Data Security and Privacy Plan

Ver­sion 1.0 · 15 Octo­ber 2026

Scope and purpose

This plan sets out how Leg­en­tibus AB pro­tects the per­son­al data of stu­dents and teach­ers that it process­es for schools and school dis­tricts, in the Unit­ed States and in Europe. It forms part of the data pro­tec­tion agree­ment Leg­en­tibus signs with each school. It is the Data Secu­ri­ty and Pri­va­cy Plan required by New York Edu­ca­tion Law § 2‑d and 8 NYCRR Part 121, and the descrip­tion of secu­ri­ty mea­sures for agree­ments under the EU Gen­er­al Data Pro­tec­tion Reg­u­la­tion (GDPR).

Leg­en­tibus AB (org. no. 559432–8337, Nac­ka Strand, Swe­den) makes Leg­en­tibus, an app for learn­ing Latin, among oth­er things by read­ing and lis­ten­ing to Latin texts, with tools such as synced audio, dic­tio­nar­ies, trans­la­tions and cours­es. Teach­ers can cre­ate class­es and stu­dent accounts, set read­ing assign­ments and fol­low their stu­dents’ progress.

Data collected and how it is used

Leg­en­tibus col­lects only the data need­ed to run the ser­vice, and uses it only to pro­vide the ser­vice to the school, as set out in the school’s agree­ment with Leg­en­tibus.

Who	Data
Stu­dents	Name; email address (used as user­name); pass­word, stored hashed; school and class mem­ber­ship; read­ing progress, read­ing and lis­ten­ing time, and assign­ment progress; word lookups and search queries; option­al error reports on texts; app set­tings; diag­nos­tic mes­sages sent by the app; device data (device ID, device type and set­tings, app ver­sion, time zone, IP address, and coun­try derived from it)
Teach­ers	Name; email address (used as user­name); pass­word, stored hashed; school; the class­es and assign­ments the teacher cre­ates; for teach­ers who also read in the app, the same app and device data as stu­dents

Leg­en­tibus does not col­lect dates of birth, gen­der, eth­nic­i­ty, address­es, phone num­bers, grades, test scores, dis­abil­i­ty or health infor­ma­tion, or teacher or prin­ci­pal eval­u­a­tion data (APPR data). Teach­ers can cre­ate stu­dent accounts with­out an email address; the stu­dent then gets a gen­er­at­ed user­name that does not iden­ti­fy them.

Leg­en­tibus nev­er sells stu­dent or teacher data, nev­er uses it for tar­get­ed adver­tis­ing, and nev­er builds pro­files of stu­dents except for the edu­ca­tion­al pur­pose of the ser­vice. Stu­dents nev­er receive mar­ket­ing email, and stu­dent and teacher accounts are exclud­ed from all adver­tis­ing mea­sure­ment. Leg­en­tibus may email teach­ers and school con­tacts about the ser­vice, such as new fea­tures and offers for the school; they can opt out of these emails at any time. For schools in Europe, offers go only to the school’s con­tact per­son and to teach­ers who have asked for them.

Legal framework

The school decides what data is processed and why; Leg­en­tibus process­es it only on the school’s instruc­tions. Each school’s agree­ment and the laws below set the rules, and this plan describes how Leg­en­tibus meets them.

	Unit­ed States	Euro­pean Union
Main laws	FERPA, COPPA, New York Edu­ca­tion Law § 2‑d and 8 NYCRR Part 121, and the state laws named in the school’s DPA	GDPR, and nation­al edu­ca­tion rules such as the Dutch Pri­va­cy Covenant for Dig­i­tal Edu­ca­tion­al Resources
Role of Leg­en­tibus	Treat­ed as a “school offi­cial” under FERPA (34 CFR § 99.31), sole­ly for access to stu­dent records; third-par­ty con­trac­tor (New York)	Proces­sor act­ing for the school, which is the con­troller (GDPR Arti­cle 28)
Agree­ment	Stu­dent Data Pri­va­cy Con­sor­tium Nation­al DPA, with state exhibits	The school’s data pro­cess­ing agree­ment, for exam­ple the Dutch Mod­el Data Pro­cess­ing Agree­ment 4.0
Par­ents’ and stu­dents’ rights	Through the school; the school’s Par­ents Bill of Rights for Data Pri­va­cy and Secu­ri­ty is part of this plan	Access, cor­rec­tion and dele­tion through the school; Leg­en­tibus helps the school answer requests
Where data is stored	In the Unit­ed States (AWS)	In the Unit­ed States, under the EU stan­dard con­trac­tu­al claus­es in the AWS Data Pro­cess­ing Adden­dum and the EU-US Data Pri­va­cy Frame­work

