Canadian Privacy Statement

Canadian Privacy Statement

Our other policies: Terms of Service · Services Privacy Policy · Children’s Privacy Policy · Rally Reader Data Storage · Service Providers · Cookie Policy · Website: Privacy Policy

1. Introduction

This Canadian Privacy Statement (“this Statement”) explains how Rally Reader collects, uses, discloses and protects personal information in Canada.

It is written for two audiences: the Canadian school boards, school districts, school divisions, school authorities, conseils scolaires and other educational institutions (collectively, “Schools”) that adopt the Rally Reader Service for their students, and the parents and guardians (“Family Members”) who sign up for Rally Reader directly and use it at home with their own children.

The two situations are governed differently, and this Statement keeps them separate throughout. Section 3 explains which one applies to you.

Section 6 lists every standard that applies to Rally Reader in Canada and states whether we meet it. Two we do not meet: consent for a child under 14 in Quebec, which applies in both situations (Section 10), and access from within Canada only under Nova Scotia legislation, which applies to School-sponsored use (Section 16).

2. How this Statement fits with our other policies

This Statement is free-standing. It applies to personal information about individuals in Canada. Where anything in it differs from our Services Privacy Policy, Children’s Privacy Policy, Website Privacy Policy, Data Storage page, Cookie Policy or Terms of Service, this Statement governs in Canada.

Our Terms of Service consist of Core Terms that apply to everyone, together with a Schedule for each account type — Schedule A for School Accounts, Schedule B for Family Accounts, Schedule C for Sponsored Program Accounts — plus Schedule D for application store terms and Schedule E, Jurisdiction-Specific Provisions. Parts 1 and 2 of Schedule E set out the provisions that apply in Quebec and elsewhere in Canada, including governing law and dispute resolution, and Schedule E ranks above the Core Terms and the other Schedules.

Where a written agreement between Rally Reader and a School sets a higher standard than this Statement, that agreement governs for that School.

3. Two ways to use Rally Reader in Canada

Which parts of this Statement apply to you depends on how the account was created.

School-sponsored use. A School adopts Rally Reader for its students. Educators or School administrators create classes and invite students; students cannot enrol themselves. The School decides what information enters the Service, who may see it, and how long it is kept. This is the arrangement described wherever this Statement says “School-sponsored use.”

Family use. A parent or guardian downloads Rally Reader, agrees to our Terms of Service, and creates an account for their own child. There is no School involved, no class, and no educator. The Family Member is the account holder and makes every decision about the child’s use of the Service. This is the arrangement described wherever this Statement says “Family use.”

For school-sponsored use, the school holds the agreement, and an educator or school administrator creates the student’s account. The school is accountable for the student’s personal information, with Rally Reader acting as its service provider. The school provides consent and is responsible for notifying families and obtaining any consent required by law. Questions about a student’s information should be directed to the school first.


School-sponsored use is subject to federal and provincial private-sector privacy law, as well as the public-sector access and privacy legislation and student-record legislation governing the school. We do not use student information for marketing; communications with educators are handled separately. Payment information is collected under the school’s agreement.


For family use, the parent or guardian holds the agreement and creates the student’s account. Rally Reader is directly accountable for the student’s personal information. The parent or guardian provides consent directly to us, and questions about a student’s information should be directed to Rally Reader.


Family use is subject to federal and provincial private-sector privacy law. With consent, we may send marketing communications to the parent or guardian, and those communications include an unsubscribe option. We never send marketing communications to the child. Payment information is collected when a paid subscription is purchased.

A student may move between the two — for example, where a family keeps using Rally Reader at home after a School’s agreement ends. Which set of rules applies at any point depends on who holds the account at that time.

Sponsored Program accounts. In some provinces a Sponsor — in Canada, The Rally Reader Education Fund of Canada, independently administered by The Veritas Foundation / La Fondation Veritas — funds accounts that a parent or guardian registers on a program website. The parent or guardian holds the account, and this Statement treats it as Family use, except that it is free, cannot become a paying account (Section 18), and follows the messaging rules in Schedule C of our Terms of Service. The registration form asks for the child’s date of birth, school and grade. The Sponsor receives counts and totals only — by grade, school district or board, region and month — never anything that identifies a child, and a group of fewer than 10 children is never reported separately.

