Privacy Policy

For K-12 School customers, CampusSteward acts as a "school official" with a "legitimate educational interest" under the Family Educational Rights and Privacy Act ("FERPA"), performing an institutional service the School would otherwise perform with its own employees, under the School's direct control and subject to FERPA's use and re-disclosure limits. (20 U.S.C. § 1232g(b)(1)(A); 34 C.F.R. § 99.31(a)(1)(i)(A)-(B); see also A.R.S. § 15-141(A).)

CampusSteward is also an "operator" under Arizona's student-data-privacy statute for online school services, and complies with its restrictions on advertising, profiling, sale of data, security, and deletion. (A.R.S. § 15-1046.)

The School owns and controls student data; CampusSteward processes it only to provide the Service and as the School directs. Where a School has signed a Student Data Privacy Addendum ("DPA") with us, that DPA governs student data and controls over any conflicting term here.

Account information: names, email addresses, role, Site and district affiliation, and credentials used to authenticate.

Information provided by your Site: student, staff, family, and roster records the Site enters or imports, which may include education records, attendance, discipline, health, library, athletics, transportation, meal, and similar operational data the Site chooses to manage in the Service.

Information generated through use: content you create in the Service, messages, activity and usage logs, and support communications.

Technical information: IP address, device and browser type, and cookies or similar technologies (see our Cookie & Tracking Notice).

We collect the categories of personal information described above in order to provide the Service; the specific student data elements are determined by the School. (Categories disclosed consistent with Cal. Bus. & Prof. Code § 22575(b)(1), which we follow as a common baseline.)

We use information to provide, maintain, secure, support, troubleshoot, and improve the Service; to authenticate users and enforce roles and permissions; to communicate about the Service; and to comply with law.

We may use information to maintain, develop, support, and improve the Service, including diagnosing problems and providing adaptive or personalized educational features, as permitted for operators under Arizona law. (A.R.S. § 15-1046(B), (E).)

We use aggregated or de-identified information that does not identify any individual student to operate, secure, analyze, improve, develop, and demonstrate the Service, consistent with applicable law. (A.R.S. § 15-1046(E).)

We do NOT sell or rent student information. (A.R.S. § 15-1046(A)(3).)

We do NOT use student information for targeted or behavioral advertising, and we do NOT allow third parties to do so through the Service. (A.R.S. § 15-1046(A)(1); consistent with the FTC's Education Technology and COPPA Policy Statement (May 19, 2022).)

We do NOT use student information to build a profile of a student except in furtherance of school purposes. (A.R.S. § 15-1046(A)(2).)

We use student personal information only to provide the school-authorized educational service, and for no other commercial purpose. (15 U.S.C. § 6502(b); FTC Education Technology and COPPA Policy Statement (2022).)

We share information only as needed to provide the Service and as permitted by law: with your School and its authorized personnel; with service providers (subprocessors) who process data on our behalf under written agreements requiring protections no less stringent than ours; and as the School directs.

We disclose covered student information only for the purposes permitted under Arizona's operator statute, and we require our service providers to be bound not to further disclose it. (A.R.S. § 15-1046(A)(4).)

Legal requests. If we receive a government or legal request for student data, we will, unless legally prohibited, notify the School in advance so the School (as the controller of the records) can respond, rather than disclosing the data ourselves without the School's direction.

Business transfers. If CampusSteward is involved in a merger, acquisition, or sale of assets, any successor will remain bound by commitments no less protective than those in this Policy and any applicable DPA.

We maintain a current list of the categories of third parties with which information may be shared, available on request. (Consistent with Cal. Bus. & Prof. Code § 22575(b)(1).)

Mobile numbers and SMS consent: we do not sell mobile numbers, and no mobile information is shared with third parties or affiliates for marketing or promotional purposes. Mobile numbers are shared only with the messaging providers that deliver our messages, and only so that they can be delivered. See our SMS Messaging Terms.

School-authorized consent for children under 13. Where the Service collects personal information from students under 13, CampusSteward does so under the authorization of the School, which may act as the parents' agent to consent in lieu of individual verifiable parental consent, and only for the school-authorized educational purpose. (Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. §§ 6501-6506; 16 C.F.R. Part 312; FTC COPPA guidance and the FTC Education Technology and COPPA Policy Statement (May 19, 2022).)

Categories of children's information we may collect. Depending on the features your School enables, this may include the student's name; school, email, or other online contact identifiers; persistent identifiers such as cookies or IP address; and content the student creates in the Service. We do not collect precise geolocation, photographs, video or audio recordings, or biometric identifiers from children unless the School expressly enables a feature that requires it and provides the necessary authorization. (16 C.F.R. §§ 312.2, 312.4(d)(2).)

No commercial use, advertising, or profiling of children's data. We do not use or disclose children's personal information for any commercial purpose, including marketing, advertising, behavioral targeting, or building profiles for any purpose other than providing the school-requested educational service. (15 U.S.C. § 6502(b); FTC Education Technology and COPPA Policy Statement (2022).)

Data minimization. We do not condition a child's participation on the collection of more personal information than is reasonably necessary. (16 C.F.R. § 312.7.)

Third-party disclosure. We do not disclose children's personal information to third parties except as integral to providing the Service or as separately authorized. (16 C.F.R. § 312.5(a)(2).)

Review, deletion, and refusal. A parent — or the School acting as the parent's agent — may, after reasonable identity verification, review the child's personal information, direct its deletion, and refuse its further collection or use. Requests should be made through your School. (16 C.F.R. § 312.6.)

