PracticeXP LLC's data security and privacy plan, in the format required by New York Education Law § 2-d and 8 NYCRR § 121.6, and referenced from our Data Privacy Agreements (including the Student Data Privacy Consortium NDPA, Exhibit K). For a plain-language explanation of how schools are kept separate, see Security; for what we collect and why, see the Privacy Policy.
Last updated October 20, 2026.
PracticeXP is practice-tracking software for school band, orchestra and choir programs. Students log practice sessions (date, minutes, optional practice note); directors review logs, set goals and send practice summaries. The data collected is limited to: student name, school-issued email, grade/class, ensemble, instrument or voice part, practice minutes and dates, optional practice notes, director feedback and goals, and an optional parent email supplied by the director. No dates of birth, addresses, health, financial, biometric or location data are collected, and students are never audio- or video-recorded (the tuner analyzes pitch on the device and stores nothing). PracticeXP LLC is a Wisconsin limited liability company with one employee, its owner.
Requirements are implemented as product controls, not policies alone: data minimization; server-verified roles and school tenancy; database security rules covered by an automated test suite that runs before every deployment; encryption in transit and at rest; a maintained subprocessor list with advance notice to the LEA before any change; access, correction, export and deletion requests honored within 30 days; and an annual review of this plan against our DPAs and applicable state law. Optional AI features are off unless the school turns them on.
The owner, a licensed K–12 music educator, completes his district's annual FERPA training and, annually, training on FERPA, COPPA, PPRA and New York Education Law § 2-d / 8 NYCRR Part 121 (NYSED and U.S. Department of Education Privacy Technical Assistance Center materials), with records available on request. Any future employee or contractor completes the same training before receiving access to PII.
PracticeXP LLC has no employees other than its owner, who signs each DPA. Subcontractors and the written terms that bind them:
| Subcontractor | Role | PII involved | Written terms |
|---|---|---|---|
| Google LLC — Google Cloud / Firebase | Hosting, authentication, database (United States) | All service data | Google Cloud Data Processing Addendum; Google's FERPA and COPPA commitments |
| Google LLC — Google Workspace (Gmail) | Delivery of email the service sends (director reports; parent summaries and student reminders if the school enables them) | Recipient address, first name, practice totals | Google Workspace terms and DPA |
| Google LLC — Gemini API | Optional AI features, only if the school enables them | Practice notes with names removed; none while disabled | Paid API terms: inputs not used to train models |
| Stripe, Inc. | Subscription billing | No student PII | Stripe services agreement |
Any future subcontractor with access to PII will be bound by a written agreement at least as protective as our DPAs before receiving access, and LEAs will be notified in advance.
On written request, or at expiration or termination, PracticeXP provides a complete export of the LEA's data (accounts, rosters, practice logs, goals and summaries) in CSV and/or JSON within 30 days at no cost, to the LEA or a successor at its written direction. Directors can also export their data from the application at any time.
Within 30 days of expiration, termination or written request (after any requested transfer), PracticeXP deletes the LEA's PII from its production database and authentication system. Backups are point-in-time snapshots that expire on a rolling 14-week cycle, after which no copy remains. PracticeXP then sends the LEA a written certification of deletion stating what was deleted and when, and confirming that no de-identified derivative is retained.
PracticeXP complies with each LEA's data security and privacy policy as incorporated in its DPA (in New York, the LEA's Part 121 policy and Parents' Bill of Rights), and provides its policies, and an independent assessment or equivalent, on request.
Narrative alignment with each NIST CSF category (Exhibit C.1). PracticeXP aligns with, but is not certified against, the framework.
