Bizi Inc. provides a schoolwide student recognition platform that helps schools reinforce positive behaviors, attendance, and academic effort by integrating with existing school systems and PBIS frameworks. We are committed to protecting the privacy and security of all platform users — and in particular the students, aged 5 through 18, who engage with our platform every day.
This Privacy Policy describes what personal information Bizi collects, how we use and protect it, with whom we share it, and what rights parents, guardians, and schools have regarding student data. This Policy applies to all users of the Bizi platform, including students, teachers, staff, administrators, and parents or guardians, whether accessing Bizi through the web application at https://app.bizimotivates.com, any related subdomains, or the Bizi mobile application.
By accessing or using the Bizi platform, you acknowledge that you have read and understood this Privacy Policy. Schools and Local Education Agencies (LEAs) that have entered into a Data Privacy Agreement (DPA) with Bizi should refer to that agreement, which governs the treatment of student data and takes precedence over this Privacy Policy where the two address the same subject matter.
Bizi reserves the right to update this Privacy Policy in accordance with the notice provisions described in Section 7.
1. Information We Collect
a. Student Account Information
Student accounts on the Bizi platform are created exclusively by schools and LEAs — students do not self-register. Account data is generated from information provided to Bizi by the school or district through their Student Information System (SIS) via secure file transfer (SFTP). Bizi does not collect personal information directly from students for the purpose of account creation.
The student account information Bizi receives and stores from the LEA's SIS may include: student name, local district ID number, state ID number, grade level, school enrollment, homeroom or class assignment, and teacher name. Bizi collects only the information necessary to create and maintain the student's platform account and to deliver the educational services described in this Privacy Policy. We do not request or store unnecessary personal information from or about students, and we do not display student personal information publicly.
Teacher, staff, and administrator accounts are similarly created through school or district-initiated processes using information provided by the LEA.
b. Education Records Received via SIS
Bizi receives student education records from LEAs via secure SFTP transfer through the LEA's SIS integration (Clever or ClassLink). These records include attendance data, behavioral data, and academic performance data. This information is used exclusively to automate the award of BiziBucks reinforcement points to students' Bizi accounts and to support rostering and reporting functions within the platform and to support schools in sustaining their positive reinforcement strategies.
Bizi does not write back to or modify the LEA's SIS. Reinforcement points are calculated and applied within the Bizi platform based on SIS data and are not recorded in the LEA's own student records.
The transmission of student education records to Bizi and the activation of student accounts on the Platform are contingent upon the LEA and Bizi having executed a Data Privacy Agreement (DPA), or the LEA having executed Bizi's Data Handling Acknowledgment as an interim measure while a full DPA is being finalized. Bizi does not make student accounts active on the Platform for any school or district that has not executed either a DPA or a Data Handling Acknowledgment. Any student data received by Bizi prior to full DPA execution is handled in accordance with the Data Handling Acknowledgment and is subject to the same data protection standards described in this Privacy Policy.
Education records received from the LEA are retained only for as long as necessary to provide the services described in this Privacy Policy, in accordance with the data retention schedule in Section 6 and the terms of the applicable DPA.
c. In-App Survey Responses
Bizi may invite students, teachers, and administrators to participate in voluntary in-app surveys to gather feedback on platform features, user experience, and service satisfaction. Survey participation is entirely voluntary and has no effect on a student's BiziBucks balance, behavioral record, or standing within the platform. Survey responses are used solely to improve the Bizi platform and the educational services we provide. Where survey responses can be attributed to an individual user account, they are treated as Student Data and subject to all protections in this Privacy Policy and Bizi's DPAs with LEAs.
d. Usage Data
Bizi collects non-personal usage data about how users interact with the platform, including progress metrics, feature engagement, and platform performance data. This information is used to improve our services and to generate reports for teachers and administrators on student and class progress within the platform. Where usage data is associated with an individual user account, it is treated as Student Data consistent with this Privacy Policy. Usage data associated with individual accounts is not used to build behavioral profiles for commercial purposes.
e. Cookies and Tracking Technologies
Bizi uses cookies and similar technologies — including pixel tags and web beacons — to support platform functionality and to understand how users navigate our platform. The information collected through these technologies may include IP addresses, browser type and language, internet service provider, referring and exit pages, operating system, date and time of access, and clickstream data.