Leg­en­tibus helps the school answer a request from a par­ent, stu­dent or author­i­ty, and pass­es on any request it receives direct­ly to the school. Par­ents, stu­dents and teach­ers can chal­lenge the accu­ra­cy of their data through the school, and Leg­en­tibus makes any cor­rec­tion the school asks for.

Security safeguards

Leg­en­tibus aligns its secu­ri­ty prac­tices with the NIST Cyber­se­cu­ri­ty Frame­work v1.1. The table groups the mea­sures by the frame­work’s five func­tions; the same mea­sures answer the con­trols of the Dutch ROSA frame­work.

NIST CSF func­tion	Mea­sures
Iden­ti­fy	A writ­ten inven­to­ry of the per­son­al data held (see “Data col­lect­ed”) and of every sys­tem and sub­proces­sor that touch­es it.
Pro­tect	All data encrypt­ed at rest with AES-256 (AWS KMS): the data­base, serv­er disks, file stor­age and back­ups. All traf­fic encrypt­ed in tran­sit with TLS: between users and Cloud­flare, between Cloud­flare and the serv­er, and between the serv­er and the data­base. Pass­words stored only as bcrypt hash­es. The data­base sits in a pri­vate net­work with no pub­lic access. Per­son­al sign-ins with two-fac­tor authen­ti­ca­tion for every AWS user, and no shared accounts. Serv­er access through AWS Sys­tems Man­ag­er, with no SSH pass­words. Auto­mat­ic secu­ri­ty updates for the oper­at­ing sys­tem. Login attempts lim­it­ed to 10 per account per minute.
Detect	AWS Cloud­Trail records every admin­is­tra­tive action, kept for at least one year. Appli­ca­tion logs are kept for 14 days. Alarms on serv­er and data­base health and on unusu­al costs go to both staff mem­bers.
Respond	A doc­u­ment­ed inci­dent pro­ce­dure (see “Inci­dents and data breach­es”) with notice to affect­ed schools with­in 72 hours.
Recov­er	Auto­mat­ic dai­ly data­base back­ups with point-in-time restore, kept for at least 14 days, plus a copy in a sec­ond loca­tion. Restores are test­ed at least once a year and after any change to the back­up set­up, and each test is record­ed.

Staff access and training

Two peo­ple can access per­son­al data: Johan Winge (devel­op­er, and pri­va­cy and secu­ri­ty con­tact) and Daniel Pet­ter­son (CEO). Leg­en­tibus uses no con­trac­tors with access to per­son­al data. Staff work from Swe­den, in the EU.

• Access is giv­en only to staff who need it to run the ser­vice, and only to the extent they need it.
• Every­one with access signs a writ­ten con­fi­den­tial­i­ty under­tak­ing before get­ting access.
• Every­one with access com­pletes pri­va­cy and secu­ri­ty train­ing before get­ting access and every year after: GDPR, FERPA and New York Edu­ca­tion Law § 2‑d, and this plan.
• When some­one leaves, their access is removed the same day.

Subprocessors

Leg­en­tibus uses sev­en sub­proces­sors for school accounts. Each is bound by a writ­ten data pro­cess­ing agree­ment with oblig­a­tions at least as strict as Leg­en­tibus’s own.

Sub­proces­sor	Pur­pose	Per­son­al data	Loca­tion
Ama­zon Web Ser­vices	Host­ing, data­base, file stor­age, back­ups	All data list­ed in “Data col­lect­ed”	Unit­ed States
Cloud­flare	Net­work pro­tec­tion and encrypt­ed con­nec­tions	All traf­fic in tran­sit, includ­ing IP address­es	Glob­al net­work; Cloud­flare is a US com­pa­ny
Stripe	Invoic­ing and pay­ment for school licences	The school’s billing con­tact: name, email address, billing address. No stu­dent data	Ire­land and Unit­ed States
Mailchimp and Mailchimp Trans­ac­tion­al (Intu­it)	Send­ing account emails (login details for new accounts, pass­word resets) and emails to teach­ers about the ser­vice	Email address and name of the stu­dent or teacher; the gen­er­at­ed pass­word in login emails	Unit­ed States
ipinfo.io	Find­ing the coun­try from an IP address	IP address	Unit­ed States
Google	Option­al sign-in with Google	Name and email address	Unit­ed States
Click­Up	Track­ing error reports on texts	Error report text, with­out the user’s iden­ti­ty	Unit­ed States

