Privacy Policy

Effective Date: March 29, 2026

1. Introduction

Alpha Heights LLC, doing business as School Tag ("Company," "we," "us," or "our"), is committed to protecting the privacy of educational institutions, staff, parents, and students. This Privacy Policy governs the collection, use, and disclosure of data across the School Tag website, administrative dashboards, and mobile applications (collectively, the "Service").

2. Information We Collect

We collect information strictly to provide and improve the Service. We do not collect Social Security numbers or biometric identifiers.

Admin/Teacher Data: Name, email, phone number, school/district affiliation, and role.
Parent/Guardian Data: Name, email, phone number, relationship to the child, and dismissal preferences.
Student Education Records: Student names, IDs, grades, class rosters, attendance, and dismissal/behavior notes provided exclusively by the school/district.
Technical & Usage Data: IP addresses, device types, operating systems, and app usage metrics. Limited point-in-time geolocation data is collected via scans strictly for school-authorized safety (e.g., bus boarding, emergency mustering).

3. How We Use Your Information

To facilitate secure student dismissal, early release, and attendance tracking.
To send transactional and safety-related notifications (push, SMS, email) to parents regarding their enrolled children.
To generate operational analytics for authorized school administrators.
To maintain TCPA-compliant SMS consent records and prevent fraud or security issues.

4. United States Educational Privacy (FERPA, COPPA & State Laws)

Alpha Heights LLC operates in strict compliance with federal and state student privacy laws.

FERPA: When providing the School Tag platform, we act as a "School Official" with a legitimate educational interest. The educational institution retains full ownership and control over all student education records. We process student data solely for authorized educational and campus safety purposes and assist schools in fulfilling their obligations to access, correct, or delete records upon request.
COPPA: School Tag is not directed to children under 13. We do not market directly to, or intentionally collect personal information directly from, children outside of the school context. We rely on the educational institution to provide the requisite consent on behalf of the parents, as permitted by COPPA for educational purposes.
SOPIPA & State Laws: We are committed to complying with state-level student privacy laws, including California's SOPIPA and Texas Chapter 322. We strictly prohibit the use of K-12 data for targeted advertising and do not build marketing profiles of students.

5. Canadian Data Residency & Regional Compliance

Data Storage and Hosting: For users and educational institutions located within Canada, all Personal Information (PI) and sensitive school operational data are hosted on secure, encrypted servers physically located within Canada (e.g., Montreal, Quebec). We prioritize keeping Canadian user data strictly within Canadian borders.
PIPEDA & Provincial Laws: Our practices comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial private-sector legislation. Our architecture also supports public schools in fulfilling obligations under public-sector laws like MFIPPA (Ontario), FOIP (Alberta), and FIPPA (BC).
Quebec Specific Compliance (Law 25): We adhere to Quebec's modernized Private Sector Act. All privacy settings are configured to the highest confidentiality by default. We conduct regular Privacy Impact Assessments (PIAs) and uphold the rights to Data Portability and the Right to be Forgotten. We strictly require express consent from a parent, legal tutor, or authorized institution before processing data for students under 14.
Security and Encryption: All data is encrypted at rest and in transit using AES-256 and TLS 1.2+ protocols. Our emergency alert trigger mechanisms are designed with data minimization in mind, gathering only the strictly necessary telemetry and location data required to ensure campus safety during an active crisis.

6. Data Sharing & Third Parties

We never sell personal information or use student data for targeted marketing. Data is shared only with:

The school or district that owns the data.
Parents (only information about their own children).
Authorized subcontractors under strict contracts (e.g., AWS, Neon, Twilio, Clever, Stripe, Namecheap).
Law enforcement or regulators when legally required.

7. Data Retention

Active Accounts: Personal information is retained while the account is active.
Education Records: Retained only as long as needed for educational purposes or district direction.
Secure Deletion: Upon contract termination, data is securely destroyed within 30 days following NIST SP 800-88 standards. TCPA consent records are retained for a minimum of 5 years.

8. Your Rights

Users may access, correct, or request deletion of their personal information via account settings. Canadian residents maintain the right to challenge data accuracy and withdraw consent under PIPEDA. Requests regarding student education records must be directed to the school or district first.

9. Data Breach and Security Incident Notification

Alpha Heights LLC maintains a comprehensive Incident Response Plan. In the event of a verified security breach resulting in the unauthorized access or disclosure of student or institutional data, we will notify the designated point of contact at the affected educational institution without unreasonable delay, and in no event later than 72 hours after confirming the incident, unless a shorter timeframe is mandated by law. We will fully cooperate with the school district to provide the necessary technical information to fulfill their own notification obligations and will conduct a thorough forensic review post-incident.

10. Privacy Officer Contact

In accordance with Law 25 and PIPEDA, Alpha Heights LLC has designated a Privacy Officer to oversee data practices. For any inquiries regarding data residency, access requests, or compliance, please contact:

Privacy Officer
Alpha Heights LLC
Email: privacy@myschooltag.com