4. Who is accountable for personal information in Canada?

In School-sponsored use, your School is the accountable institution. A School that adopts the Rally Reader Service decides what personal information enters the Service, which staff may see it, whether Family Members are invited, whether recording is available, and how long information is kept. Under the access and privacy legislation that governs it, the School is a public body with custody and control of its students’ records, and it remains accountable for them. Rally Reader acts as the School’s service provider, processing personal information on the School’s documented instructions and only for the educational purposes the School has authorized. For anything concerning a student’s information, contact the School first; we will support the School in responding.

In Family use, Rally Reader is the accountable organization. There is no institution between us and you. We are directly responsible for the personal information of the account holder and the child, and you bring your requests, questions and complaints straight to us.

In both cases, Rally Reader is accountable for what we do with personal information under the Personal Information Protection and Electronic Documents Act (“PIPEDA”), including where we transfer it to a service provider for processing, and — where they apply — under the Personal Information Protection Act of Alberta, the Personal Information Protection Act of British Columbia, and Quebec’s Act respecting the protection of personal information in the private sector as modernized by Law 25.

5. Which Canadian laws apply?

To both School-sponsored use and Family use:

  • PIPEDA. We comply. We work to its ten fair information principles and meet its breach reporting requirements (Section 21). Support staff in Canada, the United States and Europe may temporarily access Canadian account information to resolve a request — permitted under PIPEDA, and disclosed in Section 15.
  • Alberta PIPA and British Columbia PIPA. We comply where they apply in place of PIPEDA.
  • Quebec Law 25. We comply, with one exception and one item in progress. We keep information confidential by default and record and report incidents. The assessment required before communicating personal information outside Quebec is being completed (Section 15). The exception is consent for a child under 14. Recording requires an express opt-in, but the child can grant it themselves, in both School-sponsored and Family use. In Quebec that consent must come from the parent, guardian or tutor — see Sections 6 and 10.
  • CASL. We comply. We send no messages of any kind to children. Marketing to a Family account holder carries consent and an unsubscribe (Section 12).

Children and youth, in both situations. Canadian regulators expect that a child under 13 cannot give meaningful consent and that a parent or guardian must; Quebec sets that threshold at 14. Regulators also expect vendors to put the best interests of the child first. We meet these expectations, with the Quebec under-14 consent exception noted above. We do not market to children or profile them, whoever holds the account. We do not use any personal information to train AI models — not a child’s, and not anyone else’s (Section 9).

To School-sponsored use only. These statutes bind your School, not Rally Reader. We comply in our role as service provider — we process only on the School’s instructions, and we support the School’s own obligations for collection, retention, access, correction, disclosure and breach response. One exception: Nova Scotia’s Personal Information International Disclosure Protection Act, which we do not fully meet because authorized personnel outside Canada may access information stored here for support purposes — see Section 16.

In Ontario, the school’s access and privacy obligations are governed by the Municipal Freedom of Information and Protection of Privacy Act, with additional obligations for school boards under the Enhancing Digital Security and Trust Act. Student records are governed by section 266 of the Education Act and the Ontario Student Record Guideline.


In Quebec, the school’s access and privacy obligations are governed by the Act respecting Access to documents held by public bodies and the Protection of personal information, as modernized by Law 25. Student records are governed by the Education Act.


In British Columbia, the school’s access and privacy obligations are governed by the Freedom of Information and Protection of Privacy Act. Student records are governed by the School Act and the Student Records Order.


In Alberta, the school’s access and privacy obligations are governed by the Protection of Privacy Act and the Access to Information Act, which came into force on June 11, 2025. Student records are governed by the Education Act and the Student Record Regulation.


In Manitoba, the school’s access and privacy obligations are governed by the Freedom of Information and Protection of Privacy Act. Student records are governed by The Education Administration Act.


In Saskatchewan, the school’s access and privacy obligations are governed by the Local Authority Freedom of Information and Protection of Privacy Act. Student records are governed by The Education Act, 1995.


In Nova Scotia, the school’s access and privacy obligations are governed by the Freedom of Information and Protection of Privacy Act and the Personal Information International Disclosure Protection Act. Student records are governed by the Education Act.


In New Brunswick, the school’s access and privacy obligations are governed by the Right to Information and Protection of Privacy Act. Student records are governed by the Education Act.


In Prince Edward Island, the school’s access and privacy obligations are governed by the Freedom of Information and Protection of Privacy Act. Student records are governed by the Education Act.


In Newfoundland and Labrador, the school’s access and privacy obligations are governed by the Access to Information and Protection of Privacy Act, 2015. Student records are governed by the Schools Act, 1997.


In Yukon, the Northwest Territories, and Nunavut, the school’s access and privacy obligations are governed by the respective territory’s access to information and protection of privacy legislation. Student records are governed by the respective territory’s education legislation.

