Privacy Policy & Student Data Charter

1. Core Data Protection Principles

Student Success System is built on strict data minimization and cryptographic tokenization. We recognize that student records require the highest level of confidentiality under international and national educational privacy standards.

2. Compliance with Educational Regulations

2.1 FERPA Compliance (Family Educational Rights and Privacy Act)

Under FERPA regulations (34 CFR Part 99), Student Success System operates strictly as an authorized "School Official" with legitimate educational interests. Student education records remain under the direct operational control of the enrolling school district or institution.

2.2 COPPA Compliance (Children's Online Privacy Protection Act)

We do not collect personal information from children under 13 without verified school or parental consent. The platform contains zero third-party commercial advertisements, zero behavioral tracking, and never sells or leases student data under any circumstances.

3. Information We Collect and Process

We process only data strictly necessary for campus attendance management, academic achievement, and positive behavior gamification:

• Student Identity Data: Student full name, academic grade, classroom assignment, and assigned NFC card/wristband token UID.
• Attendance Event Logs: Timestamp, terminal/gate identifier, entry/exit classification, and synchronization status.
• Behavioral & Gamification Records: Positive merit points awarded, badges unlocked, behavioral interventions, and teacher feedback notes.
• Guardian Contact Details: Parent name, verified email address, and phone number for critical push notifications and alerts.

4. Security Infrastructure and Cryptography

Our infrastructure enforces enterprise-grade security protocols across all layers:

• Data in Transit: All HTTP transactions, SignalR WebSocket streams, and API communications are encrypted using modern TLS 1.3 protocols with Perfect Forward Secrecy.
• Data at Rest: Database volumes, backup images, and cache segments are encrypted with AES-256 standard encryption.
• Instant Token Revocation: In the event a physical wristband is misplaced or lost, the school administrator can revoke the token in under 1 second, immediately invalidating the physical hardware chip.
• Offline Edge Security: Scans buffered in edge readers during internet interruptions are encrypted with unique ephemeral keys prior to resynchronization.

5. Data Retention & Deletion Rights

Educational institutions retain full ownership of their data. When an academic contract concludes or upon verified school administration request, all associated student records, logs, and biometric token linkages will be permanently scrubbed from our systems in accordance with contractual SLA standards.