Privacy Policy

Version 1.0
Effective Date: August 11, 2026
Last Updated: August 11, 2026

4StudentLives, Inc. · 1967 E Sunshine Trl · Saint George, Utah 84790-1919 · legal@4studentlives.com

TABLE OF CONTENTS

PREFATORY STATEMENT

This Privacy Policy states how 4StudentLives, Inc. (“4StudentLives,” “we,” “us,” “our”) collects, uses, discloses, retains, secures, and deletes information in connection with the 4StudentLives multi-tenant software-as-a-service platform (the “Service”), the 4studentlives.com website, and our support services. It is written for the educational organization licensing the Service (each, a “Customer”) and the Authorized User it provisions with credentials. The Service is a professional tool licensed to educational organizations, not a consumer product; students do not register for, hold, or access accounts. As to all Personal Information relating to a student, including Education Records (“Student Data”), 4StudentLives processes solely as a service provider on the Customer’s behalf, and the Customer controls that data. This Privacy Policy is Document 2 of the 4StudentLives legal documentation suite, incorporated into and governed by the 4StudentLives Terms of Service, which with all Order Forms, addenda, exhibits, and incorporated policies constitutes the “Agreement.”

ARTICLE 1. SCOPE AND APPLICATION OF THIS PRIVACY POLICY

1.1 Coverage

Covered: the Service — all modules, applications, APIs, and Documentation, including Behavioral Threat Assessments, Suicide Risk Assessments, Student Profiles, Student Safety Plans, Case Management, File Storage, AI-assisted summaries, optical character recognition (“OCR”), Audit Logs, notifications, role-based access controls, and the County / District / School hierarchy — plus the marketing website, support, and business contact information. Not covered: the Customer’s own notices and data governance; linked third-party sites; exported information; our personnel data; and data governed by the Health Insurance Portability and Accountability Act (“HIPAA”) absent a signed business associate agreement, most K–12 school records being Education Records under the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and 34 C.F.R. Part 99 (“FERPA”), excluded from protected health information at 45 C.F.R. § 160.103. A more protective executed Data Privacy Agreement, student data privacy addendum, or National Data Privacy Agreement (“NDPA”) exhibit controls (Section 7.5).

1.2 Roles of the Parties and Key Terms

The Customer determines the purposes and means of processing Customer Data — the “business” or “controller” under United States statutes. 4StudentLives processes on the Customer’s behalf: a “service provider” under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (Cal. Civ. Code §§ 1798.100 et seq.) (the “CCPA”), a “processor” under the European Union General Data Protection Regulation (the “GDPR”), and a school official under FERPA (Article 7); we are a controller only for business contact information and our own account and support records, never Student Data. Customer Data is everything submitted to or generated within the Service by or for the Customer or its Authorized Users, including Student Data and AI Output. A Security Incident is confirmed unauthorized access to, acquisition of, disclosure of, loss of, or destruction of Customer Data in our control, excluding unsuccessful attempts and routine events such as pings, port scans, and failed logins. The Acceptable Use Policy governs conduct; the AI Usage & Human Review Policy governs AI Features.

ARTICLE 2. OUR ROLE: SERVICE PROVIDER TO EDUCATIONAL ORGANIZATIONS

2.1 Customer Control and Documented Instructions

The Customer owns all Customer Data; we hold it as custodian solely to deliver the Service. The Customer decides which modules, fields, students, staff, roles, hierarchy scope, uploads, AI Features, and notifications are configured, how long records are kept during the Term, and when Customer Data is exported or deleted. We process only on the Customer’s documented instructions — the Agreement, its configuration, Authorized User actions, and written instructions from its administrative contact — and will inform the Customer rather than comply if an instruction would violate law. We do not process Customer Data for our own purposes, disclose it outside the direct business relationship, or combine it with other sources except as the CCPA expressly permits a service provider.

2.2 Where to Direct a Parent or Student Request

If you are a parent, guardian, or eligible student and wish to inspect, review, obtain a copy of, correct, amend, restrict, or delete a student’s records, direct your request to the school or school district. FERPA vests those rights against the educational agency, not a vendor acting as a school official; we hold no enrollment, custody, or guardianship records and cannot verify identity or authority; and disclosure to an unverified requester would itself be an unauthorized disclosure. If contacted, we decline, redirect the requester, and where lawful notify the Customer.

2.3 Our Assistance to the Customer

At the Customer’s request, without charge for reasonable requests, we assist it in responding to parents, guardians, and eligible students: producing a student’s Student Data in a machine-readable format; producing the relevant Audit Log; executing corrections, amendments, or deletions it directs, subject to Section 12.3; confirming the categories of Student Data maintained and the Subprocessors that process it; and supplying documentation for its record of disclosures under 34 C.F.R. § 99.32.

2.4 What We Will Not Do

4StudentLives will not, at any time: sell Student Data or any other Customer Data; use Student Data for targeted or behavioral advertising or to build an advertising profile; use Customer Data to train, fine-tune, or improve any general-purpose or foundation artificial intelligence model; disclose Education Records except as the Customer directs, as FERPA permits, or as law requires; use Student Data beyond providing the Service and the purposes in Article 5; or assert any continuing right in Customer Data after the Agreement ends, beyond completing deletion and retaining de-identified data under Section 5.2.