Rally Reader does not hold the student record. In School-sponsored use, your School does. Where something created in Rally Reader — a recording of a student reading aloud, a record of reading progress — forms part of a student record, your School determines its status, retention and disclosure, and we provide export and deletion on request so the School can act on those decisions. In Family use, none of this legislation applies: there is no student record, no public body, and nothing that a School controls.

6. Where we meet these standards, and where we do not

Several entries below record non-conformance, partial conformance or work in progress. Each is described in full in the section referenced.

For both school-sponsored and family use, we conform to PIPEDA’s ten fair information principles. This includes temporary support access from Canada, the United States, and Europe, which PIPEDA permits as a use, subject to accountability and transparency. Further information is provided in sections 4 and 15.

For both school-sponsored and family use, we conform to PIPEDA’s requirements for breach reporting, notification, and record-keeping. Further information is provided in section 21.

For both school-sponsored and family use, we conform to CASL. We do not send messages of any kind to children, regardless of who holds the account. Further information is provided in section 12.

For both school-sponsored and family use, we conform to Alberta PIPA and British Columbia PIPA. Further information is provided in section 5.

For both school-sponsored and family use, we conform to Quebec Law 25’s requirements concerning transparency, rights, and incident handling. Further information is provided in sections 19, 21, and 25.

For both school-sponsored and family use, the assessment required under section 17 of Quebec Law 25 before communicating personal information outside Quebec is in progress and has not yet been finalized. Further information is provided in section 15.

For both school-sponsored and family use, Quebec Law 25’s provisions concerning automated decision-making are not applicable because no feature makes decisions about a child based solely on automated processing. Further information is provided in section 19.

For both school-sponsored and family use, we do not conform to Quebec Law 25’s consent requirements for minors under 14. Recording is off by default and requires an express opt-in, but the child can currently provide that opt-in themselves in either setting. For a child under 14 in Quebec, consent must come from a parent, guardian, or tutor. We hold age information for the child, but the app does not yet use it to direct the consent request to a parent. Further information is provided in section 10.

For school-sponsored use, we conform to public-sector access and privacy legislation across the provinces and territories in our role as a service provider. These statutes bind the school. Further information is provided in sections 4 and 5.

For school-sponsored use, we conform to British Columbia FIPPA’s requirements concerning disclosure outside Canada. Such disclosure is permitted in accordance with the regulations. Further information is provided in section 15.

For school-sponsored use, we do not fully conform to the requirement under Nova Scotia’s Personal Information International Disclosure Protection Act that information be accessed only from within Canada. We store Canadian information in Canada, but support staff in the United States and Europe may temporarily access it. This restriction binds public bodies and their service providers, so it does not apply to family use. Further information is provided in sections 15 and 16.

For school-sponsored use, we conform to Ontario’s Enhancing Digital Security and Trust Act to the extent that it is in force. Substantive requirements are to be established by regulation. We will meet those requirements as they take effect and notify Ontario schools when this Statement changes as a result. Further information is provided in section 5.

For both school-sponsored and family use, a French version of this Statement and related contract documents under the Charter of the French Language is not currently available. A French version of this Statement is in preparation. Further information is provided in section 23.

For both school-sponsored and family use, a French-language product interface is not available. The Rally Reader interface is available only in English. French-language titles are available in the library, but the interface surrounding them has not been translated. Further information is provided in section 23.

7. Who does Rally Reader collect information from?

From the people who hold Rally Reader accounts — educators, School administrators, Family Members and students — and from the devices used to reach the Service. Where a School uses a third-party authentication service, we receive information from that service.

In School-sponsored use, students cannot create their own accounts; a teacher or School administrator invites them to a class.

In Family use, the parent or guardian creates the account and adds the child. A child cannot create a Rally Reader account. Rally Reader is distributed through the Apple App Store and the Google Play Store, and relies on those platforms’ regionally enforced age gates and parent-held credentials: the app is downloaded and the account created under an adult’s store credentials, and a child using a managed or child account cannot install it or complete sign-up without the account holder’s approval.

What this control does and does not do. It establishes that an adult obtained the app and opened the account. It is not a substitute for consent to a specific collection of personal information after that point — in particular, it does not govern who enables recording, which is dealt with in Section 10.

8. What information does Rally Reader collect?

We limit collection to what is necessary to deliver the Service.