Bizi treats information collected through cookies and tracking technologies as non-personal information unless it is combined with personally identifiable information, or unless applicable law in the user's jurisdiction treats it as personal information — in which case Bizi treats it accordingly.
Cookies and tracking technologies are used for the following purposes only: platform administration and security, analyzing usage trends to improve the platform, and generating aggregate demographic information about our user base. Bizi does not use cookies or tracking technologies to serve targeted advertising to any user, including students.
Bizi does not use Google Analytics or any third-party behavioral tracking, advertising tracking, or cross-site tracking technologies on any student-facing page or interface of the Platform, including the web application, administrative interfaces, and mobile application. Any analytics tools Bizi uses are first-party or configured in a privacy-protective manner with advertising features disabled, data sharing with the provider disabled, and IP anonymization enabled. No third-party tracking technology is used on student-facing pages for any purpose other than operational security and platform functionality. A complete list of Bizi's technology providers is available in Section 4 of this Privacy Policy.
Users may disable cookies in their web browser settings. Disabling cookies may limit the availability of certain platform features and affect the user experience.
f. Mobile Application and Device Access
Bizi's Mobile App is available to educators on iOS and Android devices and is accessed using the same school-issued SSO credentials used to access the web platform. The Mobile App does not collect any personal information beyond what is collected through the web platform, as described in this Section. Bizi does not access device location, camera, contacts, or any other device-level data through the Mobile App.
Student access to the Platform is browser-based only. Students do not download or install any Bizi application. SSO for student browser access is managed entirely through Clever or ClassLink — Bizi does not collect, store, or process student login credentials directly. Student rostering and account provisioning are handled separately via secure SFTP transfer from the LEA's Student Information System, as described in Section 1(b).
2. Compliance with COPPA and FERPA:
a. COPPA (Children's Online Privacy Protection Act):
Bizi operates under the COPPA school operator exception (16 C.F.R. § 312.5(b)(1)), which permits schools and Local Education Agencies (LEAs) to provide consent on behalf of parents for the collection of student personal information used solely for educational purposes. We do not collect personal information from students under the age of 13 except through this school-directed model. Prior to activating any student account, Bizi requires the LEA to confirm, as a condition of the Data Privacy Agreement and account activation, that it has obtained any parental authorizations required by applicable law for each student whose account is activated on the Platform. Bizi's acceptance of this confirmation constitutes good faith reliance on the LEA's representation in accordance with 16 C.F.R. § 312.5(b)(1). As part of the onboarding process for schools serving students under 13, Bizi may request written documentation describing the LEA's parental notification process and Bizi reserves the right to delay or suspend student account activation for any LEA that cannot confirm compliance. Bizi does not independently verify parental consent with individual parents or guardians, and parents or guardians who wish to review, correct, or request deletion of their child's personal information should contact their school or district, which will coordinate the request with Bizi on their behalf.
b. FERPA (Family Educational Rights and Privacy Act):
We comply with the Family Educational Rights and Privacy Act (FERPA) and protect the privacy and confidentiality of student education records. Bizi operates as a “school official” with a legitimate educational interest, as defined by FERPA, and processes student data solely to provide and improve the services outlined in our agreements with schools and districts.
Access to student data is limited to authorized personnel and is governed by strict data security and confidentiality protocols. We do not sell student information or share it for any purpose other than those authorized under our DPAs and described in this Privacy Policy.
Schools and districts (LEAs) retain control of student data and are responsible for responding to parent and guardian requests regarding access, correction, or deletion of education records. Parents and guardians should direct such requests to their school or district, which will coordinate with Bizi to fulfill them in accordance with applicable law.
c. State Student Privacy Laws
In addition to FERPA and COPPA, Bizi complies with applicable state student privacy laws in every jurisdiction where it operates. Bizi's data practices are designed to meet or exceed the requirements of applicable state law. As Bizi expands into additional states, state-specific compliance commitments are incorporated into the applicable Data Privacy Agreement with each LEA.
Regardless of the state in which an LEA is located, Bizi does not:
Bizi collects no more covered information than is reasonably necessary to operate the Platform. Where state law requires deletion of student information upon a student's unenrollment or at the conclusion of a course or program, Bizi will comply with the applicable statutory timeline. Current state-specific commitments are reflected in the table below and are updated as Bizi enters new markets.
