Draft for legal review. This text has not been approved by a lawyer and is not yet in force. Highlighted items must be confirmed before publication.

Privacy Policy

Effective date: [date of approval]

SchoolWised is a school office dashboard for K-12 schools: attendance, parent emails, grades, reports, documents and fees. Schools trust us with information about their students, and this policy explains what we collect, how we protect it, and what we never do with it.

Who we are

SchoolWised is run by its founder. A company is being registered, and this page will name it once it is. [Add company name and address after registration.] To contact us about privacy, email [email protected] or use the contact form on our home page.

[Lawyer to confirm: state where SchoolWised is operated from and where school data may be accessed from.]

Two kinds of data

School data. A school that uses SchoolWised enters information about its students, parents and staff. This data belongs to the school, and the school controls it. We use it only to provide SchoolWised to that school, under the school's instructions and our written agreement with the school.

Website data. When you write to us through the contact form or book a demo on schoolwised.com, we receive what you give us. We use it only to reply to you and to arrange the demo.

Information we collect

From schools, through the service

• Student information: name, grade, classes and courses, attendance, behavior notes, grades, transcripts and report cards
• Parent and guardian information: names, contact details, and which parents receive emails
• Staff information: names, school Google accounts and roles
• Fees and payments the school records [Confirm: SchoolWised only records payments and does not process card payments.]
• Student documents, which stay in the school's own Google Drive
• An audit log of changes: which staff member changed what, and when

From visitors to schoolwised.com

• What you type in the contact form: name, work email, school, role, school size and your message
• What you enter on the demo booking page (Google Calendar): name, email and the time you choose
• Anonymous visit statistics (see Cookies and analytics below)

How we use it

We use school data only to run SchoolWised for the school: to show records to authorized staff, to calculate grades and reports, to prepare messages that the school chooses to send, to keep backups, and to give support when the school asks. We use website data only to answer your message and hold the demo.

Student privacy commitments

SchoolWised is built for K-12 school purposes. We follow the principles of U.S. student privacy laws such as FERPA and California's Student Online Personal Information Protection Act (SOPIPA):

• We do not sell student, parent, staff or school data.
• No advertising. We do not show ads in SchoolWised, and we never use student data to target advertising, on SchoolWised or anywhere else.
• No profiles. We do not build profiles of students for any purpose other than the school's own educational purposes.
• No other use. We do not use or disclose student data except to provide the service, when the school directs us, or when the law requires it.
• Deletion on request. We delete a student's data when the school asks us to.
• Reasonable security appropriate to the sensitivity of student data (see below).

For how we act on behalf of schools under FERPA, see our FERPA Statement.

Children under 13

Students do not sign in to SchoolWised and do not give us information directly. School staff enter student information for the school's educational purposes. Under the Children's Online Privacy Protection Act (COPPA), a school may authorize this on behalf of parents, for school use only. We use that information only for the school, never for commercial purposes. Parents who want to review or delete their child's information should contact the school, and we will help the school act on the request.

The schoolwised.com website is meant for school staff, not children, and we do not knowingly collect information from children through it.

Who we share it with

We share data only with the service providers we need to run SchoolWised, each limited to that job:

• Google: staff sign-in, emails sent from the school's own Google account, and documents in the school's own Google Drive
• Cloudflare: hosting the application and the website, and anonymous website statistics
• GitHub: storing the encrypted nightly backups
• Formspree: delivering messages sent through the website contact form

We may also disclose data when the law requires it, for example a valid court order. If that happens, we will tell the school first unless the law forbids it. If SchoolWised is ever sold or merged, this policy will continue to protect the data already collected, and schools will be told in advance.

How we protect it

• Sign-in with the school's Google accounts. We store no separate passwords.
• Each school is separate. Every school has its own installation and database.
• The school decides who sees what. Teachers see only their own classes; only administrators can open student documents.
• Every change is recorded in an audit log.
• Encrypted backup every night (AES-256), kept in two places: a private GitHub repository and the school's own Google Drive.
• Encrypted connections. The application and the website are served only over HTTPS.

If something goes wrong

If we learn that school data was accessed without authorization, we will notify the affected school without undue delay, and within [72 hours, to confirm], so the school can meet its own obligations, including any notice to parents required by state law.

How long data is kept

School data is kept while the school uses SchoolWised. The school can export its data at any time. When a school stops using SchoolWised, we delete its data and backups within 30 days, except where the law requires us to keep it. Contact form messages are kept for 12 months.

Your choices and rights

Parents, guardians and eligible students should contact their school to see, correct or delete records, because the school controls them. We help the school answer every such request. Website visitors can ask us to see or delete the information they sent us, by emailing [email protected].

Schools can sign a data privacy agreement with us before they start. [Confirm: offer the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA) or our own template.]

Cookies and analytics

The website uses no advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which does not use cookies and does not follow you across other websites. Because we do not track visitors across sites, our website treats every visit the same way, whether or not your browser sends a "Do Not Track" signal.

Changes to this policy

We update the effective date at the top when this policy changes. Before any important change to how we handle school data, we tell schools that use SchoolWised by email, and we do not apply the change to data already collected without the school's agreement.

State laws

[Lawyer to review: state student privacy laws that may apply to private schools in the states where SchoolWised sells (for example California SOPIPA and CalOPPA), and whether any state requires extra wording.]