Built for district review, not a claim of legal approval.
These materials describe WYG's intended pilot commitments and current product controls. WYG and the school should have an education/privacy attorney finalize the agreement, addendum, liability allocation, corporate details, and district-specific requirements before student data is transferred.
SOPPA
Educational purpose only, no targeted advertising or unrelated profiling, written data terms, secure service providers, deletion support, and school breach notice.
Read 105 ILCS 85 ↗FERPA
The draft addendum places WYG under the school's direct control for authorized educational use and limits use and redisclosure of education records.
Read Department guidance ↗COPPA
School authorization is limited to school-benefit educational use. WYG—not the school—is responsible for any COPPA duties that apply to WYG.
Read FTC school guidance ↗Pilot commitments
The school stays in control.
Educational use only
Student data is processed only to deliver the school-authorized WYG instruction and testing service.
No ads or student sales
No targeted advertising, sale, rental, or unrelated commercial profile built from student data.
Minimum necessary data
Athlete email is optional; a display name or roster identifier and team-scoped access can be sufficient.
Restricted disclosure
Access is role- and program-scoped; service providers receive only what is necessary to operate WYG.
School-directed rights
Authorized schools can export records, request correction, stop collection, deactivate accounts, and request deletion.
Incident accountability
WYG preserves evidence, communicates with the school, records decisions, and follows the signed notification timeline.
School review packet
Ten documents, ready for counsel.
Pilot agreement
Commercial and operational terms for a limited school pilot.
Download Markdown ↓Student-data privacy addendum
SOPPA-focused data terms, FERPA direct control, and COPPA school-use boundaries.
Download Markdown ↓Privacy policy
Public notice of collection, use, disclosure, student rights, and prohibited uses.
Download Markdown ↓Terms of service
Account, acceptable-use, ownership, service, and termination terms.
Download Markdown ↓Security summary
Current controls, responsibility boundaries, and pre-pilot verification gates.
Download Markdown ↓Subprocessor list
Current infrastructure providers and their narrow service purpose.
Download Markdown ↓Data-retention schedule
Proposed record-by-record retention and deletion triggers.
Download Markdown ↓Export and deletion procedure
Authorized request, verification, delivery, deletion, and certification steps.
Download Markdown ↓Breach-notification procedure
Detection, containment, school notice, updates, and post-incident steps.
Download Markdown ↓School contact and support
Named contacts, severity levels, response targets, and escalation path.
Download Markdown ↓Plain-language data map
What WYG handles and why.
Operational reliability
Built controls and activation evidence.
Operational reliability runbook
Control ownership, daily and weekly checks, pilot service objectives, evidence, and activation gates.
Download Markdown ↓Backup and recovery procedure
D1 Time Travel, daily restore-point verification, isolated recovery drill, and two-person production restore.
Download Markdown ↓Monitoring and alerting runbook
Health probes, structured errors, required alerts, privacy-safe logging, and alert activation test.
Download Markdown ↓Production access standard
Individual accounts, MFA, least privilege, protected secrets, approvals, and quarterly review.
Download Markdown ↓Incident response procedure
Severity, command, containment, evidence, notice, recovery, root cause, and tabletop exercise.
Download Markdown ↓NIST SSDF baseline
Pilot mapping across Prepare, Protect, Produce, and Respond outcomes without claiming certification.
Download Markdown ↓Baseline: NIST Secure Software Development Framework 1.1 ↗. WYG uses it as a risk-based improvement structure, not a certification claim.
Current technical service providers
Small provider chain.
The pilot build does not use advertising networks, third-party analytics, payment processors, or an external athlete-email provider. Final legal entity names, locations, and contractual terms must be confirmed before signing.
Before Shanban High School student use
Five approvals close the loop.
- WYG legal entity, address, insurance, pricing, governing law, and liability terms completed.
- Education/privacy counsel approves the pilot agreement, student-data addendum, and public notices.
- Shanban High School's authorized administrator signs; the school posts the SOPPA agreement and operator information as required.
- WYG activates external uptime/error alerts, confirms D1 and R2 recovery, sets the operations secret, names incident contacts, and passes a timed recovery test and tabletop.
- The school approves the roster fields, student/parent notice path, pilot users, test window, and success measures.