Account Information. Name, email address or other unique identifier, age information (described below), grade, optional Lexile score, password, and optional profile picture or avatar. In School-sponsored use this may be entered by an educator or administrator, by the student, or populated from the authentication service the School uses. In Family use the parent or guardian provides it. We do not collect a child’s phone number, home address or gender.

Age information. We need to know how old a child is, and the Service asks for that in one of two ways. Where an account is opened inside the application, it asks for an age in years. Where a child is registered for a Sponsored Program on a program website, the registration form asks for a date of birth. In this Statement, age information means whichever of the two we hold for a given account. Where an age in years is sufficient, an age in years is what we ask for.

Why we collect it. One purpose: to know how old the child is. Several privacy and child-protection rules apply differently depending on a child’s age, and we cannot apply the right rule to the right child without knowing their age. We do not use age information for any other purpose.

Class group names (School-sponsored use). An educator creates class groups and names them. We store the name exactly as the educator typed it, in a free-text field, and we use it only to organize students into the groups the educator set up.

Sometimes an educator names a group after a program — an EAL or ELL group, a reading intervention, a support block. Where that happens, the group name can imply something about a student that we never ask for. We do not ask about a student’s English language learner status, special education status, individual education plan, disability, or participation in any support program, and we do not collect that information anywhere else in the Service. We do not derive it from a group name, we do not use a group name to infer anything about a student, and a group name is never included in Sponsor reporting.

What a School can do about it. An educator can rename a class group at any time, and the new name replaces the old one. A School that would rather these fields carried no program information can instruct its educators to use neutral group names.

Reading Content. A child may be given the option to record a reading session. Recording is off by default. Turning it on requires an explicit in-app permission grant in accordance with the device platform’s permissions policy. Where recording occurs, Reading Content may include audio of the child reading, synchronized book capture, animated word highlighting and application interface elements.

Reading Data. Reading metrics such as time spent reading and titles completed.

Messages. A child has a single one-way feedback channel — for example, to report a problem with the app or an error in a book. A submission is acknowledged by an on-screen confirmation when it is sent; nothing is sent to the child afterwards. A child never receives email from Rally Reader, in either situation.

Information from an authentication service. Where an account is created through a third-party authentication service, we receive the name, profile picture and email address that service makes available, subject to your settings with that service. We do not send personal information back to that service beyond what authentication requires.

Payment information (Family use). Rally Reader does not store payment information. Where a Family Member purchases a subscription, payment is handled by the app store, which collects and holds the card or payment account details. We do not receive or retain them.

Usage and log data. Pages visited, time spent, actions taken, and log information including device type, operating system, device identifiers and cookie identifiers.

IP address and approximate location. We receive an IP address with every request, as every internet service does, and we derive an approximate location from it — country, province or state, and in some cases city.

We use it to secure the Service and, where books are purchased, to determine which tax jurisdiction applies to the purchase, so that the correct sales tax is charged and remitted.

We do not collect a precise device location. The Service does not ask a device for its location, and no location permission prompt appears.

Communications. Information you send us directly, including support requests and optional survey responses.

9. What Rally Reader never does

These commitments apply in both School-sponsored use and Family use. The first and the commitment on AI models apply to everyone’s personal information, not only a child’s.

  • We do not sell, rent, trade or otherwise disclose personal information for value — anyone’s.
  • We do not use a child’s personal information for advertising or marketing of any kind, and we do not allow advertisers or data brokers to collect information about a child’s use of the Service. The Service carries no third-party advertising.
  • We do not build profiles of children other than to deliver the Service — in School-sponsored use, for the educational purposes the School has authorized; in Family use, for the reading experience the parent has set up.
  • We do not send a child email or text messages.
  • We do not use personal information to train AI models. No personal information collected through the Service, whether from a child, a Family Member, an educator or a School, is used by us to train, refine, fine-tune, evaluate or otherwise develop any artificial intelligence or machine learning model. We do not sell, share or disclose personal information to anyone for that purpose, and we do not authorize any service provider to use it for that purpose. Where we learn that a service provider has done so, we will address it, including by ending the arrangement.
  • A child’s account cannot make purchases within the app.

10. How is consent obtained?

In School-sponsored use, through the School. A School adopting the Rally Reader Service is responsible for having the authority to permit collection of personal information from its students for its educational purposes, and for giving families the notices its own legislation requires. Our Terms of Service make the School responsible for giving families notice and for obtaining any consent the law requires before a student uses the Service. Where a School relies on its legal authority rather than individual consent, the School confirms it has that authority.