3. How We Use Information
a. Providing Educational Services
Bizi uses student personal information solely to provide the educational services described in our agreements with LEAs. Specifically, student data is used to:
Student personal information is never used to build profiles of students for commercial purposes, to target advertising, or for any purpose unrelated to delivering the above educational services to the LEA.
b. Platform Improvement, Data Analysis, and In-App Surveys
Bizi may conduct internal analysis of platform usage patterns — including behavioral trends, attendance correlations, and reward redemption patterns — solely for the purpose of improving the educational services provided to LEAs and demonstrating program impact to school stakeholders. Such analysis is not conducted for any commercial purpose unrelated to the delivery of educational services. All such analysis is conducted using aggregate or properly de-identified data only. Where individual-level pattern analysis is required, Bizi follows a documented internal protocol requiring removal of all direct and indirect student identifiers — including student ID numbers — before analysis begins. Bizi does not use student personal information to train, fine-tune, or otherwise inform any artificial intelligence or machine learning model. Any internal use of AI tools for data analysis is conducted exclusively on aggregate or properly de-identified data, as described in this Section, and is subject to Bizi's internal data handling protocols.
Bizi may also invite students, teachers, and administrators to participate in voluntary in-app surveys to gather feedback on platform features, user experience, and service satisfaction. Survey responses are used solely to improve the Platform and the educational services Bizi provides. Survey participation is voluntary and has no bearing on a student's BiziBucks balance, behavioral record, or standing within the Platform. Survey responses that can be attributed to an individual user are treated as Student Data and subject to all applicable protections in this Privacy Policy and Bizi's Data Privacy Agreements with LEAs. Survey response data is disclosed as a collected data element in Bizi's Schedule of Data (DPA Exhibit B).
c. Communication
Bizi uses contact information provided by LEAs to communicate with teachers, administrators, and parents or guardians regarding the following:
Teacher and Administrator Pay Period Recap Emails. Teachers and administrators are automatically enrolled to receive periodic Pay Period Recap emails upon account creation. These emails are delivered at the end of each school's PBIS pay period and contain aggregate, class-level or school-level summary data only — including grade-level averages, total bonuses issued, total flags recorded, and total store purchases for the relevant period. Teacher and administrator recap emails do not contain individually identifiable student data. Teachers and administrators may unsubscribe from recap emails at any time using the unsubscribe link included in every email. Unsubscribing from recap emails does not affect platform access or any other account functionality.
Parent Pay Period Recap Emails. Parents or guardians may opt in to receive periodic Pay Period Recap emails summarizing their individual child's activity within the Bizi platform for the relevant pay period, including bonuses received, flags recorded, attendance rate, and store purchases. This communication is parent-initiated and requires registration using an email address that is verified against the primary guardian email on file in the LEA's Student Information System (SIS). Bizi uses this SIS-based verification to confirm the identity of the requesting parent or guardian before activating recap communications. Parents may opt out at any time using the unsubscribe link included in every recap email. Recap emails to parents are consistent with the LEA's disclosure of student information to parents under FERPA and are not initiated by Bizi without a verified opt-in request.
Email Delivery. All recap emails and platform communications described in this section are delivered through Bizi's third-party email service provider. This provider acts as a data processor under Bizi's direction and is subject to a written data processing agreement. Teacher and administrator recap emails contain aggregate data only and do not constitute a disclosure of individual student education records. Parent recap emails contain individual student activity data and are governed by the verification and consent framework described above and in Bizi's Parent Pay Period Recap Email Procedure. The email service provider used for these communications is listed in the subprocessor table in Section 4 of this Privacy Policy.
Bizi does not use teacher, administrator, student, or parent contact information for marketing, promotional, or commercial communications unrelated to the educational services provided to the LEA.
4. Information Sharing
a. Third-Party Service Providers
Bizi does not sell, rent, or otherwise disclose student personal information to third parties for any commercial purpose, including advertising or marketing. Student data is shared with third-party service providers only to the extent necessary for those providers to perform specific operational functions on Bizi's behalf — such as database management, application hosting, error monitoring, and security services. This sharing is permitted under FERPA's school official exception, as these providers operate under Bizi's direction and are contractually prohibited from using student data for any purpose beyond the specific service they provide to Bizi.
