Privacy Policy

Last updated October 11, 2026

Stand To is a school operations platform used by K-12 schools and districts. This policy explains what data Stand To collects, how we use it, who we share it with, and how schools can get it back or have it deleted. In this policy, "we" means Stand To Enterprises, and "school" means the school or district that contracts with us.

Who controls student data

Schools own and control all student data in Stand To. We process student data only on the school's behalf and only to provide the service the school signed up for. For purposes of the Family Educational Rights and Privacy Act (FERPA), we act as a school official with a legitimate educational interest, under the school's direct control.

Parents, guardians, and eligible students who want to review or correct a student's records should contact the student's school. If we receive a request directly, we will refer it to the school.

Data we collect

Staff account data. Name, school email address, role, and, if a staff member signs in with Google, their Google profile name, email address, and profile photo.

Student data the school provides or enters. Depending on which features a school uses, this can include:

• Name, student ID, grade level, and photo
• Class schedules and teacher assignments
• Attendance, tardy, and hall pass records
• Course grades
• Behavior referrals and the actions taken on them
• Support plans, caseload notes, and meeting records
• Accommodations and modifications from IEP and 504 plans that teachers need to know
• Parent and guardian names and contact information
• Safety reports submitted by students or staff

Technical data. Basic information needed to run and secure the service, such as sign-in times and records of uploads and changes made in the platform.

How we use data

We use data only to provide, secure, support, and improve the Stand To service for the school. That includes sending notices to families on the school's behalf, such as tardy and attendance notices. Those emails come from a no-reply address and replies go to the school.

We do not:

• Sell student or staff data
• Use student data for targeted advertising
• Build profiles of students for any purpose other than the school's educational purposes
• Use student data to train artificial intelligence models
• Share student data with anyone except as described in this policy

Google sign-in

If you sign in with Google, Stand To receives only your Google name, email address, and profile photo. We use them only to sign you in and show who you are inside Stand To. We do not access your Gmail, Google Drive, calendar, or any other Google data, and we do not share Google user data with anyone.

Service providers

We use a small number of service providers to run Stand To. They process data only to provide their service to us and are bound by contract to protect it:

• Google Cloud and Firebase: hosting, sign-in, and database
• Netlify: hosting for the Stand To web application
• Resend: delivery of email notices to families and staff

We may also disclose data if required by law, such as in response to a valid court order. If that happens, we will notify the school unless the law prohibits it.

How we protect data

Data is encrypted in transit and at rest. Access inside Stand To is limited by role, so staff see only what their role allows. For example, teachers see records only for their own students. We review access rules before each release and limit who on our side can reach production data.

Data breaches

If we learn of unauthorized access to school or student data, we will notify the affected school without unreasonable delay and give them the information they need to meet their own notice obligations to families.

Keeping and deleting data

We keep data for as long as the school's contract is active. When a contract ends, the school can export its data. We then delete the school's data within 60 days. A school can also ask us to delete specific records at any time while the contract is active.

Children's privacy

Students do not create their own accounts in Stand To. Student information comes from the school, which provides any consent required under the Children's Online Privacy Protection Act (COPPA) on behalf of parents for educational use.

State law

Stand To is designed to meet student privacy laws in the states where it operates, including California's Student Online Personal Information Protection Act (SOPIPA) and California Education Code section 49073.1. Schools may also sign a data privacy agreement with us that sets out these commitments in detail.

Changes to this policy

If we make a material change to how we handle student data, we will notify schools before the change takes effect. The date at the top of this page shows when this policy last changed.

Contact

Questions about this policy or about data in Stand To: privacy@standtok12.com