In Family use, directly from you. The parent or guardian consents on their own behalf and on behalf of their child when they create the account. We identify our purposes at the point of collection, and recording requires a separate express opt-in.

Express opt-in for recording, in both situations. Recording does not occur unless someone affirmatively turns it on and grants the device permission.

Quebec: children under 14. For a child under 14 in Quebec, consent to the collection of personal information — including any recording of the child’s voice — must be given by the person having parental authority or by the tutor.

  • In Family use, the Service does not currently enforce this. The parent or guardian consents to the child’s use of Rally Reader when the account is created, but recording is a separate, express consent, and the child can turn it on themselves from within the app. For a child under 14 in Quebec, that consent has to come from the parent, guardian or tutor. Until the app provides this control, a Quebec parent or guardian who does not want their child under 14 recorded should leave recording off and not permit the child to enable it.
  • In School-sponsored use, the Service does not currently enforce this either. The recording permission can be granted by the student, whatever their age or province. Until the app provides this control, a Quebec School must obtain parental or tutor consent outside the Service before enabling recording for a student under 14, and is responsible for having done so.

We hold age information for the child, but in neither situation does the app yet use it to route the recording consent to a parent or tutor. We will notify Quebec Schools and Quebec Family account holders when the control is available.

Withdrawing consent. Consent may be withdrawn at any time on reasonable notice, subject to legal and contractual limits, and withdrawal may mean parts of the Service can no longer be provided. In School-sponsored use, contact the School: it can turn off recording, close the account, or ask us to delete the information. In Family use, you can turn off recording, close the account, or ask us to delete the information yourself.

11. How does Rally Reader use this information?

We use personal information to:

  • provide and secure the Service — authenticating users, storing and displaying Reading Content and Reading Data, maintaining accounts;
  • in School-sponsored use, support educators, School administrators and Family Members, and give School administrators information about how Rally Reader is performing in their School;
  • in Family use, deliver the reading experience to the account holder and the child, including progress information for the parent or guardian;
  • process payment for a subscription or a book purchase, in Family use;
  • determine the applicable tax jurisdiction for a purchase, using the approximate location derived from an IP address, so that the correct sales tax is charged and remitted;
  • send service messages and important notices to adult account holders, and other notifications they have not turned off;
  • identify activity that may breach applicable law or our policies;
  • provide customer support and respond to inquiries;
  • meet our legal and regulatory obligations.

In aggregated and de-identified form only, we analyze usage patterns to improve and develop features, and to inform how we describe the Service to educators, Schools and families generally.

What de-identified means here. Before information is treated as de-identified we do all four of the following: remove direct identifiers such as names, student identification numbers, government identifiers, exact addresses and phone numbers; control indirect identifiers such as date of birth, postal code, gender and ethnicity, which could be cross-referenced against other datasets to re-identify someone; generalize by grouping values into broader categories, such as an age band rather than an exact age or a region rather than a postal code; and aggregate, so that what is reported describes a group rather than an individual.

We do not attempt to re-identify de-identified information, and we do not permit anyone else to. Where Canadian law sets a higher standard, we apply it.

12. Does Rally Reader send marketing?

Never to a child, in either situation.

In Family use, we may send the parent or guardian who holds the account information about Rally Reader — new features, reading tips, subscription information — where you have consented, in accordance with CASL. Every message identifies us and carries an unsubscribe link, and unsubscribing takes effect promptly. Service messages you cannot opt out of are limited to things like billing notices, security notices and material changes to the Service.

In School-sponsored use, we do not market on the basis of student information, and Student Data is never used to inform or enable marketing. Educators and School administrators may receive communications under their own preferences.

13. Who can view content in Rally Reader?

In School-sponsored use, a student’s Reading Content and Reading Data are by default visible only to the student, their teacher and authorized School staff. A teacher or School administrator may extend access — to a reading specialist, or to an invited Family Member. School administrators may have access across their Rally Reader organization.

In Family use, a Family account holds up to five family members, each of whom is either a parent or a child. A child’s Reading Data is visible to that child and to the parent members of the account. A parent member can also play back a child’s Reading Content — recordings of that child reading aloud.

Only a parent can add a family member, so a child cannot give anyone access to the account or to their own reading information. Only the person who opened the account can remove a family member.

No School, educator or other Rally Reader user can see a Family account’s content.

In both, children cannot share content with one another. There is no child-to-child messaging and no public posting within the Service. Access controls cannot prevent every form of onward sharing outside the Service — a screenshot, for instance.

