Privacy Policy
ArcAngel Academics (“ArcAngel Academics,” “we,” “us,” or “our”), a product of ArcAngel Technical Services, LLC, provides school-management and recordkeeping software (the “Service”) to homeschools, co-ops, and public and private schools. We know the Service handles sensitive information about children and students, and we take that responsibility seriously. This Privacy Policy explains what we collect, how we use and protect it, and the choices and rights that schools, parents, and students have.
In short: we collect only the information needed to run a School’s records, we never sell it or use it for advertising, we encrypt sensitive data, we keep each School’s data isolated from every other School’s, and the School stays in control of its records at all times. The sections below give the detail.
1. Our role: we work on the school’s behalf
For every school, ArcAngel Academics acts as a service provider processing information at the direction of, and under the control of, the school or parent-educator that operates the account (the “School”). We do not decide what student information is collected or why; the School does. Where FERPA applies, we operate as a “school official” with a legitimate educational interest, using education records only to provide the Service to that School. See our School Data Addendum.
In a homeschool, the parent-educator is both the School and the child’s parent, and provides their own child’s information directly.
2. Information we collect
- Account information — for staff, parents, and students who sign in: name and email address, a securely hashed password, and the role(s) they hold at a School.
- Student records the School enters — depending on how the School uses the Service, this may include a student’s name, date of birth, grade level, mailing address, phone, email, courses and enrollments, grades and gradebook entries, attendance and instructional hours, test scores, reading logs, and staff notes.
- Billing information — plan and subscription status. Card payments are processed by our payment provider (Stripe); we do not receive or store full payment-card numbers.
- Technical and usage information — IP address, browser type, and security/audit logs of actions taken in the Service (for example, who viewed, printed, or exported a record).
We do not store Social Security numbers. Where an SSN is optionally used on a printed transcript, it is entered at print time and is never saved to our systems.
3. How we use information
We use information only to operate and improve the Service for the School: to maintain rosters and records, calculate grades and GPAs, generate transcripts and report cards, run parent and student portals, provide support, secure the Service, and process billing.
We will never: sell student or child information; use it to serve targeted advertising; build advertising or commercial profiles of children; or use it for any purpose other than providing the Service to the School, except as the School directs or the law requires.
4. Children’s privacy (COPPA)
The Service is designed for use under the authority of a School or parent-educator, not for children to sign up on their own. We rely on the School’s or parent-educator’s authorization and consent for any information about children entered into the Service, consistent with the Children’s Online Privacy Protection Act (COPPA) and FTC guidance permitting schools to consent on parents’ behalf for educational use. A plain-language summary is in our Children’s Privacy Notice. Parents may review, correct, or request deletion of their child’s information through their School, or by contacting us.
5. Education records (FERPA)
For schools subject to the Family Educational Rights and Privacy Act (FERPA), student records in the Service are “education records” that remain under the School’s control. We access and use them only to provide the Service, do not re-disclose them except as the School directs or the law requires, and do not use them for any independent purpose. See the School Data Addendum.
6. How information is shared
- Within the School — users see information according to the roles the School assigns (for example, a parent sees only their own linked children; staff see their School’s records).
- Service providers — we use a small number of vendors to run the Service, including cloud hosting (DigitalOcean, United States — New York City region) and payment processing (Stripe). They may process information only to provide services to us and are bound by confidentiality and data protection obligations.
- Legal and safety — when required by law, or to protect the rights, safety, or security of users, the public, or ArcAngel Academics.
- Business transfers — if ArcAngel Academics is involved in a merger, acquisition, or asset sale, information may transfer subject to this Policy; we will notify affected Schools.
We do not sell information and do not share it with third parties for their own marketing.
7. How we protect information — the security we provide
We want Schools and parents to know exactly what protection they are getting. The safeguards below are built into the Service:
- Encryption in transit — all traffic is served over HTTPS/TLS.
- Encryption at rest — directly identifying and sensitive student information (such as names, dates of birth, contact details, and health and medical notes) is encrypted in our database, so it is not readable even by someone with raw database access.
- Tenant isolation — every School’s data is partitioned so that one School can never see or reach another School’s records.
- Role- and capability-based access — users can see only what their assigned role permits. Especially sensitive medical information is tiered: staff can be shown only what they need for a student’s safety (for example, a life-threatening allergy) while confidential diagnoses and detail remain restricted to authorized roles such as a principal or counselor.
- Audit logging — sensitive actions (viewing, printing, or exporting records) are recorded for accountability.
- No Social Security numbers stored — see Section 2.
- Payment security — card payments are handled by Stripe; we never receive or store full card numbers.
- United States hosting — the Service runs on U.S.-based infrastructure (see Section 10).
If we ever become aware of a confirmed breach affecting a School’s data, we will notify the affected School without undue delay and cooperate with any breach-notification obligations that apply.
What we do not promise. No online system can be guaranteed perfectly secure, and we do not claim to be. We commit to reasonable administrative, technical, and physical safeguards and to the specific measures above; we cannot guarantee that data will never be accessed, altered, or lost despite those safeguards. Keeping login credentials confidential and assigning roles carefully remain the School’s responsibility.
8. Data retention and deletion
We retain information for as long as the School’s account is active and as needed to provide the Service. A School may correct or delete records at any time, and may request export or deletion of its data. When an account is closed, we will delete or return the School’s data within 60 days, except where retention is required by law. Backups are purged on a rolling schedule.
9. Your rights and choices
Schools control their data and can access, correct, export, or delete it through the Service or by contacting us. Parents and eligible students may exercise access and correction rights through their School, which is the appropriate party under FERPA; we will support the School in responding. Depending on where you live, you may have additional rights under state privacy or student-data laws.
10. Where information is stored
The Service is operated and data is stored in the United States (New York City region). We do not transfer Student Data outside the United States in the ordinary course of providing the Service.
11. Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes affecting student data, notify Schools.
12. Contact us
For privacy questions or requests, contact [email protected].
Questions about this document? Contact [email protected].