ARTICLE 3. CATEGORIES OF INFORMATION WE COLLECT

3.1 Information Inventory

Table A — information in the Service, all Customer-configured and Customer-populated. We obtain Student Data from no source other than the Customer. Any threat level, risk level, or disposition is the Customer team’s professional judgment, never generated, scored, validated, or influenced by us or by AI Features.

Table B — information we hold as a controller, kept in our business systems, never in a Customer tenant and never combined with Student Data: support tickets, correspondence, and attachments (Authorized Users should not include Student Data in tickets; where included it is treated as Customer Data); and website contact, demonstration, newsletter, and event forms, from which a subscriber may unsubscribe at any time.

3.2 Cookies and Similar Technologies

Unqualified: no advertising cookies; no third-party ad networks, retargeting, or conversion tags; no cross-site tracking; no sale of personal information and no sharing for cross-context behavioral advertising as defined at Cal. Civ. Code § 1798.140(ad) and § 1798.140(ah). We do not conduct the cross-site tracking a Do Not Track signal is meant to stop. Global Privacy Control signals are honored as a matter of policy: though no sale or sharing occurs and no statute obliges us to act on an opt-out signal, we treat one as an instruction to suppress non-essential first-party operational analytics for that browser. Cookie choices appear in Section 15.3.

3.3 Information We Do Not Collect

(a) No Student Data directly from students — students hold no accounts and never interact with the Service. (b) No biometric identifiers — no fingerprints, palm prints, voiceprints, retina or iris scans, hand or face geometry, or gait, as those terms are used in state biometric privacy statutes. (c) No facial recognition — no face detection for identification, matching, clustering, or emotion inference. (d) No social media monitoring or web scanning of student accounts — no crawling, monitoring, feed purchasing, or surveillance of social, messaging, or gaming platforms or the open web for content about any student; where a Customer’s staff independently reviews public material and records it, the collection was the Customer’s act. (e) No precise geolocation — no GPS, Bluetooth beacon, or Wi-Fi triangulation; an IP address is not precise geolocation and is not used to derive it. (f) No data purchased from data brokers or appended from a list vendor. (g) No advertising profiles — no audience segments, lookalike models, interest categories, or behavioral profiles. (h) No tracking of students across websites or applications — nothing deployed on district websites, learning management systems, or student devices. (i) No payment card data. (j) No HIPAA-regulated protected health information knowingly maintained absent a signed business associate agreement.

ARTICLE 4. AI PROCESSING OF INFORMATION

4.1 When AI Processing Occurs

AI processing occurs only in response to an act of an Authorized User — either affirmative invocation of an AI Feature on a specific record or file, or the upload or creation of a record where a Customer Administrator has enabled automatic OCR or automatic categorization for the tenant. There is no scheduled processing, no proactive scanning of a tenant, and no analysis of Student Data absent such an act. Only the selected content is transmitted over an encrypted channel to Google Cloud Vertex AI and processed by a Google Gemini model in United States regions (Section 10.1).

4.2 Assistive-Only Posture

AI Features may summarize entered or uploaded information; extract text through OCR; assist with drafting and organization; categorize or tag for navigation; and provide search assistance by interpreting a natural-language query to retrieve responsive passages within records the requesting Authorized User may already access, without ranking students, computing similarity between students, or surfacing any record the user may not see. AI Features never make disciplinary decisions; determine, score, assign, or validate threat or risk levels; make safety or intervention decisions; recommend or trigger law enforcement contact, removal from school, discipline, or hospitalization; replace professional judgment; or operate autonomously. The Service exposes no AI-generated score, level, tier, ranking, or recommendation for any student (Article 16).

4.3 Training, Ephemerality, Human Review, and Disabling

Customer Data is not used to train, fine-tune, or improve any general-purpose or foundation model — not by us, not by our AI provider, which is contractually directed not to and whose enterprise Google Cloud configuration does not make prompts or responses available for foundation model training, and not by any Subprocessor. Content is processed ephemerally and is not retained as a persistent corpus; AI Output is stored in the tenant as Customer Data under the same access, logging, retention, and deletion commitments. Every AI Output requires human review before it is relied upon or acted upon — a contractual obligation under the Agreement and the AI Usage & Human Review Policy; the Authorized User shall read it in full, compare it against the source, correct any inaccuracy, and take professional responsibility, and invocation is logged. AI Features may be disabled at the Customer’s direction, in whole or by feature, for the tenant or parts of the hierarchy, by notice to legal@4studentlives.com; where AI Features are disabled, no Customer Data from that tenant is transmitted to the AI provider.

4.4 OCR and Accuracy Limitations

OCR converts an image or scanned document into machine-readable text stored with the file as Customer Data and performs no identification of persons, no facial analysis, and no biometric processing of any kind. Handwriting, poor scans, and unusual layouts reduce accuracy, and AI Output may be inaccurate, incomplete, or fabricated (“hallucination”); the human review requirement in Section 4.3 is therefore absolute.

ARTICLE 5. HOW WE USE INFORMATION

5.1 Purposes of Use

Information is used only for these purposes; Student Data is never repurposed.

5.2 Aggregated and De-Identified Data

Data is de-identified only where all direct identifiers are removed or irreversibly transformed and it cannot reasonably be used, alone or with information reasonably available, to identify or link to any student, guardian, Authorized User, or individual Customer, with aggregation thresholds preventing small cell sizes from isolating an individual. Free-text narrative content — case narratives, assessment responses, safety plan content, and team notes — is not used for improvement purposes in any form. We shall not re-identify, permit any third party to do so, or use the data other than in de-identified form; we publicly commit to that and bind any recipient identically, consistent with Cal. Civ. Code § 1798.140(m). We do not sell or license de-identified data or publish district-identifiable benchmarks without written authorization.