All third-party service providers with access to student personal information are required to:
Bizi currently uses the following third-party service providers. Student personal information is accessible to these providers only where operationally required and only to the minimum extent necessary:
Provider | Purpose | Student Data Accessible
Bizi will update this subprocessor list when providers are added or removed. Prior to engaging any new subprocessor who will have access to student personal information, Bizi will provide written notice to affected LEAs no fewer than thirty (30) days in advance. Notice will include the name and function of the new subprocessor and the categories of student data to which it will have access. If an LEA objects to a new subprocessor within the thirty (30) day notice period, Bizi will work in good faith with the LEA to address the concern, which may include identifying an alternative subprocessor or, if no resolution is possible, allowing the LEA to terminate its agreement without penalty. Emergency replacements required to maintain service security or continuity will be notified as soon as practicable, with a minimum of forty-eight (48) hours notice where feasible.
b. Data Aggregation
Bizi may periodically generate aggregated, de-identified reports to analyze platform usage, measure outcomes, and demonstrate program impact. Any data used for these purposes is de-identified in accordance with applicable standards — meaning all direct and indirect identifiers have been removed such that the information cannot reasonably be used to identify any individual student, family, or group.
De-identified aggregated data may be used for the following purposes only. For the purposes of this Policy, data is considered de-identified and aggregated when all direct and indirect student identifiers have been removed and the data reflects a minimum of ten (10) individual students, such that no individual student can reasonably be identified from the reported information:
Bizi will not publish or share any aggregate data that names or identifies a specific school or district in a marketing context without first obtaining written approval from the LEA. Aggregated data used externally will reflect a minimum cohort size sufficient to prevent re-identification, and will never include behavioral, disciplinary, special education, or other sensitive student indicators.
Bizi does not use individual student data — including BiziBucks histories, behavioral records, or academic performance — for marketing, advertising, or any purpose unrelated to providing educational services to the LEA.
5. Security Measures
a. Security Program
Bizi maintains a comprehensive information security program designed to protect student personal information from unauthorized access, disclosure, acquisition, destruction, use, or modification. Our security program incorporates administrative, physical, and technical safeguards appropriate to the nature and sensitivity of the student data we process on behalf of LEAs. Bizi's security practices are aligned to a nationally recognized cybersecurity framework, as disclosed in our Data Privacy Agreements with LEAs.
b. Technical Safeguards
Bizi implements the following technical measures to protect student data:
c. Administrative Safeguards
Bizi maintains written internal security policies governing the handling of student personal information. All Bizi employees and contractors with access to student data are required to complete privacy and security training and to execute confidentiality agreements prior to receiving access. Access to student data is reviewed periodically and revoked immediately when no longer required.
d. Data Breach Notification
In the event that Bizi confirms a breach of student personal information, Bizi will notify the affected LEA(s) within 72 hours of confirmation of the breach, unless notification within that timeframe would disrupt an active law enforcement investigation, in which case notification will be made as soon as legally permissible. Breach notification will include, to the extent known at the time of notice: the nature and scope of the breach, the categories of student data involved, the estimated date or date range of the breach, and the steps Bizi is taking to contain and remediate the incident. The LEA is responsible for notifying affected students, parents, and guardians in accordance with applicable law.
Bizi maintains a written data breach response plan consistent with applicable federal and state law and industry standards. This plan is reviewed and updated annually and following any confirmed security incident.
e. Limitations and Shared Responsibility
While Bizi implements the safeguards described above, no system is immune from all security risks. Bizi cannot guarantee absolute security against all possible threats, including unforeseen technical vulnerabilities, sophisticated cyberattacks, or unauthorized actions by third parties outside Bizi's control. LEAs share responsibility for security through the safeguards they maintain on their own systems, including protecting login credentials, managing authorized user access, and notifying Bizi promptly — and in no event later than 72 hours — of any confirmed breach or suspected unauthorized access originating from the LEA's environment.
6. Data Retention and Deletion
a. Data Retention Period
Bizi retains student personal information only for as long as necessary to provide our educational services to the LEA. We apply the following retention periods by data type:
Data Type - Retention Period
Where applicable state law requires a shorter retention period than those listed above, the shorter period applies. Bizi will never retain student personal information longer than permitted by applicable federal or state law, including but not limited to FERPA, COPPA, and applicable state student privacy statutes.
b. Data Deletion Upon Account Termination or Disenrollment
Upon termination of an LEA's contract, closure of a student account, or notification that a student is no longer enrolled, Bizi will delete or render irretrievable all associated student personal information within 60 days, unless the LEA provides specific written instructions for an alternative disposition. LEAs may submit data disposition instructions to Bizi at any time using the process outlined in our Data Privacy Agreement.
