Student Data Privacy for New York Schools

Education Law §2-d · Parents' Bill of Rights and supplemental information · Effective November 11, 2026

1. Who this page is for

New York State Education Law §2-d protects personally identifiable information (PII) from student records, and Part 121 of the Regulations of the Commissioner of Education explains how schools and their vendors must protect it. Every New York school district, BOCES and charter school publishes its own Parents' Bill of Rights for Data Privacy and Security and attaches it, with supplemental information about the vendor, to each contract with a company that receives student data.

This page gives New York parents, students, teachers and schools that information for Quollyo in one place. Section 2 summarizes the rights the law gives you. Section 3 is Quollyo's supplemental information. Section 4 lists the commitments Quollyo makes to every New York school it contracts with. Your school's own Parents' Bill of Rights and its contract with Quollyo are the official versions. If anything here differs from them, they control.

Quollyo's Privacy Policy covers everyone who uses Quollyo, including students who sign up on their own.

2. Parents' Bill of Rights for Data Privacy and Security (summary)

Under Education Law §2-d, parents (including legal guardians and persons in parental relation) and eligible students (students 18 and older) can expect that:

1. A student's personally identifiable information can't be sold or released for any commercial or marketing purpose.
2. Parents have the right to inspect and review the complete contents of their child's education record kept by the school.
3. State and federal laws, including Education Law §2-d and the Family Educational Rights and Privacy Act (FERPA), protect the confidentiality of student PII, and safeguards in line with industry standards and best practices, such as encryption, firewalls and password protection, must be in place when it is stored or transferred.
4. A complete list of the student data elements collected by New York State is available for public review at nysed.gov/data-privacy-security/student-data-inventory, or by writing to the New York State Education Department, 89 Washington Avenue, Albany, NY 12234.
5. Parents have the right to have complaints about possible breaches or unauthorized releases of student data addressed. Complaints may be made to your school first, and to the New York State Education Department's Chief Privacy Officer:
   • Online: nysed.gov/data-privacy-security/report-improper-disclosure
   • Email: privacy@nysed.gov
   • Mail: Chief Privacy Officer, New York State Education Department, 89 Washington Avenue, Albany, NY 12234
6. Parents and eligible students have the right to be notified, in line with applicable laws and regulations, if a breach or unauthorized release of their student data occurs.

This is a plain-English summary. Read your school's full Parents' Bill of Rights on its website, or the State's version at nysed.gov/data-privacy-security.

3. Supplemental information about Quollyo

This is the information Part 121.3(c) requires for each contract a New York educational agency enters with a vendor that receives student data. It describes Quollyo as it works today. A school's contract with Quollyo may add details specific to that school.

What student data Quollyo receives

Quollyo does not receive grades, class announcements, class materials, classmates' names or classmates' work, and it can never turn in, change or delete anything in Google Classroom. Quollyo does not receive teacher or principal APPR data.

1. Exclusive purposes for which the data will be used

Quollyo uses student data only to provide the Quollyo services the school contracts for: showing each student what's due, planning study time, spotting upcoming tests, and, when the student asks, making flashcards, practice questions and hint-first study help. Quollyo does not use student data from a school contract for any other purpose, and it does not use it to develop, improve or market products or services.

2. How subcontractors will protect the data

Quollyo uses these service providers to run its services:

• Netlify hosts the Quollyo website and app and runs Quollyo's server functions. The functions process requests and keep no student data after they answer.
• Anthropic (the Claude API) generates AI study help, only for material a student chooses to study. Under Anthropic's commercial terms, data sent through its API is not used to train its models.
• Google provides sign-in and is the source of the Classroom data, under the school's own agreement with Google.

Quollyo gives each provider only the data it needs for its part of the service, holds each one to written terms that limit its use of the data, and requires any provider that receives student data under a school contract to follow the same data protection and security requirements Quollyo follows, including Education Law §2-d and Part 121. Quollyo will list any new provider here before it receives student data.

3. Contract term, and what happens to the data when it ends

Each contract's start date, length and expiration date are set out in that contract. When a contract ends or expires, Quollyo will delete any student data it holds under that contract within 30 days, unless the school asks for it to be returned or transferred first, and will confirm the deletion to the school in writing. Because study data is kept on students' own devices, students can also erase it at any time by signing out of Quollyo, and Quollyo's access to their Google Classroom ends when they sign out or when the school removes Quollyo's access.

4. How to challenge the accuracy of the data

Quollyo shows Google Classroom data exactly as Google provides it, so most corrections are made in Google Classroom by the teacher or school. A parent, student, eligible student, teacher or principal who believes data is inaccurate can follow the school's procedure for amending education records, or email hello@quollyo.com. Quollyo will respond within 30 days and will work with the school to correct any data Quollyo holds.

5. Where the data is stored, and how it's protected

Study data is stored in the browser on the student's own device and is protected by that device's sign-in and security settings. Quollyo does not keep a database of student data on its servers. Data that passes through Quollyo's server functions is processed in memory on Netlify's infrastructure and is not saved. Quollyo limits access to its systems to the people who need it to provide the service, protects its provider accounts with strong sign-in security, and keeps its server code and secrets out of public view.

6. Encryption

All data moving between the student's device, Quollyo, Google and Quollyo's providers is encrypted in transit with HTTPS (TLS). Quollyo does not store student data at rest on its servers. Where any provider stores data on Quollyo's behalf, it is encrypted at rest by that provider.

4. Quollyo's commitments to New York schools

For every New York educational agency it contracts with, Quollyo will:

• Follow Education Law §2-d, Part 121, FERPA and the school's own data security and privacy policy.
• Align its security practices with the NIST Cybersecurity Framework, as Part 121 requires.
• Use student data only for the purposes in the contract, and limit access to people who need it to provide the service.
• Not sell student data, use or disclose it for any commercial or marketing purpose, or let anyone else do so.
• Not disclose student data to anyone else without the prior written consent of the parent or eligible student, except to its service providers acting under the contract, or when required by law or court order, in which case Quollyo will notify the school no later than the time of disclosure unless the law or order forbids it.
• Train anyone at Quollyo who has access to student data on federal and state student privacy laws before they get access.
• Notify the school of any breach or unauthorized release of student data in the most expedient way possible and without unreasonable delay, and no later than 7 calendar days after discovering it, cooperate with the school's and the State's investigation, and pay for any notifications the law requires when Quollyo caused the breach.
• Provide the school with Quollyo's data security and privacy plan and sign the school's data privacy agreement where appropriate.

5. Contact

IT admins: see how to approve Quollyo in Google Workspace for Education.

Questions about student data privacy, or a school ready to contract: email hello@quollyo.com or write to Quollyo, 375 West Main St., #536, Huntington, NY 11743.