5.3 Prohibited Uses

Without exception: never for advertising — no targeted, behavioral, or contextual advertising against student information, no retargeting, no attribution for any advertiser; never for student profiling for non-educational purposes — no cross-Customer profile, no identity graph, no risk index; never sold — no sale of Customer Data, Student Data, or Personal Information and no disclosure for monetary or other valuable consideration, with no opt-out because there is nothing to opt out of; never for general-purpose model training; never disclosed for a third party’s independent purposes (Section 10.2); and never used to make automated decisions about individuals (Article 16).

ARTICLE 6. LEGAL BASES AND AUTHORITY FOR PROCESSING

6.1 Educational Organizations and Business Contacts

The authority for processing Student Data is the Customer’s own authority, exercised through 4StudentLives as a school official designated under 34 C.F.R. § 99.31(a)(1)(i)(B) on the conditions in Article 7; the Agreement supplies the documented instructions and establishes direct control. We obtain no separate consent, having no relationship with any student or parent; where consent is legally required, obtaining it is the Customer’s responsibility (Article 8). For the information in Table B of Section 3.1 we act as a controller, on the bases of contract performance or steps taken at the individual’s request; legitimate interests in security, fraud prevention, service improvement, and business communications, subject to objection or unsubscribe; consent where required; and legal obligations for tax, accounting, and retention.

6.2 GDPR and UK GDPR Mapping

The Service is designed, marketed, and hosted for United States educational organizations and is not offered generally in the European Economic Area or the United Kingdom; limited business contact data may nonetheless fall within Regulation (EU) 2016/679 (the “GDPR”) or the UK General Data Protection Regulation as incorporated by the European Union (Withdrawal) Act 2018 (the “UK GDPR”). The lawful bases are GDPR Article 6(1)(b) for account provisioning and administration and for responding to an inquiry or support request; GDPR Article 6(1)(f) for security, fraud prevention, Audit Logging, de-identified improvement under Section 5.2, business communications, and legal claims; GDPR Article 6(1)(a) for newsletter subscription and non-essential analytics; and GDPR Article 6(1)(c) for tax, accounting, and retention obligations. As to Customer Data we would be a processor under GDPR Article 4(8), and on request will enter a data processing agreement with the terms required by GDPR Article 28(3), including documented instructions only, personnel confidentiality, GDPR Article 32 security measures, the Subprocessor conditions of GDPR Article 28(2) and 28(4), assistance with data subject rights and GDPR Articles 32 through 36, deletion or return, and audit rights. Transfers are addressed in Article 13.

ARTICLE 7. FERPA AND STUDENT DATA PRIVACY

7.1 School Official Designation and Direct Control

4StudentLives operates under the school official exception at 34 C.F.R. § 99.31(a)(1)(i)(B): it performs an institutional service the Customer would otherwise perform using its own employees; it is under the direct control of the Customer as to the use and maintenance of Education Records; and it is subject to 34 C.F.R. § 99.33(a). The Customer must separately use reasonable methods, as 34 C.F.R. § 99.31(a)(1)(ii) requires of it, to limit our access to records in which we have a legitimate educational interest. Control is exercised contractually, by configuration, by access control (only the Customer provisions accounts), over personnel (access only as necessary for support, Security Incident investigation, an authorized change, or legal compliance — minimum necessary, least privilege, logged), by audit of the Audit Log at any time, and at termination (Article 12). This framing governs throughout; other Articles cross-reference it.

7.2 Customer Obligations, Redisclosure, and Parent Rights

Annual notification of FERPA rights under 34 C.F.R. § 99.7, including the criteria for school-official status and legitimate educational interest, is the Customer’s obligation, not ours. Under 34 C.F.R. § 99.33(a) Education Records may not be redisclosed without prior consent except as authorized and on the disclosing agency’s behalf; we redisclose only as the Customer directs, as FERPA permits on its behalf, or as law requires (Section 9.2); the same limitation binds every Subprocessor (Section 10.2); and we supply what the Customer needs for its record of disclosures under 34 C.F.R. § 99.32.

Parent and eligible student rights run against the school or district: to inspect and review within forty-five (45) days (34 C.F.R. § 99.10), without search or retrieval fees (§ 99.11) and limited to the portion concerning that student (§ 99.12); to seek amendment (§ 99.20), with a hearing before a disinterested official and a written decision on the evidence (§§ 99.21, 99.22), after which a statement of disagreement may be placed in and disclosed with the record; to consent to disclosures FERPA does not otherwise permit; and to complain to the Student Privacy Policy Office, U.S. Department of Education, 400 Maryland Avenue SW, Washington, DC 20202-8520. We adjudicate none of them and do not respond to parents or students directly; we assist the Customer under Section 2.3.

Under the Protection of Pupil Rights Amendment, 20 U.S.C. § 1232h (“PPRA”), survey, physical-examination, and marketing-collection duties run to the local educational agency; we administer no surveys and collect nothing from students. Records concerning a student with a disability are also subject to the confidentiality provisions of the Individuals with Disabilities Education Act (“IDEA”) at 20 U.S.C. § 1417(c) and 34 C.F.R. §§ 300.610 through 300.627, whose duties rest with the Customer; we support compliance with role-based access controls, Audit Logs, and deletion.

