Privacy Policy

1. Introduction

PRISM, operated by Ethan Unland, is committed to protecting the privacy of students, teachers, administrators, and all users of our educational platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

We collect and store the following information that schools, teachers, students, and families provide to us through manual entry, file uploads, linked spreadsheets, Google Classroom, and the student and family portal:

Student Information

• Name (first and last name)
• Student ID number
• School email address, when the school provides one
• Grade level, school, homeroom, and classroom enrollments
• Assessment scores and progress on standards and skills
• Test results the school imports: i-Ready diagnostic results (scale scores, placements, and levels) and Smarter Balanced (SBA) results
• School-day attendance totals the school imports, and tardy and absent marks for Learning Lab sessions
• Learning Lab and intervention group placements, and notes staff write about them
• Portrait of a Graduate observations, ratings, and notes from teachers; nominations; and reflections and feedback from students and families
• Student survey answers, such as interests, what helps them learn, and self-ratings on skills
• Work a student adds as evidence of their learning (links or files)
• Notes a teacher writes about students they choose for a professional growth (TPEP) goal, including tags the teacher may add such as IEP, 504, or attendance

The TPEP tags can show that a student has an IEP or a 504 plan, so they are handled as sensitive information. They are visible only to the teacher who wrote them and to school or district administrators the teacher chooses to share the goal with. They never appear on anything a student or family sees, or on any printout made for a student or family.

Teacher and Staff Information

• Name and professional email address
• Teacher code/identifier
• School and district affiliation
• Subject areas and grade levels taught
• Classroom rosters and assignments
• Professional Learning Community (PLC) participation
• Planning work: PLC plans, journals, assessments, and worksheets
• Professional growth (TPEP) goals, notes, and reflections
• Problem reports you send, including the page you were on and technical details from your browser

Student and Family Portal

Students and families do not have PRISM accounts. A student or family member opens the student's profile by entering the student's ID number and first name. We use Cloudflare Turnstile to block automated guessing, and a portal session ends after 24 hours. Through the portal, a student or family can view the student's profile, write reflections, give feedback, and add evidence of learning. Information meant for staff, such as notes teachers write about placements and the TPEP tags described above, is not shown in the portal.

Usage and Security Information

• A security audit log of actions taken in PRISM, recording the account, the time, the IP address, and the browser used
• IP addresses, briefly, to limit how many requests can be made in a short time
• Anonymous page view counts. Before a page address is counted, PRISM removes any record identifiers from it, so no student or staff record can be identified from these counts

Support & Contact Communications

When you submit a support request or contact form on our platform, we collect and store:

• Your name and email address
• The subject and content of your message
• Any replies exchanged as part of the support conversation
• Timestamp and direction (inbound/outbound) of each message

This information is stored in our database to manage, track, and respond to your inquiry. Support messages are accessible only to authorized PRISM platform administrators.

Leadership Loop (Coaching Records)

The Leadership Loop stores professional coaching communication between a school leader and a teacher. For each entry we store:

• The author, the teacher the loop belongs to, and the school
• Whether the entry is a logged classroom visit or a written note, and its text
• Optional tags and an optional linked academic standard
• The visibility setting chosen by the author (shared with school leaders, or private to two people)
• Planned observation dates, and whether the teacher was shown them
• Timestamps, and a record of which participants have opened the conversation

Loop entries are professional communication about educators. They are not intended to contain student records, and users are asked not to identify individual students in them.

Google Classroom Integration

When you connect Google Classroom, we access, read-only:

• Your Google account name and email address
• List of your Google Classroom courses
• Student rosters with names and email addresses

PRISM uses a Google Classroom roster only to connect your class to your school's roster. It adds a student to your class only when the school's roster already includes that student.

Google Drive Integration

When you export from PRISM to Google Drive, we access:

• Your Google account name and email address
• Permission to create and manage files that PRISM creates in your Google Drive (drive.file scope)

We use this access solely to:

• Create assessments, answer keys, practice worksheets, and skill checklists as Google Docs
• Create TPEP documents for your professional growth portfolio
• Create a spreadsheet to collect student survey answers, and read those answers back into PRISM
• Set sharing on documents PRISM creates

Assessments, answer keys, and skill checklists are set so anyone with the link can open and edit them, where your school's Google settings allow, so your teammates can use them. They contain no student information. TPEP documents and survey spreadsheets are never shared with anyone with the link, and stay private to you unless you share them yourself.

PRISM strictly:

• Only creates NEW files, and reads back only files it created
• Cannot access your existing Google Docs or other Drive files
• Cannot see, edit, or delete files not created by PRISM
• Leaves the files it creates in your Google Drive under your control

Spreadsheets Linked by a School

A school administrator can link a Google Sheets roster or attendance spreadsheet to PRISM. PRISM reads that spreadsheet to keep the school's roster and attendance up to date.

Google API Services User Data Policy

PRISM's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use Your Information

We use the collected information to:

• Provide educational services and track student progress
• Place students in Learning Lab sessions and intervention groups
• Generate personalized learning recommendations
• Facilitate teacher-student interactions and classroom management
• Create and manage Professional Learning Communities
• Sync classroom rosters with Google Classroom
• Generate reports for teachers, administrators, and districts
• Ensure platform security and prevent unauthorized access
• Comply with educational regulations and requirements

4. AI Features and Student Data

PRISM does not send student information to any artificial intelligence (AI) service. PRISM's AI features write a prompt from standards, skills, and questions, and the teacher chooses whether to paste it into an AI tool of their own. These prompts do not include student names or student records.

Teachers who use an outside AI tool are responsible for following their district's rules for that tool, and should not paste student information into it.