14. In what limited circumstances may Rally Reader share information?

Only these:

  • Within the Service, as its functionality requires and as the School or Family Member has configured it.
  • With the School, in School-sponsored use, and with the people the School has authorized.
  • With service providers who process personal information on our behalf under written agreements requiring them to meet our security standards, to use the information only to provide or support the Service, and to comply with applicable Canadian privacy law. Our service provider list — what each provider does and where each processes information — is published at rallyreader.com/legal/data-storage/service-providers.
  • Where required by law, including in response to a valid legal demand. Where we are compelled to disclose, we will notify the affected School or individual unless we are prohibited from doing so.
  • In a corporate transaction. We will not transfer a child’s personal information in a sale, divestiture or reorganization unless the acquirer commits to privacy standards no less protective than these. We will notify affected Schools with an opportunity to have the information deleted before any transfer, and we will notify Family account holders of any change of ownership affecting the use of their personal information, together with the choices available to them, including deletion.

15. Where is Canadian information stored, and who can access it?

Storage location and access location are different questions, and Canadian legislation treats them differently. Both are set out below.

Storage. Personal information belonging to Canadian Schools, Canadian Family accounts and their users is stored in Canada. No copy of it is stored, hosted, replicated or backed up in any other country.

Rally Reader runs on three platforms. Amazon Web Services and Google Cloud each have separate Canadian and United States environments; Vercel runs our server-side code in its Montréal region:

  • Amazon Web Services runs the book system, including book storage, copy protection, licensing, and purchases, as well as the login system. These systems operate in the Canadian region ca-central-1 (Montréal), with ca-west-1 (Calgary) serving as the backup region.
  • Google Firebase and Google Cloud run the rest of the application, including application data, Reading Data, Reading Content, logs, and backups. These services operate in northamerica-northeast1 (Montréal), and northamerica-northeast2 (Toronto) may also be used.
  • Vercel hosts our websites and runs the server-side code behind our registration forms. All server-side code executes in the dedicated Canadian region yul1 (Montréal).

Logs and backups for Canadian accounts are stored in Canada only.

A Canadian account’s information stays in the Canadian environment on each platform. The full service provider list is published at rallyreader.com/legal/data-storage/service-providers.

Access from outside Canada. Access is a different thing from storage, and the difference matters. Personnel outside Canada do not receive a copy of Canadian information and do not hold it on systems outside Canada. They connect remotely to the Canadian environment, and the information remains stored in Canada throughout. It is displayed to the person handling the request; it is not moved to another country to be kept or processed there.

Rally Reader support staff located in Canada, the United States and Europe may access this information to resolve a support request or incident. Support access is temporary and purpose-limited: our support staff access an account only as needed to resolve a specific request or incident, only to the extent necessary, and only under role-based permissions. Access is logged. Reading Content is technically reachable in support, but is rarely needed and rarely accessed — support work is concentrated almost entirely on account and system data such as sign-in problems, class rosters, subscription status and device or application errors. We maintain written data processing agreements with every service provider outside Canada.

This is permitted under PIPEDA, and we comply. Transferring personal information to a service provider or an employee outside Canada for processing — including remote access for support — is treated as a use of the information rather than a disclosure, and does not require separate consent. What PIPEDA does require is that we remain accountable for the information, secure comparable protection by contract, and disclose the arrangement.

What this means for you. Information stored in or accessible from another country may be subject to lawful access requests by the authorities of that country while it is there. Our safeguards do not displace foreign law.

Provincial requirements in School-sponsored use. In British Columbia, FIPPA permits a public body to disclose personal information outside Canada in accordance with the regulations. In Quebec, section 17 of the private sector Act requires an assessment before personal information is communicated outside Quebec. We are completing that assessment. It covers the remote access described above, and it will be available to Schools and regulators on request. In Nova Scotia, see Section 16.

16. Nova Scotia: where we do not conform

This section concerns School-sponsored use. It does not apply to Family use, because the legislation binds public bodies and their service providers.

Nova Scotia’s Personal Information International Disclosure Protection Act restricts public bodies and municipalities — and their service providers — from storing personal information outside Canada, or permitting it to be accessed from outside Canada, unless an exception applies. A modernized framework replacing that Act is scheduled to take effect April 1, 2027.

Rally Reader does not currently meet the access requirement. We store Canadian personal information in Canada. But support staff in the United States and Europe may temporarily access it to resolve a request or incident, as described in Section 15, and that access is a disclosure outside Canada regardless of where the information is stored. What is permitted under PIPEDA is not permitted here.