7.3 State Student Data Privacy Statutes

Additional or more specific state requirements are addressed in the Customer’s Data Privacy Agreement.

7.4 Core Commitments

Across every jurisdiction and Customer, with no opt-out because there is nothing to opt out of: no sale of Student Data for monetary or other valuable consideration; no targeted advertising; no profiling to amass a student profile except in furtherance of the K–12 school purposes the Customer defines; no model training; deletion on request (Article 12); reasonable security (Article 11); and contractual flow-down to every Subprocessor (Section 10.2).

7.5 Order of Precedence

Where 4StudentLives and a Customer have executed a Data Privacy Agreement, student data privacy addendum, or comparable exhibit — including an NDPA or state-specific exhibit — the executed instrument controls as to that Customer where it is more protective of Student Data. Order of precedence: (1) an executed Data Privacy Agreement or addendum; (2) an executed Order Form; (3) the Terms of Service; (4) incorporated policies, including this Privacy Policy.

ARTICLE 8. CHILDREN’S PRIVACY

8.1 Not Directed to Children; No Direct Collection

The Service is a professional case management tool used by credentialed adult staff; it is not directed to children. Students do not register for, hold, or access accounts, no student authenticates to, submits a form in, or uploads a file to the Service, and 4StudentLives collects no information directly from any child — a structural fact, not a configurable policy. Information somehow collected from a child would be promptly deleted and the Customer notified.

8.2 School Consent Under COPPA and Its Limits

The Children’s Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the Children’s Online Privacy Protection Rule at 16 C.F.R. Part 312, require verifiable parental consent from operators of services directed to children under thirteen and operators with actual knowledge of collecting personal information from a child under thirteen; the Service is neither. Where a COPPA question arises, FTC guidance provides that a school may consent on parents’ behalf where the operator collects personal information from students solely for the use and benefit of the school and for no other commercial purpose, the school having reviewed the operator’s practices and given parents information about it, direct parental notice remaining best practice and in many states a legal requirement. Where any parental consent is required, obtaining it is the Customer’s responsibility. School consent is limited: it does not displace FERPA and cannot authorize a disclosure FERPA would prohibit; it does not displace state law, several states imposing more demanding notice, consent, contract-posting, or opt-out requirements that run to the Customer (Section 7.3); it is limited to the educational purpose; and it does not cover students above age thresholds in other statutes, our protections applying to all Student Data regardless of age.

ARTICLE 9. DISCLOSURE OF INFORMATION

9.1 Categories of Disclosure

We disclose only in these categories, and as stated in Section 5.3 and Section 7.4 we do not sell Personal Information or disclose it for any third party’s independent purposes: within the Customer’s own organizational hierarchy, according to the role and County / District / School configuration the Customer establishes — these visibility decisions are the Customer’s determination of which of its officials have a legitimate educational interest in which records; to Subprocessors under written contract, only as necessary to perform services on our behalf (Section 10.1, Section 10.2); to professional advisors under a duty of confidentiality, never including bulk access to Customer Data; at the Customer’s express written direction, to third parties it designates, the Customer being responsible for the lawfulness of that disclosure; and in a corporate transaction under Section 9.3.

9.2 Response to Lawful Process

We may disclose where required by law, regulation, legal process, or enforceable governmental request. We evaluate each demand for validity, service, and scope and object to demands that are overbroad, unauthorized, or defective; notify the affected Customer promptly and, where practicable, before disclosing, unless legally prohibited, in which case as soon as the prohibition lapses; redirect demands for Education Records to the Customer where lawful, because 34 C.F.R. § 99.31(a)(9) imposes duties on the educational agency — including a reasonable effort to notify the parent or eligible student in advance of compliance, except in specified law enforcement and grand jury circumstances — that only the Customer can perform; disclose only the minimum the valid demand reaches; and log the disclosure under 34 C.F.R. § 99.32.

9.3 Corporate Transactions

In a merger, acquisition, reorganization, financing, sale of assets, or bankruptcy, information including Customer Data may be transferred or disclosed as part of the transaction or of diligence under confidentiality obligations. Any successor is bound by this Privacy Policy and the Agreement, including the FERPA school official obligations, the redisclosure limitations of 34 C.F.R. § 99.33(a), the no-sale and no-advertising commitments, and the Customer’s ownership of Customer Data — Customer Data is not an asset that may be sold free of these obligations. Affected Customers receive notice with enough time to exercise any right, including termination and deletion.

9.4 Health or Safety Emergencies

FERPA permits an educational agency to disclose personally identifiable information from Education Records without consent to appropriate parties in an emergency where knowledge of the information is necessary to protect health or safety, only where there is an articulable and significant threat and only for the period of the emergency. 34 C.F.R. § 99.36. That determination is the Customer’s to make. 4StudentLives does not make it. Where the Customer determines disclosure is warranted, it exports or directs us to assist, and we record the disclosure for its § 99.32(a)(5) obligation. The Service is not an emergency notification system and is not monitored by 4StudentLives for emergencies. In an emergency, call 911.

ARTICLE 10. SUBPROCESSORS AND THIRD-PARTY SERVICE PROVIDERS

10.1 Current Subprocessors

Current as of the Effective Date; each processes Customer Data only in the United States.

Notifications are minimized — they state that action is required and direct the recipient to log in, with no student names, assessment content, or case narratives, so the SMS and email Subprocessors receive no Student Data. Where AI Features are disabled under Section 4.3, no Customer Data from that tenant reaches the AI Subprocessor.