5. FERPA Compliance

We comply with the Family Educational Rights and Privacy Act (FERPA). We work with schools as a "school official" with a legitimate educational interest. Student records are only accessible to authorized school personnel and parents/guardians as permitted by FERPA.

6. Staff Coaching Communication (Leadership Loop)

Because the Leadership Loop holds communication about employees, it follows stricter rules than the rest of the platform:

• Access is granted deliberately, never by job title. Reading a school's coaching conversations requires being designated a Loop leader at that school. Holding a school admin, district admin, or platform owner role does not by itself grant access.
• The audience is always named. Every conversation displays the full list of people who can read shared notes in it.
• Private notes reach two people. A note marked private is visible only to its author and the other participant, and is excluded from other leaders' views, counts, and notifications.
• Teachers see their own record in full, with one labeled exception. Every visit, message, and reply in a teacher's loop is visible to that teacher. The exception is a leader's memo: a private working note visible only to the leader who wrote it, clearly labeled, never sent to anyone, and excluded from every other person's view.
• Notification emails never contain note text. Emails state only that new activity exists; the content stays in PRISM under these access controls.
• Access is logged. Reads and writes by school leaders are recorded in our security audit log.
• Impersonation is blocked. Loop data is unavailable while any account is being accessed through a delegation or act-as session.

When Someone Leaves

• A school leader leaves or changes schools. Their Loop access is revoked automatically when their school assignment is removed or transferred. Notes they wrote remain in each teacher's loop, attributed to them, because those notes are part of that teacher's record. Conversations they marked private stay private: an incoming leader does not inherit them.
• A teacher leaves the school. Their loop stops appearing to school leaders once their assignment to that school ends. The record is retained for the school or district to handle under its own retention schedule.
• An account is deleted. That person's Loop access, read markers, and their own coaching record are deleted with the account.
• Keeping a copy. Any participant can download a conversation they can see, at any time, from within the Loop.

"Private" in PRISM means access-controlled, not legally confidential. Records created by public school employees in the course of their work may be subject to public records laws, records retention schedules, collective bargaining provisions, and legal discovery. PRISM controls who can read a record inside the platform; it cannot exempt a record from law. Users should follow their district's guidance on what belongs in a written record.

7. COPPA Compliance

For users under 13, we comply with the Children's Online Privacy Protection Act (COPPA). We only collect information necessary for educational purposes with proper school consent serving as parental consent.

8. Data Security

We implement appropriate security measures including:

• Encryption of data in transit and at rest
• Secure authentication through Clerk
• Role-based access controls
• Activity logging and monitoring
• Secure cloud infrastructure (Vercel and Neon)

9. Data Sharing

We do NOT:

• Sell student or teacher data
• Use data for advertising purposes
• Share data with third parties for non-educational purposes

We MAY share data:

• With authorized school personnel within your district
• With parents/guardians as permitted by FERPA
• With the service providers listed in section 12, who help us operate the platform (under strict confidentiality)
• When required by law or valid legal process

10. Data Retention

We retain educational records as long as necessary to provide our services and comply with legal obligations. Schools may request data deletion in accordance with their retention policies.

When a student leaves a school, PRISM archives the student's record instead of deleting it, so a student who returns keeps their history. Archived records are kept until the school or district asks us to delete them. When a school or district asks us in writing to delete student records, we delete them within a reasonable time, and no later than any deadline in the school's or district's agreement with us.

Leadership Loop entries are organized by school year and roll over each August 1. Past school years remain readable in the platform as a read-only record. Entries are kept for as long as the staff member remains in PRISM at that school; they are removed when the account is deleted, as described above. PRISM does not delete Loop records on a timer, because records subject to a retention schedule, a public records request, or litigation may not be destroyed. Districts should apply their own retention schedule, and any participant can download a copy of a conversation at any time.

Support and contact form messages are automatically purged 90 days after they are received, regardless of status. You may request early deletion of your support messages by contacting us at support@prismlearn.org.

11. Your Rights

You have the right to:

• Access your personal information
• Request corrections to inaccurate data
• Request deletion of your data (subject to legal requirements)
• Opt-out of optional features
• Receive a copy of your data in a portable format

12. Service Providers and Integrations

These services help us run PRISM. Each one receives only what it needs to do its job:

• Vercel: Hosts PRISM, and counts anonymous page views (Vercel Web Analytics)
• Neon: The database where PRISM's records are stored
• Clerk: Staff sign-in and accounts, including the Google connection a teacher authorizes
• Google Classroom: For roster synchronization (optional)
• Google Drive and Google Sheets: For files PRISM creates and spreadsheets a school links (optional)
• Pusher: Relays live updates between people working on the same page, such as a Learning Lab placement board or a team's TACA. Updates carry record identifiers and the content being edited
• Upstash: Limits how many requests can be made in a short time, using IP addresses
• Cloudflare Turnstile: Checks that a student and family portal sign-in comes from a person, not an automated program
• Resend: Sends and receives PRISM email through support@prismlearn.org, including support replies and notifications. Some notifications name a student, such as a request to move a student between Learning Lab rooms
• Common Standards Project: For educational standards data. No user or student information is sent to it

Each service has its own privacy policy. We only share the minimum necessary information with these services to provide functionality.

13. Cookies and Tracking

We use essential cookies for authentication and session management, including the 24-hour session cookie for the student and family portal. Our page view counts do not use cookies. We do not use tracking cookies for advertising or marketing purposes.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this policy. We encourage you to review this policy periodically. Continued use of the platform after changes constitutes acceptance of the updated policy.

15. Contact Information

For questions about this Privacy Policy or our data practices, please contact your school administrator or district technology coordinator.

Data Controller:
Ethan Unland
Email: support@prismlearn.org
Website: https://prismlearn.org