School accounts are exclud­ed from adver­tis­ing mea­sure­ment (Meta), and stu­dents from mar­ket­ing email. App store pay­ments (Apple, Google Play) are used only for indi­vid­ual sub­scrip­tions, nev­er for school accounts.

Leg­en­tibus tells schools at least 30 days before a new sub­proces­sor starts han­dling their per­son­al data, or longer where the school’s agree­ment requires it (six weeks under the Dutch Mod­el Data Pro­cess­ing Agree­ment), so a school can object. This cov­ers only ser­vices that receive per­son­al data of school users, not the tools used to build the app. When a change is urgent for secu­ri­ty or to keep the ser­vice run­ning, Leg­en­tibus may make it soon­er and tells schools at once.

Incidents and data breaches

Leg­en­tibus noti­fies every affect­ed school with­out undue delay, and at the lat­est with­in 72 hours of con­firm­ing a breach of per­son­al data.

1. Detect and con­tain: who­ev­er notices a pos­si­ble inci­dent tells the pri­va­cy and secu­ri­ty con­tact at once. Access is cut off and evi­dence kept.
2. Assess: what hap­pened, when, which data and which schools are affect­ed, and how many peo­ple.
3. Noti­fy: the school’s named con­tact gets a writ­ten notice by email con­tain­ing the date and nature of the breach, the cat­e­gories and approx­i­mate num­ber of peo­ple and records involved, the like­ly con­se­quences, the mea­sures tak­en, and a con­tact per­son. Infor­ma­tion not yet known fol­lows as it becomes avail­able.
4. Coop­er­ate: Leg­en­tibus helps the school inform par­ents, stu­dents, staff and author­i­ties. It does not con­tact them itself unless the school asks or the law requires it.
5. Learn: every inci­dent, includ­ing sus­pect­ed ones, is logged with its cause and the fix, and this plan is updat­ed where need­ed.

Return and deletion of data

When a school’s agree­ment ends, Leg­en­tibus asks the school by email whether it wants its data returned, kept for a peri­od it sets in writ­ing, or delet­ed. Unless the school asks to keep it, Leg­en­tibus deletes the data 90 days after that email. A school can also ask for dele­tion at any time; Leg­en­tibus then deletes the data with­in 90 days.

• Return first, if asked: before dele­tion the school can ask for an export of its stu­dents’ and teach­ers’ data, deliv­ered as CSV files.
• What is delet­ed: the accounts of the school’s stu­dents and teach­ers, with every­thing linked to them: read­ing progress, usage data, lookups, error reports, device data, class­es and assign­ments.
• Back­ups: delet­ed data dis­ap­pears from the rolling back­ups as they expire, with­in 35 days at most. Back­ups are encrypt­ed and nev­er restored except to recov­er the ser­vice.
• Con­fir­ma­tion: Leg­en­tibus con­firms the dele­tion to the school in writ­ing.
• Reten­tion with­out a request: data is kept only while the school uses the ser­vice, and after that only as described above. A stu­dent who leaves the school is delet­ed on the school’s request.

Stor­age media at AWS are destroyed using meth­ods con­sis­tent with NIST SP 800–88, as set out in AWS’s own secu­ri­ty doc­u­men­ta­tion.

Contact and review

Ques­tions about pri­va­cy or secu­ri­ty, requests, and inci­dent reports go to Johan Winge, pri­va­cy and secu­ri­ty con­tact, at [email protected].

Leg­en­tibus AB, Cylin­dervä­gen 18, 131 52 Nac­ka Strand, Swe­den. Org. no. 559432–8337.

This plan is ver­sion 1.0. It is reviewed at least once a year and after any sig­nif­i­cant change to the ser­vice, its host­ing or its sub­proces­sors.