| Function | Category | PracticeXP response |
|---|---|---|
| Identify | Asset Management (ID.AM) | Inventory maintained of every system (Firebase Authentication, Cloud Firestore, Cloud Functions, Firebase Hosting), every data element collected (Exhibit B of our DPAs) and every subprocessor. No company-owned servers; no PII on local devices or paper. |
| Identify | Business Environment (ID.BE) | Single purpose: practice tracking for school music programs. Student data exists only to provide that service to the school; it is never sold, used for advertising, or used to build profiles. |
| Identify | Governance (ID.GV) | Written privacy policy, security page, COPPA notice, retention/deletion policy and this plan, reviewed at least annually and whenever the service's data practices change. Legal obligations tracked per state DPA (FERPA, COPPA, PPRA, NY Ed Law § 2-d and state supplements). |
| Identify | Risk Assessment (ID.RA) | Risks assessed before each feature that touches student data (for example, school web filters, cross-school access, AI processing). Platform advisories from Google Cloud monitored; dependencies kept current. |
| Identify | Risk Management Strategy (ID.RM) | Data minimization first: no dates of birth, addresses, health, financial, biometric or location data. Risk tolerance is low; features that would add data categories are not shipped without updating DPAs. |
| Identify | Supply Chain Risk Management (ID.SC) | Subprocessors limited to Google LLC (Google Cloud / Firebase hosting and authentication; Google Workspace email; Gemini API for optional AI features) and Stripe, Inc. (billing, no student data), each under written data processing terms. LEAs are notified before any new subprocessor receives PII. |
| Protect | Identity Management, Authentication and Access Control (PR.AC) | Accounts restricted to school email domains and, where the school requires it, to the school's roster. School and role are server-assigned signed claims; database security rules enforce per-school isolation on every read and write and are covered by an automated test suite (54 tests) that runs before deployment. Administrative access: owner only, least privilege, multi-factor authentication. |
| Protect | Awareness and Training (PR.AT) | The owner (a licensed K–12 music educator) completes annual FERPA training through his district and annual training on FERPA, COPPA, PPRA and NY Ed Law § 2-d / 8 NYCRR Part 121. Any future employee or contractor completes the same training before receiving access to PII. |
| Protect | Data Security (PR.DS) | TLS 1.2+ in transit; AES-256 at rest (Google-managed keys). Data stored in the United States. Student free text is scrubbed of names before any optional AI processing. No student data in analytics; no advertising or tracking code in the application. |
| Protect | Information Protection Processes and Procedures (PR.IP) | Changes are version-controlled and tested before release; security rules and functions are deployed only from reviewed code. Daily automated database backups retained for 14 weeks. Secure deletion on request or contract end (see item 7). |
| Protect | Maintenance (PR.MA) | Fully managed Google Cloud services; platform patching handled by Google. Application dependencies and runtimes updated promptly. No remote maintenance access to customer systems. |
| Protect | Protective Technology (PR.PT) | Authentication, input validation and role checks on every server function; deny-by-default database rules (collections not explicitly allowed are inaccessible); rate limiting on account-recovery endpoints; secrets in Google Secret Manager, never in source code. |
| Detect | Anomalies and Events (DE.AE) | Google Cloud logging of authentication, function and database activity; security-rule denials and unusual access patterns reviewed. |
| Detect | Security Continuous Monitoring (DE.CM) | Cloud logging and alerting on errors and authentication events; billing and quota alerts; Google platform security notices monitored. |
| Detect | Detection Processes (DE.DP) | Owner reviews logs and alerts; automated tests detect regressions in access rules before release; security reports accepted at support@practicexp.com. |
| Respond | Response Planning (RS.RP) | Written incident procedure: contain (revoke credentials, tokens or keys; disable affected access), scope from audit logs, preserve evidence, remediate, notify. |
| Respond | Communications (RS.CO) | Notice to the LEA's designated contact without unreasonable delay, and within the time its DPA and state law require (New York: no later than seven business days after discovery), with the information required by Article V of the DPA. Cooperation with the LEA and law enforcement. |
| Respond | Analysis (RS.AN) | Each incident is analyzed for cause, data and records affected, and number of students and teachers affected. |
| Respond | Mitigation (RS.MI) | Affected access disabled immediately; vulnerability fixed and covered by an automated test before the service is restored. |
| Respond | Improvements (RS.IM) | Lessons learned are incorporated into code, tests and this plan after every incident or near miss. |
| Recover | Recovery Planning (RC.RP) | Point-in-time restore from daily backups (14-week retention); infrastructure defined in version control and redeployable. |
| Recover | Improvements (RC.IM) | Recovery steps reviewed after any restore and the plan updated. |
| Recover | Communications (RC.CO) | LEAs are kept informed through recovery and receive a written summary after an incident is resolved. |
support@practicexp.com
PracticeXP LLC · 421 N Elizabeth Ave, Apt 1, Jefferson, WI 53549 · United States