10.2 Diligence and Contractual Flow-Down

Diligence before engagement covers independent security attestations, such as a SOC 2 Type II report or ISO/IEC 27001 certification, where available; security architecture, encryption, access controls, and personnel screening; subprocessor management, data location, and incident history; willingness to accept FERPA flow-down; and continuity and exit. Subprocessors are reassessed periodically. Each is bound by written agreement to obligations no less protective than those we owe the Customer: processing only for us, on our instructions; the FERPA redisclosure limitation of 34 C.F.R. § 99.33(a); no sale, rental, targeted advertising, or amassing of a student profile; no use to train, fine-tune, or improve any general-purpose or foundation model; encryption in transit and at rest; personnel confidentiality; equivalent flow-down; Security Incident notice permitting us to meet the seventy-two (72) hour commitment in Section 11.3; audit cooperation; and deletion or return. We remain responsible to the Customer for our Subprocessors’ performance as if we performed the services ourselves.

10.3 Change Notice, Objection, and the Current List

Before engaging a new Subprocessor or materially expanding an existing one’s processing, we give thirty (30) days’ advance notice to the Customer’s administrative contact and update the published list. The Customer may object in writing within that period on reasonable data-protection grounds to legal@4studentlives.com. We will work in good faith to offer a commercially reasonable alternative; if none is available, the objection, its resolution, and the resulting termination and refund mechanics are governed by the Terms of Service, and the Customer may require export and deletion under Article 12. Emergency substitution may precede notice, with prompt explanation and the objection right applying retrospectively. The current list is available at legal@4studentlives.com.

ARTICLE 11. DATA SECURITY

Our information security program is informed by NIST Special Publication 800-53, the NIST Cybersecurity Framework, and the OWASP Top 10 and is designed to satisfy the “reasonable security procedures and practices” standard of SOPIPA, SOPPA, Cal. Civ. Code § 1798.81.5, and comparable statutes.

11.1 Administrative, Technical, and Physical Safeguards

Administrative: written security, access control, change management, incident response, continuity, and vendor policies reviewed at least annually; least-privilege access, approved and periodically reviewed, revoked on role change or separation, with no standing access to Customer tenants; background screening and surviving confidentiality obligations; security training at hire and annually covering FERPA and student data privacy; vendor flow-down under Section 10.2; change control with peer review and rollback; and periodic risk assessment.

Technical: TLS 1.2 or higher in transit; AES-256 or equivalent at rest for databases, files, and backups with Google Cloud key management; MFA available to Authorized Users, requirable by the Customer, and mandatory for all 4StudentLives personnel with production access; server-side authorization of every request against role and hierarchy scope; tenant isolation at the query and authorization layers; central logging and alerting on anomalous authentication, unusual exports, and privilege escalation; no plaintext passwords, only salted hashes, with short-lived revocable sessions; production in Google Cloud Platform United States regions behind firewalling and restricted administrative paths; endpoint encryption and managed patching; and encrypted backups tested by restoration.

Physical: Google Cloud Platform United States data centers with perimeter controls, multi-factor physical access authorization, surveillance, intrusion detection, and controlled media disposal, subject to independent audit. Our personnel have no physical access and we keep no on-premises servers holding Customer Data.

11.2 Vulnerability Management, Testing, and Secure Development

Dependencies, images, and infrastructure configuration are scanned recurrently, triaged by severity, and remediated on defined timelines, critical findings first. We will engage qualified independent third parties to conduct penetration testing of the Service on a recurring basis, not less frequently than annually, and will remediate validated findings by severity; where a test has been completed, a summary or attestation is available under confidentiality at legal@4studentlives.com. Development uses peer review, static analysis, secrets management, separated environments, de-identified test data, and the OWASP Top 10 baseline; patches follow a defined cadence, out-of-cycle for critical fixes. Good-faith vulnerability reports are welcome at legal@4studentlives.com.

11.3 Incident Response

We maintain and exercise a written incident response plan with defined roles, severity classification, escalation, forensic preservation, and post-incident review.

Notification. Without undue delay and in any event within seventy-two (72) hours of confirming a Security Incident affecting Customer Data, we notify the affected Customer’s administrative and security contacts, stating as known and supplementing thereafter the nature and scope, the categories and approximate volume affected, the individuals affected to the extent identifiable, the dates of incident and discovery, containment and remediation, and a point of contact, and we cooperate with the Customer’s own breach notification obligations.

Where a state statute imposes a shorter or additional requirement we comply with it in addition. The principal state deadlines applicable to a third-party contractor — seven (7) calendar days under 8 N.Y.C.R.R. § 121.10, thirty (30) days under 105 ILCS 85/, and thirty (30) days (sixty (60) days for directory information, student records, and student-generated content) under Conn. Gen. Stat. § 10-234dd(b) — are each longer than the seventy-two (72) hour commitment made in this Section, which therefore satisfies them. Consistent with Section 1.2, unsuccessful attempts and routine events are not Security Incidents.

11.4 Customer Responsibilities

The Customer, not 4StudentLives, must provision accounts only to individuals with a legitimate educational interest and deprovision promptly; configure roles and hierarchy scope to least privilege; require MFA and secure its identity provider; instruct Authorized Users not to share credentials or export to unmanaged locations; control uploads consistent with Section 3.1 and the Acceptable Use Policy; secure its own devices and networks; review Audit Logs for inappropriate access; and report suspected compromise to legal@4studentlives.com.

