Privacy & data
No student PII collected, ever.
Schoolhouse delivers curriculum as public web pages and downloadable teacher editions. Students do not sign in, submit forms, or generate data in our systems. The only personal information we receive is what educators and administrators voluntarily provide when requesting access or activating a license.
For procurement & privacy officers
| Student PII collected | None |
| SDPC NDPA | We will sign — typically within 5 business days |
| FERPA / COPPA | No student education records received; no collection from children under 13 |
| Data sold or used for ads | Never |
| Privacy & DPA contact | privacy@contact.schoolhouse.space |
Procurement pack
Download DPA documents
Pre-filled Exhibit E, data flow statement, sub-processor list, and signing guide — ready to attach to your vendor review or RFP response.
Student data
No student accounts. No student PII. No student tracking.
Our curriculum is designed to be taught in the classroom — often unplugged, with printable materials — without requiring students to interact with Schoolhouse systems. Public student lessons are static web pages: no login, no account creation, no form submission, and no device-required telemetry.
We do not collect, maintain, disclose, or process personally identifiable information about students. We do not receive education records from your division. No cookies on our site identify students. No third-party analytics or advertising SDKs run on student-facing pages.
Data elements we handle
The table below mirrors what districts typically request in an SDPC Exhibit E or vendor security questionnaire. For Schoolhouse, nearly every student row is “none.”
| Category | Status |
|---|---|
| Student PII / education records | None — not collected, stored, or processed |
| Student accounts or logins | None |
| Teacher / staff PII (licensed access) | Work email and name, only when your division activates a license or you request access |
| Expansion interest (request-coverage) | Email, optional name, US state, school/district or homeschool context, optional message — for expansion notifications only |
| Free downloads (sampler, sample lesson) | School or district email, optional name, role, and school/district — to deliver the download and send occasional curriculum updates |
| Directory information | None from students |
| Biometric, geolocation, or behavioral profiling | None |
| Advertising or marketing data about students | None |
Teacher & administrator data
When you submit the request-access form, the state coverage interest form, or your division activates a license, we may collect:
- Name and work email (or personal email for homeschool families on the coverage form)
- School or division name and your role
- US state and, on the coverage form, whether you represent a school/district or a homeschool family
- Grade bands of interest, inquiry type, enrollment size, timeline, and funding source (form fields you choose to provide)
- Optional message text — please do not include student names or student contact information
For licensed divisions, we may also store authenticated teacher email addresses and a log of which gated artifacts (PDF teacher editions, etc.) were downloaded — for license compliance only, not for profiling or marketing.
We use this information solely to fulfill access requests, deliver the product, send transactional notices, issue invoices, and provide support. We do not sell, rent, or share it with third parties for their marketing purposes.
What we never do
- Sell or rent personal information — about students or adults
- Run advertising or retargeting on our site
- Build behavioral profiles of students
- Require students to create accounts or submit data to use curriculum content
- Use student data to train AI models (we collect none)
FERPA
The Family Educational Rights and Privacy Act (FERPA) governs how schools protect education records — records directly related to a student that are maintained by the school or a party acting on its behalf.
Schoolhouse does not receive, maintain, or process student education records. Our product is a curriculum publisher: we deliver instructional content. We are not a “school official” with access to your student information systems, and your division does not need to disclose student records to us for the curriculum to work.
Because there are no student education records in our environment, the ordinary FERPA obligations around third-party handling of those records do not arise for our core product. If your legal team needs a written data-flow confirmation for their file, email privacy@contact.schoolhouse.space and we will provide a signed statement describing our no-student-data architecture.
COPPA
The Children’s Online Privacy Protection Act (COPPA) applies to operators that collect personal information from children under 13 online.
Schoolhouse does not collect personal information from children of any age. Student-facing curriculum pages require no registration and include no data collection mechanisms. Teachers may use printed or projected lessons with young students entirely offline — in that mode, no data reaches Schoolhouse at all.
COPPA consent and parental-notification requirements therefore do not apply to our web delivery, because we do not collect information from children.
Virginia & state student-privacy laws
Virginia school divisions commonly require vendors to comply with state student privacy expectations and to execute the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement before purchase.
Because Schoolhouse does not process student personal information, state student-privacy obligations that govern the collection and use of student data generally do not attach to our core curriculum delivery. We still sign your division’s agreement when required — see the DPA section below.
DPA & SDPC NDPA
We will sign your district’s Data Privacy Agreement (DPA). We are prepared to execute the SDPC National Data Privacy Agreement (NDPA) — including Virginia and other state addenda your division requires — through the Student Data Privacy Consortium.
Because we do not collect student PII, DPA review is typically straightforward: Exhibit E (data elements) is largely “not applicable,” and there is no student data to return or delete at contract end. We can usually return a signed agreement within five business days of receiving your template.
For privacy officers and procurement: send DPA requests, security questionnaires, and Exhibit E clarifications to privacy@contact.schoolhouse.space. Include your division name and the agreement version you need signed.
Sub-processors
We use a small number of infrastructure providers. None receive student PII from us because we do not collect it.
| Provider | Purpose | Location | Certification |
|---|---|---|---|
| Vercel | Web hosting, CDN, serverless API routes | United States | SOC 2 Type II |
| Supabase | PostgreSQL database (lead forms, licensed-org records) | United States (configurable region) | SOC 2 Type II |
| Resend | Transactional email (confirmations, access notices) | United States | SOC 2 |
| Cloudflare Turnstile | Bot verification on public forms | United States | SOC 2 Type II |
| Upstash | Rate limiting for public form submissions | United States / EU (configurable) | SOC 2 Type II |
We will notify contracted divisions before adding a sub-processor that handles personal information, consistent with your DPA terms.
Retention, deletion & your rights
Lead-form submissions and licensed-user records are retained for as long as needed to fulfill your request, maintain your license, and meet legal obligations (typically up to three years after last contact for inactive leads). You may request deletion of your personal information at any time by emailing privacy@contact.schoolhouse.space.
Because we hold no student data, student record deletion requests under FERPA are not applicable to Schoolhouse — your division retains sole custody of student education records.
Cookies & analytics
Our public curriculum pages do not set first-party tracking or advertising cookies. We do not currently run third-party analytics SDKs (such as Google Analytics) on the site. We do not participate in ad networks or cross-site tracking.
When licensed download access is enabled, we may use essential session authentication cookies to verify your organization’s entitlement. Those cookies identify your authenticated session only — not students — and contain no student PII.
We load web fonts from Google Fonts; that request may transmit your IP address to Google’s CDN. No student data is involved. Our hosting provider (Vercel) may process standard server logs (IP address, user agent, requested URL) for security and reliability — aggregate only, not linked to student identity.
Hosting, encryption & security
Schoolhouse is hosted on Vercel (CDN and serverless functions in the United States) with application data stored in Supabase (PostgreSQL). All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256). Our infrastructure providers maintain SOC 2 Type II certifications.
We follow least-privilege access internally, row-level security on database tables, and input validation on all public API endpoints. Gated downloads require an active organizational entitlement — anonymous users cannot access licensed artifacts.
In the event of a security incident affecting personal information we hold, we will notify affected divisions and individuals without unreasonable delay, consistent with applicable law and your DPA terms.
Privacy officer contact
Questions about this policy, FERPA/COPPA architecture, DPA execution, sub-processor lists, or data deletion:
privacy@contact.schoolhouse.space
Schoolhouse · Virginia, USA · Last updated June 2026
Related: Security posture · Accessibility statement · About & legal entity