Cool English — Data Security & Privacy Plan
Last updated: November 4, 2025

Overview

Cool English provides ESL activities as printable PDFs and interactive HTMLs. We do not use student accounts and do not collect student PII. The public website is hosted on Wix. Static activity files are stored on AWS S3 and delivered via Amazon CloudFront. This plan applies to our public website and CDN-delivered activity assets.

Data Minimization

• No student names, emails, IDs, submissions, or profiles are collected.

• Limited technical metadata (e.g., IP, browser, cookies) and aggregate usage statistics are used only for security, performance, and reliability.

• Teacher contact details are collected only when a teacher creates an account or contacts support.

Security Controls (aligned to NIST CSF v1.1)

• Identify / Protect: Least-privilege IAM with MFA for admin access; HTTPS/TLS; S3 server-side encryption; restricted bucket policies; change/configuration reviews.

• Detect: Provider logs/metrics (Wix analytics; S3/CloudFront access logs) monitored for anomalies.

• Respond: If an incident affecting LEA data is confirmed, we will notify the LEA within 72 hours, share scope/impact/mitigations, and coordinate next steps.

• Recover: Versioned/static redeploy, configuration baselines, and post-incident reviews.

Access & Retention

• No student logins. Teacher/admin access is role-based and limited to business need.

• Teacher accounts are managed on Wix (Wix Members); passwords are hashed—never stored in plaintext.

• Teacher contact data is retained only as needed for service/support or legal obligations. Upon request, we delete teacher accounts and associated contact data within 30 days from production systems (backups age out per routine retention).

Cookies & Analytics

We use essential cookies and basic analytics for reliability and abuse prevention. We do not use behavioral advertising.

Hosting & Data Locations

• Wix.com Ltd. hosts the website and teacher authentication.

• AWS S3/CloudFront store/deliver static activity files only; no teacher or student PII is stored in AWS.

Subprocessors

• Wix.com Ltd. — Website hosting & authentication (teacher accounts)

• Amazon Web Services (S3, CloudFront) — Static file storage & CDN

• An email provider (e.g., Google Workspace or similar) may be used solely for teacher support communications.

Contact

Cool English, LLC — Security & Privacy
Email (incidents): security@coolenglish.net
Email (general privacy): privacy@coolenglish.net
A direct phone line for LEA officials is provided upon request.