FERPA rights. Parents and eligible students may inspect and review education records (which the School must make available, generally within 45 days), request correction of records they believe are inaccurate or misleading, and control directory-information disclosures. Because the School controls the records, these rights are exercised through your School, and CampusSteward supports the School in honoring them. (34 C.F.R. §§ 99.10, 99.20-99.21, 99.37.)

Retention and deletion of children's data are governed by our Data Retention practices in Section 8 and are never indefinite. (16 C.F.R. § 312.10.)

We maintain a written information-security program with administrative, technical, and physical safeguards appropriate to the sensitivity of the information. These include encryption of personal information in transit and at rest, role-based least-privilege access controls, authentication safeguards, and periodic risk assessment, testing, and review. (A.R.S. § 15-1046(C)(1); 16 C.F.R. § 312.8.)

As part of that program we designate personnel to coordinate it, conduct at least an annual risk assessment, test and monitor the effectiveness of our safeguards, evaluate and adjust the program at least annually, and obtain written assurances that our service providers are able to maintain the confidentiality, security, and integrity of children's personal information before we release such information to them. (16 C.F.R. § 312.8(a)-(b).)

No method of transmission or storage is perfectly secure, but we work to protect information using measures aligned to recognized security standards and to continuously improve them.

Because your School controls the student data, if we discover a security incident affecting personal information we maintain we act as a data maintainer/processor: we will notify the School (as owner/controller) without unreasonable delay and in any event within seventy-two (72) hours of confirming the incident, provide the details reasonably available, and cooperate with the School's notification to affected individuals. (A.R.S. § 18-552(A), (C); definitions at § 18-551(1), (7).)

Where CampusSteward is itself the owner of the affected data, or where the School directs us to do so, we will notify affected individuals directly, and where Arizona's breach-notification statute applies we will comply with it — including notifying affected individuals within forty-five (45) days after the determination of a breach. (A.R.S. § 18-552(A), (B).)

Where a breach requires notification of more than 1,000 Arizona residents, the notifying party will also, within the same period, notify the three largest nationwide consumer reporting agencies and, in writing, the Arizona Attorney General and the Director of the Arizona Department of Homeland Security. (A.R.S. § 18-552(B)(2).) An individual notice will include the approximate date of the breach, a description of the personal information involved, the toll-free numbers and addresses of the three largest nationwide consumer reporting agencies, and the toll-free number, address, and website of the Federal Trade Commission. (A.R.S. § 18-552(E).)

Encrypted data whose encryption key was not acquired, and properly redacted data, are outside the statutory definition of a breach. (A.R.S. § 18-551(1), (3), (9).)

Any legally required "written" notice to an individual is provided by or through your School. If CampusSteward is ever required to deliver such a notice to you solely by electronic means, we will first obtain the consent that federal law requires, after disclosing your right to a paper copy, your right to withdraw consent, and any hardware or software requirements. (15 U.S.C. § 7001(c).)

We retain personal information only as long as reasonably necessary to provide the Service or as required by law, and we delete or return student data on the School's request or at the end of the School's subscription. Specific retention periods depend on the data category and your School's configuration and are set out in our written data-retention practices, which we provide to Schools on request. (A.R.S. § 15-1046(C)(2); 16 C.F.R. § 312.10.)

Children's personal information is retained only as long as reasonably necessary for the purpose for which it was collected, is not retained indefinitely, and is deleted using reasonable measures to protect against unauthorized access during deletion, in accordance with our written data-retention practices. (16 C.F.R. § 312.10.)

We securely destroy or redact records that contain personal identifiers when disposing of them, and we apply the same standard to electronic records that Arizona law sets for paper records. (A.R.S. § 44-7601.)

Because your School controls student records, requests to access, review, correct, or delete a student's data should be directed to your School, which CampusSteward supports. (FERPA, 34 C.F.R. §§ 99.10, 99.20-99.21; for special-education records, 34 C.F.R. §§ 300.613-300.618, 300.624.)

Account holders may update certain account information in their settings or by contacting contact@campussteward.com.

Privacy rights vary by state of residence. Any statutory access, deletion, correction, or opt-out rights you may have depend on the law of your state; contact us at contact@campussteward.com and we will help route your request appropriately, including to your School where it controls the records.

Text messages: if you have opted in to text messages, message frequency varies with your own notification settings and your Site's activity, and message and data rates may apply. Texts may include sign-in codes, alerts about your account, and emergency or safety alerts issued by your Site — including lockdown, evacuation, shelter in place, weather, transportation, power outage, medical, security and closure notices. Reply STOP to any message to stop them, or clear the consent box in Account → Security; note that this stops emergency alerts by text as well. See our SMS Messaging Terms.

We use cookies and similar technologies as described in our Cookie & Tracking Notice, which explains the categories we use, their purposes, and your choices. We disclose there how we respond to browser "Do Not Track" signals and whether third parties may collect information across sites. (Cal. Bus. & Prof. Code § 22575(b)(5)-(6).)

We aim to make our legal pages and consent screens accessible and work toward conformance with the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA. If you have difficulty accessing any part of them, contact contact@campussteward.com and we will help.

This Policy is effective as of the date shown above. We may update it; for material changes we will post the updated Policy with a new effective date and version and, where required, obtain renewed acceptance. For material changes to how we handle children's data, we will provide new notice to, and obtain new consent from, the School (as the parents' agent) before the change takes effect. (16 C.F.R. § 312.4(b), § 312.5(a)(1); notice practices consistent with Cal. Bus. & Prof. Code § 22575(b)(3)-(4).)

Privacy questions or requests: contact@campussteward.com. (16 C.F.R. § 312.4(d)(1).)