What this means for a Nova Scotia School. The Act permits the head of a public body, or the responsible officer of a municipality, to allow storage of and access to personal information outside Canada where they determine that it meets the necessary requirements of the organization’s operation. A Nova Scotia School wishing to use Rally Reader may need to make and document that determination.

Nova Scotia Schools should contact us before adopting the Service, so that we can work through the arrangement together and put the appropriate agreement in place.

17. How long is information kept?

Retention works differently for a whole account relationship than for one person’s account inside it. Both are set out below.

While the relationship is active. We keep personal information for as long as the School’s agreement or the Family account remains active, so that reading history and progress stay available.

After a School or Family account ends. Our default is to keep the information for at least 90 days, and we may keep it for up to 12 months. Our standard practice is to delete it at 12 months. That practice is not a contractual commitment and can vary where an agreement or the law requires something different. A School or Family account holder can direct deletion at any point in that window and we will act on it.

Deletion on request, at any time. A School, a Family account holder, or an individual may request deletion at any time and we will action the request promptly. The only exceptions are a legal hold or a minimum retention period the law requires of us.

Deleting one person’s account during an active relationship. Where a single student, educator or Family Member account is deleted while the School’s agreement or the Family account continues, the information is deleted from our live systems immediately. Copies may persist in backups until those backups expire on their normal cycle. Backups are immutable — they cannot be edited after they are written, so a copy inside one is removed by the backup expiring rather than by being reached into. The maximum periods are as follows:

Point-in-time recovery backups expire after a maximum of 7 days. Daily backups expire after a maximum of 30 days, and weekly backups expire after a maximum of 98 days.

Once those periods pass the backups expire automatically and the information is unrecoverable. Backups are held in Canada, are access-controlled throughout, and are used only to restore the Service.

Records we keep separately. Support tickets, security logs, and records we are required by law to keep, including subscription and transaction records, are retained under access controls and deleted on their own cycle.

18. What happens when a School begins providing Rally Reader to a child who already has a Family or sponsored account?

The School account is stood up first. It is created and working before we contact the account holder, so the child is never without the Service.

We tell the account holder before the change takes effect.

The account holder controls their own account. Downloading a record of the child’s reading and closing that account are theirs alone.

Whether the child uses a School account is the School’s decision, made under the School’s own authority, and a School will often not consult each family individually. Where a family asks that their child not use the School account, we refer them to the School and act on the School’s instruction.

A sponsored account winds down on a fixed schedule. A Sponsor funds a child’s reading, books included, rather than a particular account. Where a School adopts Rally Reader, the Sponsor directs its support for that child to the School. The same Sponsor continues to fund that child’s reading.

The sponsored account then stops allowing new book downloads immediately, remains readable for 90 days so the child can finish books already downloaded, and becomes dormant. This schedule runs whether or not the account holder replies, because it follows from the funding having moved rather than from a failure to answer. Dormant does not mean deleted.

An account holder whose sponsored account winds down keeps every right described here, and may open a paid Family Account at the prices then in effect. A sponsored account cannot be upgraded or converted into a paying account, so a paid account opened afterwards is a new account and carries nothing across from the sponsored one.

A paid Family account does not wind down. The account holder is paying for it, and it continues unless they close it.

Reading history is downloaded by the account holder, for the account holder. It is a summary of cumulative statistics — time spent reading, books read, titles completed, reading level over time. We do not send it to the School, and it cannot be imported into another Rally Reader account or into another company’s product.

Reading Content is never transferred. A recording of a child reading, made under a Family or sponsored account, does not move to a School account under any circumstances. It stays with the account it was made in and is deleted with it.

The right to download and delete is always available. It is not limited to a transition period and does not depend on anything else.

A School cannot see into a Family or sponsored account. A School obtains nothing about a child’s earlier use by virtue of providing a new account.

If a School stops providing the Service, or a child leaves that School. The School account closes. Before it closes, the School is given notice and the opportunity to download a record of each affected child’s reading, and decides what to pass on to its families. Information is then deleted or returned under the School’s instruction, or under the retention periods in Section 17 where the School gives no instruction. The account does not convert into a paid account and no family is billed.

Who controls what, after the change. Information in the School account is controlled by the School; a deletion request for it goes to the School, and we support the School in responding. Information in the previous account remains controlled by its account holder, who can ask us directly at any time.

19. What are your rights, and how do you exercise them?

Subject to the exceptions in the applicable legislation, individuals in Canada may:

You have the right to ask whether we hold personal information about you, obtain a copy of that information, and learn how it has been used and to whom it has been disclosed.

