Parents' Bill of Rights — Supplemental Information
Exhibit B to the NY §2-d Addendum — the supplemental information NY Education Law §2-d and 8 NYCRR §121.3(c) require from AskElira as a third-party contractor, published here as a convenience copy for your school to append to its own Parents’ Bill of Rights for Data Privacy and Security.
What it is
Ed Law §2-d requires every school to publish a Parents’ Bill of Rights and, for each vendor contract, supplemental information about how that vendor handles student data. This document is AskElira’s supplemental information as one standalone, always-public page and PDF — no need to extract it from the contract exhibits. Part I restates the statutory Bill of Rights for families; Part II answers the six questions 8 NYCRR §121.3 requires.
Exclusive purposes
Protected Data is used only to run your enrollment and attendance outreach: family email/SMS sequences, weekday enrollment voice calls in defined windows, same-day attendance notices, IEP-director notification, the daily digest, tracker auto-fill, reconciling your tracker against your student information system so we can tell you where the two disagree, the family Q&A assistant, the automated send-or-hold review of staff enrollment notes, and — where your uploads carry present-day records — the attendance measures shown to your own staff in your own dashboard: each student's attendance rate against the days they were enrolled, the chronic-absence determination that follows under the New York definition, and an early warning where a student is projected to cross that line, each shown with the numerator, denominator and threshold behind it. Those measures never contact a family on their own; every action they suggest is a recommendation for your staff. Where your uploads carry absences only, we report absence counts and decline to state a rate rather than assume a denominator we were not given. No sale, no marketing, no AI training on your data.
Subcontractors
Every subcontractor with access to Protected Data is named (Twilio, Meta Platforms, Turso, Vercel, Google, AgentMail, Resend, SchoolMint), each bound in writing to data-protection terms covering confidentiality, security, breach notification, and deletion on our instruction, with 30 days’ notice before any change. Any subcontractor that runs an AI model for us is marked in that schedule as an AI model provider. Two are named: Google Cloud (Vertex AI), which carries every model request at present, and Amazon Web Services (Amazon Bedrock), named and authorized as a second source so that a change between them is something disclosed to you in advance rather than after the fact. Adding or replacing either takes not less than 30 days’ written notice to your school and the chance to object. Meta appears because the family Q&A assistant can also be reached on WhatsApp where your school enables it, and Meta operates that network. This supplement keeps naming every subcontractor — a parent asking who handles their child’s information deserves the list, not a link — and the same list is published at /legal/subprocessors, which is the schedule the DPA incorporates, so the two cannot drift apart.
Contract end = delete or return
Term and expiration live in each school’s Order Form. On expiration or termination, all Protected Data is securely destroyed within 30 days (subcontractors within 90), or transitioned to your successor vendor at your direction — with written certification. Inactive family data also auto-deletes after 90 days during the subscription.
Challenging accuracy
Parents challenge data accuracy through the school’s FERPA amendment procedures; AskElira corrects or flags disputed data within 3 business days of a verified request from the school.
Where data lives & encryption
Our own systems are configured to United States regions (Turso database, Vercel hosting, Twilio and Amazon SES delivery), with no store, backup, or personnel access path of ours outside the country — but, as Exhibit B (5) says plainly, we do not warrant that no Protected Data ever leaves the United States, because three of our providers do not warrant it to us: Vercel may process and replicate backups globally, Twilio does not guarantee a datum stays in a chosen region, and Meta makes no United States commitment at all for WhatsApp traffic. No AI model provider is one of those three: model inference runs at a US Processing Endpoint, and both the region and the provider are recorded in the §5.3(a) schedule — which is true of the provider in force today and of any the schedule adds, because a provider that cannot offer a US Processing Endpoint cannot be added at any notice period. Everything is encrypted in transit (TLS 1.2+) and at rest (AES-256, plus envelope-encrypted school credentials), under NIST CSF-aligned safeguards with 24/7 monitoring and the 48-hour breach-notice standard.