Privacy & data
No student PII collected during curriculum use.
Schoolhouse delivers curriculum as public web pages and downloadable teacher editions. Students do not sign in, and curriculum use generates no student data in our systems. The one exception: a grades 9–12 student may choose to send us a completed week-1 log from the college-tracks page. Otherwise, the only personal information we receive is what educators and administrators voluntarily provide when requesting access or activating a license.
For procurement & privacy officers
| Student PII collected | None during curriculum use; one optional grades 9–12 week-1 log |
| SDPC NDPA | We will sign — typically within 5 business days |
| FERPA / COPPA | No education records received from your division; the week-1 log form is for grades 9–12 and not directed to children under 13 |
| Data sold or used for ads | Never |
| Privacy & DPA contact | privacy@contact.schoolhouse.space |
Procurement pack
Download DPA documents
Pre-filled Exhibit E, data flow statement, sub-processor list, and signing guide — ready to attach to your vendor review or RFP response.
Student data
No student accounts. No student PII from curriculum use. No student tracking.
Our curriculum is designed to be taught in the classroom — often unplugged, with printable materials — without requiring students to interact with Schoolhouse systems. Public student lessons are static web pages: no login, no account creation, no form submission, and no device-required telemetry.
Curriculum use does not collect personally identifiable information about students. We do not receive education records from your division. No cookies on our site identify students. We use privacy-oriented, cookie-free Vercel Web Analytics for aggregate page-view statistics; it does not identify students or collect student PII. We do not run advertising or cross-site tracking SDKs.
The one exception is optional. On the grades 9–12 college-tracks page, a student may send a completed week-1 log. It carries the student’s email address, grade, chosen track, the free-text log (up to 5,000 characters), and the name of the person who checked it. We store it in Supabase, copy it to staff by email (Resend) and Slack, and email the student a confirmation. The student’s IP address goes to Cloudflare Turnstile for a spam check, and the IP and email are short-lived rate-limit keys in Upstash. “Open in email app” sends the same content to us by email instead; “Copy filled log” and printing send us nothing.
Data elements we handle
The table below mirrors what districts typically request in an SDPC Exhibit E or vendor security questionnaire. For Schoolhouse, nearly every student row is “none.”
| Category | Status |
|---|---|
| Student PII / education records | No education records. Student PII only from an optional grades 9–12 week-1 log: email, grade, track, the free-text log, and the second reader's name |
| Student accounts or logins | None |
| Teacher / staff PII (licensed access) | Work email and name, only when your division activates a license or you request access |
| Expansion interest (request-coverage) | Email, optional name, US state, school/district or homeschool context, optional message — for expansion notifications only |
| Free downloads (sampler, sample lesson) | School or district email, optional name, role, and school/district — to deliver the download and send occasional curriculum updates |
| Directory information | None from students, other than the email address on an optional week-1 log |
| Biometric, geolocation, or behavioral profiling | None |
| Advertising or marketing data about students | None |
Teacher & administrator data
When you submit the request-access form, the state coverage interest form, or your division activates a license, we may collect:
- Name and work email (or personal email for homeschool families on the coverage form)
- School or division name and your role
- US state and, on the coverage form, whether you represent a school/district or a homeschool family
- Grade bands of interest, inquiry type, enrollment size, timeline, and funding source (form fields you choose to provide)
- Optional message text — please do not include student names or student contact information
For licensed divisions, we may also store authenticated teacher email addresses and a log of which gated artifacts (PDF teacher editions, etc.) were downloaded — for license compliance only, not for profiling or marketing.
We use this information solely to fulfill access requests, deliver the product, send transactional notices, issue invoices, and provide support. We do not sell, rent, or share it with third parties for their marketing purposes.
What we never do
- Sell or rent personal information — about students or adults
- Run advertising or retargeting on our site
- Build behavioral profiles of students
- Require students to create accounts or submit data to use curriculum content
- Use student data to train AI models
FERPA
The Family Educational Rights and Privacy Act (FERPA) governs how schools protect education records — records directly related to a student that are maintained by the school or a party acting on its behalf.
Schoolhouse does not receive education records from your division’s systems. Our product is a curriculum publisher: we deliver instructional content. We are not a “school official” with access to your student information systems, and your division does not need to disclose student records to us for the curriculum to work.
If your division directs its students to send week-1 logs, we treat those submissions as covered student data under your division’s agreement. If your legal team needs a written data-flow confirmation for their file, email privacy@contact.schoolhouse.space and we will provide a signed statement describing our data flow.
COPPA
The Children’s Online Privacy Protection Act (COPPA) applies to operators that collect personal information from children under 13 online.
Curriculum use does not collect personal information from students of any age. Student-facing curriculum pages require no registration and include no data collection mechanisms. Teachers may use printed or projected lessons with young students entirely offline — in that mode, no data reaches Schoolhouse at all.