You have the right to have inaccurate or incomplete personal information corrected.

You may withdraw your consent on reasonable notice, subject to legal and contractual limits.

You have the right to have your personal information deleted where we no longer have a lawful basis to retain it.

In Quebec, you have the right to receive the computerized personal information you provided in a structured, commonly used technological format.

In Quebec, you may request that information be de-indexed or that its dissemination cease in the circumstances provided for by legislation.

In Quebec, you have the right to be informed of a decision based exclusively on automated processing and to make representations about that decision.

You may challenge our compliance by raising a concern with our Privacy Lead and escalating it to a regulator.

Where to bring a request. In School-sponsored use, bring requests about a student’s information to the School, which controls it; we support the School in responding. In Family use, bring them directly to us — there is no intermediary, and we will handle the request ourselves.

How we respond. We acknowledge requests promptly and respond within 30 days. Where a request is complex we may extend that period as the legislation permits, and we will tell you of the extension and the reason within the original period. We respond without charge, and will tell you in advance if any permitted cost would apply.

Verifying identity. We verify identity before acting on a request, and we use anything provided for verification only for that purpose. For a request about a child in Family use, we verify that the requester is the account holder.

Automated decisions. No feature of the Service makes a decision about a child based exclusively on automated processing. Reading levels, progress and anything else the Service produces are there to inform the educator or Family Member, who decides what to do with them.

20. How does Rally Reader keep your data safe?

We protect personal information with administrative, technical and physical safeguards: encryption in transit and at rest, access-controlled data centres, role-based access limiting employee access to what is necessary, logging and monitoring, privacy and security training for staff, and periodic independent security testing.

21. What happens if there is a breach?

If a breach of security safeguards affects personal information, we will:

  • report to the Office of the Privacy Commissioner of Canada and to the applicable provincial regulator, and notify affected individuals, as soon as feasible where the breach creates a real risk of significant harm;
  • in School-sponsored use, notify affected Schools by email within 72 hours of confirming the breach, and sooner where circumstances warrant, and give them the information they need to meet their own reporting and notification obligations;
  • in Family use, notify the affected account holder directly, on the same timeline;
  • notify any other organization that may be able to reduce the risk of harm; and
  • keep records of breaches as the legislation requires.

The 72-hour commitment is a maximum, not a substitute for the “as soon as feasible” standard, which can be shorter.

22. Complaints and oversight

Bring a concern to our Privacy Lead first (Section 25). We will acknowledge it, investigate, and tell you the outcome.

If you are not satisfied, you may complain to the regulator with jurisdiction:

Anywhere in Canada, the regulator responsible for federal private-sector privacy law is the Office of the Privacy Commissioner of Canada. Its website is priv.gc.ca.

In Alberta, the regulator is the Office of the Information and Privacy Commissioner of Alberta. Its website is oipc.ab.ca.

In British Columbia, the regulator is the Office of the Information and Privacy Commissioner for British Columbia. Its website is oipc.bc.ca.

In Quebec, the regulator is the Commission d’accès à l’information du Québec. Its website is cai.gouv.qc.ca.

In Ontario, the regulator is the Information and Privacy Commissioner of Ontario. Its website is ipc.on.ca.

In other provinces and territories, the regulator is the provincial or territorial Information and Privacy Commissioner or Ombudsman.

In School-sponsored use, where your concern is about information held by your School, that School’s oversight body may also have jurisdiction.

23. Language

The Rally Reader interface is available in English only. There is no French-language version of the product at this time. The Rally Reader library does include French-language titles, which a child can read in French within an English-language interface.

The websites for our Canadian sponsored programs, including New Brunswick and Scarborough, are published in French and in English. Both versions are published at the same time and say the same thing.

A French version of this Statement is not currently available. One is in preparation and will be published with equal status.

24. Changes to this Statement

We may update this Statement to reflect changes in our practices or in Canadian law. The “Last updated” date shows when it was last revised. Where a change would materially affect how we collect or use a child’s personal information, we will notify affected Schools and Family account holders in advance and give them a choice before the new practice takes effect. We will not apply materially different practices to personal information already collected without that notice.

25. Contact information

Questions, requests and complaints under this Statement:

Privacy Lead: Stouffer Egan
Rally Reader, Inc.
265 Cambridge Ave #60459
Palo Alto, CA 94306

  • Privacy: legal@rallyreader.com
  • General and support: hello@rallyreader.com
  • Legal notices: legal@rallyreader.com