Where a student departs mid-year without the LEA terminating its contract, Bizi will delete that individual student's personal information within 60 days of receiving notice of disenrollment from the LEA.
c. Exceptions to Deletion
Bizi may retain certain data beyond the periods described above only where retention is required to:
Any data retained under these exceptions will be stored securely, access-restricted to authorized personnel only, and deleted as soon as the applicable legal obligation is satisfied.
d. Backup Data
Bizi maintains encrypted backup systems solely for operational continuity and disaster recovery purposes. Backups are not used as an independent data source and are not accessible for general operational use. Student personal information contained in backups is subject to the same retention and deletion schedules as primary data. When a deletion obligation is triggered, Bizi will purge the relevant data from both primary systems and backup archives within the timeframes stated above.
e. LEA-Directed Disposition
LEAs may at any time submit written instructions directing Bizi to delete, transfer, or otherwise dispose of student data ahead of the standard retention schedule. Bizi will fulfill such requests within 30 days of receipt. Instructions should be directed to support@bizimotivates.com or submitted through the process outlined in the applicable Data Privacy Agreement.
7. Changes to Privacy Policy
a. Material & Non Material Changes
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we do, we will distinguish between material and non-material changes.
For non-material changes (such as clarifications, formatting updates, or minor administrative edits), we will update the "Last Updated" date at the top of this Policy. We encourage you to review this Policy periodically at www.bizimotivates.com.
For material changes — meaning any change that affects how we collect, use, share, or retain student personal information — we will provide written notice to LEAs and school administrators no less than 30 days before the changes take effect. For changes affecting the personal information of students under 13, Bizi will not apply those changes to existing users until the LEA has had the opportunity to review the update and provide any re-authorization required under COPPA. If an LEA or parent objects to a material change, they should contact us at support@bizimotivates.com to discuss options, which may include data deletion prior to the change taking effect.
Continued use of the platform by an LEA following the effective date of any material change constitutes the LEA's acceptance of the updated Policy on behalf of its authorized users.
b. Change of Control
In the event of a merger, acquisition, consolidation, or sale of all or substantially all of Bizi's assets (a "Change of Control"), Bizi will provide written notice to all active LEAs no later than sixty (60) days prior to the closing date of such Change of Control, or as soon as legally permissible if earlier notice is prohibited. Bizi will obtain written assurance from any successor entity that it will assume all obligations under this Privacy Policy and all active Data Privacy Agreements with respect to student personal information. In the event of a Change of Control, LEAs retain the right to terminate their Data Privacy Agreement with Bizi if the LEA reasonably determines that the successor entity cannot uphold the terms herein or that continued engagement would violate the LEA's policies or applicable law. Upon termination under this provision, Bizi or its successor shall dispose of all Student Data in accordance with Section 6 of this Privacy Policy and the applicable DPA.
8. Contact Information
If you have any questions or concerns regarding this Privacy Policy, the data Bizi collects, or how student personal information is handled, please contact us at:
Bizi Inc. - Privacy and Data Inquiries
support@bizimotivates.com
www.bizimotivates.com
For privacy, compliance, and data security matters, you may also contact Bizi's Chief Operating Officer and Co-Founder directly:
Jack Gibson, COO & Co-Founder, Jack@bizimotivates.com
For parents and guardians: If you have questions about your child's personal information or wish to submit a data access, correction, or deletion request, please contact your child's school or district directly. The school will coordinate with Bizi on your behalf. This process is described in Section 3 of this Privacy Policy.
For LEAs and school administrators: Questions regarding Bizi's Data Privacy Agreements, subprocessor arrangements, data security practices, or FERPA and COPPA compliance should be directed to jack@bizimotivates.com or support@bizimotivates.com. Bizi will respond to LEA inquiries within five (5) business days.
For data security concerns or breach reports: If you believe you have identified a security vulnerability or potential data breach involving Bizi's platform, please notify us immediately at jack@bizimotivates.com. Security-related inquiries will be treated as high priority.
Made for schools who
show up for students.
Download Bizi
for Educators