11.5 No Guarantee of Absolute Security

No system, product, or organization is one hundred percent secure, and 4StudentLives cannot and does not guarantee absolute security. These safeguards reduce risk to a level appropriate to the sensitivity of the data; they do not eliminate it. Transmission over the internet, storage on any system, and human handling carry residual risk. Nothing here warrants that Customer Data will never be subject to unauthorized access, disclosure, alteration, or destruction; allocation of risk and limitations of liability are set out in the Terms of Service.

ARTICLE 12. DATA RETENTION AND DELETION

12.1 Retention Principles and Schedule

Information is retained only as long as necessary for the purposes in Article 5, as the Customer directs, or as law requires. During the Term, Customer Data is retained as long as the Customer maintains it, retention of Education Records being governed by the Customer’s records schedule, state law, and litigation holds.

12.2 Export, Deletion, Backups, and Legal Hold

Export. Customer Data may be exported during the Term and for ninety (90) days after expiration or termination, in commonly used, machine-readable formats, with reasonable assistance for migration-scale exports. Deletion. After that window we delete or de-identify Customer Data from active production systems within thirty (30) days of written request to legal@4studentlives.com, or in the ordinary course, certifying categories and completion date on request; in-Term deletion requests are executed on the same commitment. Backups. Backups are point-in-time images overwritten or expiring within a period not to exceed twelve (12) months; single-record deletion from historical media is not feasible without compromising the backup set. Data persisting in backups is not restored to production, is not used, remains encrypted, and remains subject to the Agreement until expiry. Legal hold. Information subject to a litigation hold, subpoena, court order, or regulatory demand is retained for the duration, segregated, protected under Article 11, notified to the Customer where lawful under Section 9.2, and deleted on release.

12.3 Deletion Within the Service During the Term

Authorized Users with the appropriate role may delete records as configured, subject to two rules. Audit Log integrity: deleting a record does not delete the Audit Log entries showing that it existed and who accessed, modified, or deleted it; entries are append-only and not editable or individually erasable by anyone, including 4StudentLives personnel, and are removed only in tenant-level deletion under Section 12.1 and Section 12.2. Cascading deletion: deleting a student record extends to associated cases, assessments, safety plans, tasks, uploaded files, OCR text, and AI Output.

ARTICLE 13. INTERNATIONAL USERS AND DATA TRANSFERS

13.1 United States Hosting and Access From Abroad

4StudentLives is a Delaware corporation with its principal place of business in Saint George, Utah, and the Service is licensed to United States K–12 educational organizations. Customer Data is stored and processed in Google Cloud Platform regions located in the United States, as is all Subprocessor processing under Section 10.1; no data residency outside the United States is offered. Access from abroad — while traveling, or from a Department of Defense Education Activity or comparable overseas school of a United States Customer — transfers authentication, technical, and viewed or entered Customer Data to the United States; those individuals act on their own initiative and are responsible for local law. We do not offer the Service generally in the European Economic Area or the United Kingdom or monitor behavior there.

13.2 Transfer Mechanisms

Where the GDPR or UK GDPR applies to the limited business contact data described in Section 6.2 and a transfer to the United States occurs, we rely on the Standard Contractual Clauses adopted in European Commission Implementing Decision (EU) 2021/914, Module Two where we process on a Customer’s behalf and Module One for business contact data; the UK International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018, or the UK International Data Transfer Agreement; the Standard Contractual Clauses with the adaptations recognized by the Swiss Federal Data Protection and Information Commissioner; and supplementary measures — encryption under Article 11, least privilege, minimization, and notice or challenge of governmental demands under Section 9.2. Execution copies are available at legal@4studentlives.com.

13.3 Data Subject Rights Under the GDPR and UK GDPR

Where either applies to information we process as a controller, the individual may exercise at legal@4studentlives.com: access under GDPR Article 15; rectification; erasure under GDPR Article 17, subject to its exceptions; restriction under GDPR Article 18; portability; objection to processing based on legitimate interests, including profiling, and an unconditional objection to direct marketing; withdrawal of consent; and complaint to a supervisory authority or, in the United Kingdom, the Information Commissioner’s Office. Where we process as a processor, requests go to the Customer as controller and we assist under Section 2.3. We respond within one month, extendable by two months with notice.

ARTICLE 14. CALIFORNIA PRIVACY RIGHTS AND OTHER STATE PRIVACY LAWS

14.1 Service Provider Status; No Sale, No Sharing

To the extent a Customer is a “business” subject to the CCPA, 4StudentLives is that Customer’s “service provider” under Cal. Civ. Code § 1798.140(ag), on a written contract satisfying § 1798.140(ag)(1) and 11 C.C.R. §§ 7050–7053. We process personal information only for the business purposes specified in the Agreement; do not retain, use, or disclose it outside the direct business relationship; do not sell or share it; do not combine it with information from other sources except as § 1798.140(ag)(1)(D) permits; provide the level of privacy protection the CCPA requires of a business; will notify the Customer if we can no longer meet those obligations; and assist with verifiable consumer requests under Section 2.3. A request concerning a student’s information goes to the Customer, not to us. Most Customers, as public agencies or nonprofits, are not themselves “businesses” subject to the CCPA; their obligations arise under FERPA and state student privacy law (Article 7).

