than that, we will share your personal data only if there is a legal requirement or if there is a warranted exception in the applicable law.

It is important to specify how we do not use your personal data:

- We do not give, sell or lease a student’s personal data to advertisers or for the purpose of direct advertising. - We will not make your contact information public. - We do not share or give access to your data to third parties except for our service providers (see below) or unless legally obligated to do so. - Our platform does not have third-party advertisements. - We do not use your personal data to train AI models, and our AI service providers are not permitted to train their models on the data we send them.

We will not publish or give public access to your data like your username, login information or email address. We may share some Game Data with the general public outside of the 99math platform if the data is aggregated and non-personally identifiable, for example statistics in marketing materials about where our users are mostly located or what games are most popular. We may use your anonymous nickname, for example to show which players are at the top of our leaderboards.

Some of your Game Data can be seen on your public profile. Your profile can be accessed through our platform, where it is possible to look at individual users’ profiles. Your public profile includes only the following:

- Your anonymous player nickname - Your country - The name of your team if you have joined one - Your overall level of experience - Your ‘badges’, which show completing certain game-related achievements.

This Game Data is made public so users can assess their skill levels compared to other players. Additional Game Data is only shown to a parent’s or a teacher’s account if it is linked with your account.

We undertake to keep your personal data safe and secure, avoid unauthorized access, disclosure, misuse or alteration of your personal data.

We use all appropriate and reasonable security measures to do that, for example:

- We have an internal data security policy. - We use contemporary measures for digital security and follow industry standards. - We have relevant training for our employees. - Our employees are contractually obligated to keep confidentiality. - Access to personal data is only possible for appropriate employees.

We also use the following technical precautions:

Password protection. Creating a secure password is the key to protecting your account, because having a secure password prevents unauthorized access to your account. When storing the password, we never store the password as plain text. We always salt the password and encrypt it before storing it to the database. We recommend that you choose a password that is hard to guess and isn’t too common, but is easy to remember. Additional information on password security, why having a secure password is important and how to choose a good password, can be found from The Cybersecurity and Infrastructure Security Agency (CISA) website.

Database protection. Our database servers use different servers from our application servers and are accessible only to specific IP addresses. Any IP address that is not listed in the IP address whitelist will not be able to access the database. All databases are also password protected.

SSL encryption. Any data that is transferred through our application is protected by encryption with the Secure Socket Layer (SSL) protocol. SSL protocol makes it difficult for unwanted parties to access your data when in transit.

We also periodically review our practices of collecting and processing data against software industry standards. We try to keep our practices up to date in the face of technological advancements that malicious people could use to access data.

Please keep in mind that transmitting and storing data digitally cannot be 100 percent secure. While we do our best, we cannot guarantee that nothing bad will ever happen. You are responsible for keeping your password safe. We do not accept liability for unintentional disclosure of personal data to the fullest extent permitted by law.

For users in the European Union / European Economic Area. 99math is based in Estonia. Your personal data is stored on our servers located in the United States, in the Google Cloud us-central1 region (Iowa). Some of our third-party service providers are also located outside the EU/EEA. This means that your data is transferred to servers outside the EU/EEA. The data protection laws of other countries may not be as comprehensive as those in the EU/EEA.

We transfer personal data to a country outside the EU/EEA only if the country is recognised by the EU as having an adequate level of data security or if the transfer is made with your consent or is made in our legitimate interest. When we transfer your personal data, we will take reasonable steps to ensure that your rights continue to be protected, for example by concluding the EU Standard Contractual Clauses with third parties.

If we discover a breach or unauthorised disclosure of personal data, we investigate immediately, take steps to contain it and restore the integrity of our systems, and keep a record of what happened.
We notify affected users without undue delay. Where the data came from a school, district or education agency, we notify that school or agency in the most expedient way possible and without unreasonable delay, and in any event no later than seven calendar days after we discover the breach, so that the school can meet its own notification duties. We give the school what it needs in order to do so: what happened, when, which data was involved, and what we are doing about it. We do not charge schools for our part in this.
For users in the EU/EEA, we notify the Estonian Data Protection Inspectorate within 72 hours of becoming aware of a personal data breach where the law requires it, and we notify affected individuals directly where the breach is likely to result in a high risk to their rights.
Where a signed agreement with a school sets a shorter deadline or a different procedure, that agreement applies.

You have the following rights in relation to your personal data:

- The right to be informed about what personal data is processed and why. - The right to access the personal data that we hold. - The right to have your data corrected or amended. - The right to request 99math to delete your personal data. This applies if your personal data is no longer required for the purpose it was collected for or if you revoke your consent. - The right to restrict us from processing your personal data for a certain period of time. - The right to object to further processing of your personal data if it is not consistent with the primary purpose for which your data was collected (e.g if we use it for direct marketing instead).

If you are a parent of a child who uses 99math and is under the age of 13 then you may review your child's personal data or ask for it to be deleted and refuse to permit further collection or use of the child's information. You may do so by writing a request at this link. However, please keep in mind that this will terminate your child’s use of 99math. Since 99math may be used by your child’s teacher as part of their curriculum, please contact your child’s teacher to resolve that situation.

We may collect and process your data for purposes not named in this Privacy Policy or without your consent, only if there is a specific and clear exception in the applicable law (e.g COPPA or GDPR). This happens, for example, in cases where we need to comply with a legal obligation, when it is necessary to protect the safety of a child, take precautions against liability, protect the security of our platform etc.

We delete student accounts that have been inactive for 24 months. When an account passes that point we mark it for deletion and delete it 30 days later, so a student who comes back within that window keeps their account. Deleting an account removes the profile together with the related game and progress records.
Teacher and parent accounts are kept for as long as the account exists. You can delete your account at any time from your profile, and we will usually delete all stored data if your account is deleted at your request or due to your breach of contract.
Individual game records are deleted two years after the game is played, activity logs after 60 days and home assignments after 90 days, including on accounts that remain in use.
Accounts with a payment history are treated differently. If you have been a subscriber of premium content and have entered into a monetary transaction with us, we will keep storing the data until we have a legal obligation to do so (for example an obligation to preserve accounting documents for seven years) or until it can be used to defend our legitimate interests (for example to use as evidence in case of a legal dispute between us).
Copies of deleted data may remain in our encrypted backups for up to 12 months before they are overwritten.

As laws change and our platform evolves, so does the Privacy Policy need amending from time to time. Minor changes will be reflected on this page, please see above for the time of last update. We will notify users about larger material changes to the Privacy Policy directly by email or through a user’s account. If you do not agree with the updates, you may terminate your account before the updates take force. Continuing to use 99math after our Privacy Policy has been changed means that you agree with those changes.

For accounts created directly by a parent, a teacher or a student at home, the controller of your personal data is 99math OÜ (Estonian Commercial Registry code 14682374). Where 99math is used through a school, the school or district is the controller and 99math OÜ is the processor acting on its instructions, as described in section 3.7. If you want further information about how we process your personal data or wish to exercise any of your rights above you may contact the 99math at the address below.

If you wish to make a formal complaint about the way 99math has processed your personal data, you may contact the data protection authorities of the country where you are resident at. Alternatively you can contact the Estonian Data Protection Inspectorate at 39 Tatari St., 10134 Tallinn, Estonia or through email at info@aki.ee.