The one student form, the week-1 log on the grades 9–12 college-tracks page, is not directed to children under 13. We do not knowingly collect personal information from a child under 13; if we learn that a submission came from one, we delete it.
Virginia & state student-privacy laws
Virginia school divisions commonly require vendors to comply with state student privacy expectations and to execute the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement before purchase.
Because curriculum delivery does not process student personal information, state student-privacy obligations that govern the collection and use of student data generally do not attach to it. The optional week-1 log is the exception, and we handle it under your division’s agreement. We still sign your division’s agreement when required — see the DPA section below.
DPA & SDPC NDPA
We will sign your district’s Data Privacy Agreement (DPA). We are prepared to execute the SDPC National Data Privacy Agreement (NDPA) — including Virginia and other state addenda your division requires — through the Student Data Privacy Consortium.
Because student data is limited to the optional week-1 log, DPA review is typically straightforward: most Exhibit E rows are “not collected,” and at contract end we delete any week-1 logs as your division directs. We can usually return a signed agreement within five business days of receiving your template.
For privacy officers and procurement: send DPA requests, security questionnaires, and Exhibit E clarifications to privacy@contact.schoolhouse.space. Include your division name and the agreement version you need signed.
Sub-processors
We use a small number of infrastructure providers. Student data reaches them only when a student chooses to send a week-1 log from the grades 9–12 college-tracks page.
| Provider | Purpose | Location | Certification |
|---|---|---|---|
| Vercel | Web hosting, CDN, serverless API routes | United States | SOC 2 Type II |
| Supabase | PostgreSQL database (lead forms, licensed-org records, student week-1 logs) | United States (configurable region) | SOC 2 Type II |
| Resend | Transactional and inbound email (confirmations, access notices, week-1 log notifications) | United States | SOC 2 |
| Slack | Staff notification of new submissions (includes week-1 log text) | United States | SOC 2 Type II |
| Cloudflare Turnstile | Bot verification on public forms (IP address) | United States | SOC 2 Type II |
| Upstash | Rate limiting for public form submissions (IP and email as short-lived keys) | United States / EU (configurable) | SOC 2 Type II |
| Web font CDN (fonts.googleapis.com); IP may be logged, no student data | United States | SOC 2 / ISO 27001 |
We will notify contracted divisions before adding a sub-processor that handles personal information, consistent with your DPA terms.
Retention, deletion & your rights
Lead-form submissions and licensed-user records are retained for as long as needed to fulfill your request, maintain your license, and meet legal obligations (typically up to three years after last contact for inactive leads). You may request deletion of your personal information at any time by emailing privacy@contact.schoolhouse.space.
Student week-1 log submissions are kept for no more than 12 months after receipt, then deleted. We delete a submission within 30 days of a request from the district, a parent, or the student, and at contract end as the district directs. Deletion covers the database record and our email and Slack copies. Your division retains sole custody of student education records.
Cookies & analytics
Our public curriculum pages do not set first-party tracking or advertising cookies. We use Vercel Web Analytics for aggregate, cookie-free page-view statistics (URL path, referrer, device type, and coarse geography). Vercel does not use third-party cookies for this product and does not collect data that identifies individual visitors across sites. On selected marketing surfaces (persona landing pages and specialty brief banks), we also record anonymous first-party pageview and click events in our own database — URL path, optional UTM parameters, referrer, and a short-lived per-tab session id in sessionStorage (cleared when the tab closes). We do not run Google Analytics, ad networks, or cross-site tracking.
When licensed download access is enabled, we may use essential session authentication cookies to verify your organization’s entitlement. Those cookies identify your authenticated session only — not students — and contain no student PII.
We load web fonts from Google Fonts; that request may transmit your IP address to Google’s CDN. No student data is involved. Our hosting provider (Vercel) may process standard server logs (IP address, user agent, requested URL) for security and reliability — aggregate only, not linked to student identity.
Hosting, encryption & security
Schoolhouse is hosted on Vercel (CDN and serverless functions in the United States) with application data stored in Supabase (PostgreSQL). All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Our infrastructure providers maintain SOC 2 Type II certifications.
We follow least-privilege access internally, row-level security on database tables, and input validation on all public API endpoints. Gated downloads require an active organizational entitlement — anonymous users cannot access licensed artifacts.
In the event of a security incident affecting personal information we hold, we will notify affected divisions and individuals without unreasonable delay, and no later than 30 calendar days after we determine that a breach occurred, or sooner where your DPA or state law requires it.
Privacy officer contact
Questions about this policy, FERPA/COPPA architecture, DPA execution, sub-processor lists, or data deletion:
privacy@contact.schoolhouse.space
Schoolhouse · Virginia, USA · Last updated September 2026
Related: Security posture · Accessibility statement · About & legal entity