4StudentLives does not sell personal information and does not share personal information for cross-context behavioral advertising as defined at Cal. Civ. Code § 1798.140(ad) and § 1798.140(ah), and has not in the preceding twelve (12) months; nor do we sell or share the personal information of consumers under sixteen (16), which cannot arise because students hold no accounts. With no sale or sharing there is no “Do Not Sell or Share My Personal Information” mechanism to operate; Global Privacy Control signals are handled under Section 3.2.

14.2 Categories of Personal Information Collected in the Preceding Twelve Months

For our own business contacts and website visitors, mapped to Cal. Civ. Code § 1798.140(v); sources are the individual or the Customer, and business-purpose disclosures are limited to the Subprocessors in Section 10.1 and professional advisors. Rows (J) and (L) reflect Student Data held solely as a service provider, not as a business.

Sensitive personal information is used only as Cal. Civ. Code § 1798.121(d) and 11 C.C.R. § 7027(m) permit and never to infer characteristics about any individual; the right to limit therefore requires no limitation mechanism.

14.3 California Rights, Verification, and Authorized Agents

A California resident whose personal information we process as a business — business contacts and website visitors, not students — may exercise the rights to know categories, sources, purposes, and recipients and to obtain specific pieces for the preceding twelve (12) months; to access; to delete, subject to Cal. Civ. Code § 1798.105(d); to correct; to opt out of sale or sharing, of which there is none; to limit sensitive personal information, which we already limit; to non-discrimination; and to no retaliation. Requests go to legal@4studentlives.com, subject line “California Privacy Request.” We verify proportionately under 11 C.C.R. § 7060 — generally two matching data points for categories, three plus a signed declaration under penalty of perjury for specific pieces or sensitive deletions. We confirm receipt within ten (10) business days and respond within forty-five (45) calendar days, extendable by forty-five (45) days with notice. An authorized agent must supply written permission signed by the individual, who must verify identity, unless the agent holds a power of attorney under Cal. Prob. Code §§ 4000 through 4465. Requests concerning a student’s information receive no substantive response — the requester is directed to the school or district (Section 2.2).

14.4 Shine the Light and the California Minor Eraser Law

Cal. Civ. Code § 1798.83 lets California residents with an established business relationship ask annually about personal information disclosed to third parties for those parties’ direct marketing purposes. 4StudentLives makes no such disclosures and has made none; confirmation may be requested at legal@4studentlives.com, subject line “Shine the Light Request.” Cal. Bus. & Prof. Code § 22581 lets a registered minor user remove content the minor posted on services directed to minors. That right has no application here because minors do not register for, hold, or access accounts and cannot post content (Section 3.3(a), Section 8.1); requests about a student’s records go to the school or district under Section 2.2 and Section 7.2.

14.5 SOPIPA and AB 1584 Compliance for Student Data

For Student Data the governing California requirements are SOPIPA (Cal. Bus. & Prof. Code §§ 22584–22585) and Cal. Educ. Code § 49073.1 (AB 1584), described in Section 7.3. Pupil records remain the property of and under the control of the local educational agency; parents and pupils review and correct through that agency; and we maintain reasonable security, use pupil records for no purpose beyond the contract, neither advertise nor amass a profile except for K–12 school purposes, do not sell or rent covered information, and delete it at the agency’s direction under Article 12.

14.6 Other State Comprehensive Privacy Laws

The Virginia Consumer Data Protection Act (Va. Code Ann. §§ 59.1-575 et seq.), Colorado Privacy Act (Colo. Rev. Stat. §§ 6-1-1301 et seq.), Connecticut Data Privacy Act (Conn. Gen. Stat. §§ 42-515 et seq.), Utah Consumer Privacy Act (Utah Code Ann. §§ 13-61-101 et seq.), and Texas Data Privacy and Security Act (Tex. Bus. & Com. Code §§ 541.001 et seq.) each exempt data regulated by FERPA, several also exempting nonprofits, higher education, or governmental entities; because Student Data here consists of Education Records held for educational agencies, FERPA and the statutes in Section 7.3 govern instead. Each distinguishes controller from processor, and as to Customer Data 4StudentLives is a processor in every one, requests going to the Customer as controller with our assistance under Section 2.3. Where we act as a controller for business contact information, residents may exercise access, correction, deletion, portability, and opt-out rights at legal@4studentlives.com; because we do not engage in targeted advertising, sell personal data, or conduct profiling producing legal or similarly significant effects (Section 5.3, Article 16), those opt-outs have no operative effect. Where an appeal is provided, as in Virginia, Colorado, Connecticut, and Texas, we explain the process and respond within the statutory period.

ARTICLE 15. YOUR CHOICES AND RIGHTS

15.1 Account and Profile Updates

An Authorized User may update display name formatting, telephone and mobile number, time zone, and language within the Service. Fields establishing identity, affiliation, or authorization — work email, role, school and district, account status — determine what records the user may access and are controlled by the Customer’s administrators. Inaccuracies may be reported to legal@4studentlives.com.

15.2 Email and SMS Notification Choices

Operational and transactional email notifications are part of the licensed Service and follow the Customer’s configuration; an individual cannot unilaterally disable them — that requires the Customer’s administrator, because a notification that a safety-related task is due is an operational control, not a marketing message. Security and account notices cannot be disabled by anyone. Marketing communications may be declined by unsubscribe link or at legal@4studentlives.com, honored within ten (10) business days consistent with the CAN-SPAM Act, 15 U.S.C. §§ 7701–7713. SMS is operational and transactional only; the Customer is responsible for a lawful basis for the numbers it enrolls. A recipient may opt out by replying STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT, or HELP for assistance; message and data rates may apply. In an emergency, call 911.

