Privacy Policy

1. Introduction

ScholarPath Systems, LLC ("we," "our," or "us") builds educational software designed to empower students and schools. This Privacy Policy explains how we collect, use, store, and protect information when schools use our products, including GradTrack.

ScholarPath Systems is committed to protecting student privacy and complying with the Family Educational Rights and Privacy Act (FERPA) and applicable state student privacy laws.

ScholarPath Systems, LLC is located in Gresham, Oregon.

2. Information We Collect

ScholarPath Systems collects information only as directed by partner schools and only for the purpose of providing our educational software services.

Student Information (provided by schools):

• Student names
• School-assigned email addresses
• Student ID numbers
• Grade level and expected graduation year
• Course enrollment and completion records
• Credit hours earned by category
• Graduation pathway progress

Staff Information:

• Counselor and administrator names
• School-assigned email addresses
• Role and school assignment

Parent/Guardian Information:

• Parent/guardian names
• Email addresses
• Linked student relationships

Technical Information:

• Login timestamps and IP addresses (for security and audit purposes)
• Browser type and device information

3. How We Use Information

We use the information we collect solely to provide and improve our educational software services:

• Display graduation progress to authorized users
• Calculate credit completion by category
• Track career and technical education (CTE) pathway progress
• Identify at-risk students who may need intervention
• Generate progress reports and transcripts
• Enable counselor caseload management
• Allow parents to monitor their student's progress
• Maintain security through audit logging

We DO NOT:

• Sell student data to third parties
• Use student data for advertising or marketing
• Share data with third parties except as described in this policy
• Create advertising profiles based on student information

4. Data Storage and Security

We take the security of student data seriously and implement industry-standard protections.

Where Data is Stored:

All data is stored on Supabase, a SOC 2 Type 2 certified database platform hosted on Amazon Web Services (AWS) infrastructure in the United States.

Security Measures:

• All data is encrypted at rest using AES-256 encryption
• All data is encrypted in transit using TLS/SSL
• Row Level Security ensures schools can only access their own data
• Role-based access control limits data visibility by user type
• Audit logging tracks all data access and changes
• Regular security assessments and updates
• Secure authentication with password requirements

5. Data Sharing

We do not sell or rent student information. We only share data in the following limited circumstances:

Service Providers (Subprocessors):

We use the following third-party services to operate our products:

Provider	Purpose	Certification
Supabase	Database hosting & authentication	SOC 2 Type 2
Vercel	Web application hosting	SOC 2 Type 2

Legal Requirements:

We may disclose information if required by law, such as in response to a valid subpoena or court order. We will notify the affected school before disclosure unless legally prohibited from doing so.

6. Data Retention

We retain student data only as long as necessary to provide our services or as required by our agreement with each school.

• Active student data is retained while the student is enrolled and the school maintains an active account
• Upon school request, we will delete all school data within 30 days
• Audit logs may be retained for up to 3 years for security and compliance purposes
• Backup data is automatically deleted within 90 days of primary data deletion

7. School and Parent Rights

Schools Have the Right To:

• Access all data associated with their school
• Export their data in standard formats
• Request correction of inaccurate data
• Request deletion of all their data
• Receive notification of any data breaches

Parents/Guardians Have the Right To:

• View their student's graduation progress through the parent portal
• Request access to their student's data through the school
• Request corrections through the school

Note: Because ScholarPath Systems operates under the direction of schools as a "school official" under FERPA, parents should direct data access and correction requests to their school, which will coordinate with us as needed.

8. FERPA Compliance

ScholarPath Systems operates as a "school official" under FERPA, meaning:

• We perform institutional services that schools would otherwise perform themselves
• We are under the direct control of the school regarding data use
• We use education records only for authorized purposes specified in our agreements
• We comply with FERPA's restrictions on re-disclosure of student information

Our Data Processing Agreement with each school establishes the specific terms of our school official relationship and data handling obligations.

9. Children's Privacy

Our products are designed for use by schools to track student academic progress. We do not knowingly collect information directly from children under 13. All student data is provided by schools in accordance with FERPA and applicable state laws.

For students under 18, schools are responsible for obtaining any necessary parental consent as required by law.

10. Data Breach Notification

In the event of a data breach affecting student information, we will:

• Notify affected schools within 24 hours of discovering the breach
• Provide details about what data was affected
• Describe the steps we are taking to address the breach
• Cooperate with schools in notifying affected individuals as required by law

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify partner schools of material changes by email at least 30 days before they take effect. The "Effective Date" at the top of this policy indicates when it was last revised.

12. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: