GRADIFY

Student Data Privacy

Last updated: June 4, 2026

GRADIFY does not sell student data.

GRADIFY Technologies Incorporated supports schools, districts, and students with college and career planning tools. This page summarizes how we handle student information and our commitments under applicable student-privacy laws.

Our commitments

GRADIFY makes the following commitments regarding student data:

We do not sell student personal information.
We do not use or disclose student data for targeted advertising, and we do not build advertising or non-educational profiles of students.
We use student data only to provide and improve the educational services authorized by the school, district, or program.
We use de-identified or aggregated data only for permitted purposes such as improving and securing the service, and we do not attempt to re-identify it.
We delete or return student data at the direction of the school or district, consistent with our agreements and applicable law.
We enter into data privacy agreements with schools and districts and will sign a district's data privacy agreement, including standard frameworks such as the SDPC National Data Privacy Agreement, where requested.

What student data includes

Depending on school configuration, student data may include name, school affiliation, grade level, career assessment results, planning activities, and related educational records entered by the student, parent, or authorized school staff.

How student data is used

Deliver career planning, reporting, and school-authorized educational features
Support administrators and counselors managing student progress
Maintain security, auditing, and platform reliability

FERPA and our role as a school official

When GRADIFY provides services to a school or district, we act as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), 34 C.F.R. § 99.31(a)(1), to the extent we access education records. In that capacity we: (i) perform an institutional service or function for which the school or district would otherwise use its own employees; (ii) are under the direct control of the school or district with respect to the use and maintenance of education records; and (iii) use education records only for the authorized educational purpose and do not re-disclose them except as permitted by FERPA and our agreement with the school or district.

State student data privacy laws

We design our handling of student data to meet applicable state student-data-privacy laws in the states where we operate, including laws modeled on the Student Online Personal Information Protection Act (SOPIPA) that restrict the use of K-12 student data for advertising, the sale of student data, and the creation of non-educational profiles. Where a state law grants students or parents additional rights, we honor those rights through the user's school or district.

Sharing

Student data is shared with the student's authorized school or district and contracted service providers that help operate GRADIFY under confidentiality and security obligations. GRADIFY does not sell student data to data brokers or unrelated third parties for advertising.

Children under 13

Where COPPA applies, we collect personal information from children under 13 only with school authorization for educational use, or with verifiable parental consent for uses outside the school-authorized educational context. We obtain separate verifiable parental consent before any non-integral disclosure of a child's personal information to a third party, and we never use children's data for targeted advertising. See our Privacy Policy for details on consent and parental rights.

Parent and school rights

Parents and authorized school officials may request review, correction, or deletion of student information according to school policies and applicable law. Contact your school administrator or GRADIFY at admin@gradify.io.

Security

We protect student data with a written security program that includes access controls, encryption in transit and at rest, monitoring, and administrative safeguards, and we require our service providers to maintain comparable protections. If we experience a security incident affecting student data, we will notify the affected school or district without undue delay and within the timeframe required by our agreement and applicable law, and we will cooperate in any required notifications.

Data retention and deletion

We retain student data only as long as needed to provide the authorized service or as required by a school agreement or law. When a school or district agreement ends, we delete or return the associated student data within 45 days of request, except where retention is required by law.