15.3 Cookie Choices

Cookies may be blocked, restricted, or deleted through browser settings, with two consequences: blocking strictly necessary, authentication, or session cookies prevents the Service from functioning, because an authenticated session cannot be maintained without them; and blocking preference cookies causes interface choices to be forgotten. As stated in Section 3.2, a Global Privacy Control signal suppresses non-essential first-party operational analytics for that browser, and there are no advertising cookies, ad networks, or cross-site tracking technologies to disable.

15.4 All Student Data Rights Requests Go to the Customer

Every request concerning a student’s information — to inspect, review, obtain a copy of, amend, correct, restrict, or delete it — must be directed to the school or school district, not to 4StudentLives. The reasons are in Section 2.2, the FERPA rights and procedures in Section 7.2, and our assistance to the Customer in Section 2.3.

ARTICLE 16. AUTOMATED DECISION-MAKING AND PROFILING

16.1 No Automated Decision-Making Producing Legal or Similarly Significant Effects

The Service does not engage in automated decision-making, including profiling, that produces legal effects concerning any individual or that similarly significantly affects any individual. No feature makes, recommends, or triggers a decision about a student’s discipline, placement, enrollment, removal, referral, services, or access to educational opportunity, or about an Authorized User’s employment. Every consequential determination recorded — a threat level, a risk level, a disposition, an intervention — is made by human beings on the Customer’s multidisciplinary team and recorded after the fact. Profiling opt-outs under state privacy statutes, and GDPR Article 22, therefore have no operative application.

16.2 No Algorithmic Scoring or Ranking of Students

No algorithm, model, or AI Feature of the Service scores, ranks, rates, tiers, flags, sorts by risk, or otherwise evaluates any student. Where a Customer configures an assessment instrument specifying a scoring construct, the Service performs only the deterministic arithmetic that instrument prescribes, applied to the entries the Customer’s own team makes; we supply no scoring logic, and no AI Feature contributes to, adjusts, validates, or interprets any score. There is no risk score, no predictive model, no early-warning algorithm, no anomaly detection on student records, and no automated escalation. Where a Customer adopts a published framework, the Service records what the Customer’s trained team determines; it does not apply, compute, validate, or interpret any framework, and we claim no endorsement by or affiliation with its authors.

16.3 Human Review of All AI Output

As stated in Section 4.2 and Section 4.3, AI Features are assistive only, never determine or score threat or risk levels, never make safety or disciplinary decisions, and never operate without a human in the loop. Every AI Output requires human review before it is relied upon or acted upon, a contractual obligation under the Agreement and the AI Usage & Human Review Policy, and invocation is recorded in the Audit Log.

ARTICLE 17. CHANGES TO THIS PRIVACY POLICY

17.1 Notice of Material Changes

For any material change — expanding the categories of information collected or the purposes of use, adding a category of recipient, materially reducing a protection described here, or materially changing a retention period — we give thirty (30) days’ advance notice before it takes effect, by email to the Customer’s administrative contact and by posting an updated Privacy Policy with a new Effective Date and Version Number. Changes required by law and changes addressing a security exigency may take effect on posting, with prompt explanation. Where a material change is adverse, the Customer may terminate without penalty in accordance with the Terms of Service, receive a pro rata refund of prepaid unused fees, and exercise its rights under Article 12.

17.2 Versioning and Effect of Continued Use

Each version carries a Version Number and Effective Date, stated in the front matter and repeated in the document control line below; prior versions and a description of changes are available at legal@4studentlives.com. Continued use after a revision’s effective date constitutes acceptance, subject to the termination right in Section 17.1 and the order of precedence in Section 7.5.

ARTICLE 18. CONTACT US

18.1 Privacy and Security Contact

Privacy correspondence — including requests for the current Subprocessor list, the Standard Contractual Clauses or International Data Transfer Addendum, and California and other state privacy requests — and reports of a suspected vulnerability, credential compromise, or Security Incident go to legal@4studentlives.com or 1967 E Sunshine Trl, Saint George, Utah 84790-1919. Please state the subject in the subject line. Suspected Security Incidents are triaged under Section 11.3; vulnerability reports under Section 11.2.

18.2 Mailing Address

4StudentLives, Inc.
1967 E Sunshine Trl
Saint George, Utah 84790-1919
United States

A Delaware corporation with its principal place of business in Saint George, Utah.

18.3 If You Are a Parent, Guardian, or Student

Please contact your child’s school or school district. 4StudentLives is a technology vendor that maintains records on behalf of schools and districts. We have no relationship with you, cannot verify your identity or authority as to a particular student, and may not disclose, correct, or delete a student’s Education Records on our own authority. Direct your request to the school principal, the district records custodian, the district data privacy officer, or the district’s FERPA contact. If you believe an educational agency has failed to comply with FERPA, you may complain to the Student Privacy Policy Office, U.S. Department of Education, 400 Maryland Avenue SW, Washington, DC 20202-8520. If a student is in immediate danger, call 911. The Service is not an emergency notification system and is not monitored by 4StudentLives for emergencies.

4StudentLives, Inc. — Privacy Policy — Version 1.0 — Effective Date: August 11, 2026

This Privacy Policy is Document 2 of the 4StudentLives legal documentation suite, incorporated into and governed by the 4StudentLives Terms of Service. Capitalized terms not defined here have the meanings given in the Terms of Service.