Privacy Policy

1. Who we are and what this policy covers

Agenteach ("we," "us") provides Agenteach Attend, an attendance case management service for schools and districts. Our service is offered to schools and districts ("LEAs") and their authorized staff. This policy covers the Agenteach application (portal.agentea.ch), our API (api.agentea.ch), our marketing site (agentea.ch), and the district-system integrations we operate through our integration partner Ednition (§7).

Agenteach Attend is used by authorized school and district staff only. Attendance staff and counselors manage cases; principals and district leaders oversee attendance and reporting; district administrators manage users, roles, and connections. Teachers add quick student notes and carry out assigned trusted-adult follow-ups. Students and families have no accounts and never use the product. The district's SIS remains the record of truth for attendance; Agenteach keeps a working copy and does not change attendance in the SIS.

2. Our role and student data ownership

When an LEA uses Agenteach, we act as a school official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)), operating under the LEA's direct control with respect to education records, typically through a signed Data Privacy Agreement (such as the SDPC National Data Privacy Agreement).

All student data belongs to the LEA. We claim no ownership or license beyond what is needed to provide the service. We use student data only for the educational purposes the LEA authorizes — never for advertising, never for profiling, never for sale, and never to train AI models.

For New York districts, we commit to signing the district's data privacy documents for New York Education Law 2-d, including the Parents' Bill of Rights for Data Privacy and Security and the supplemental information for each contract. These are contractual commitments, not a claim of certification.

3. Data we collect

3.1 Data from the district's SIS

We receive only the fields the district authorizes, through the district-approved Ednition connection. See §7 for Ednition's data boundary.

3.2 Records created by district staff in Agenteach

3.3 Staff accounts and service records

Staff account name, school email, role, school/district affiliation, assigned student relationships, and district-approved connection credentials or tokens (stored encrypted; see §8). Account and directory fields come from the district's identity provider, its approved SIS connection, or district administrators. Service records include connection-job status. Before Attend handles real district data, we will record sensitive reads, changes, exports, erasures, and every AI call in a database-enforced append-only audit trail. AI-call entries will contain provider, model, and purpose, never raw content.

3.4 Data we do NOT collect

No child-welfare reports (staff follow district procedures outside Agenteach), disability or IEP/504 records, health records, or discipline records. Staff must not enter these records in case notes, restricted notes, or drafts. No biometric data, location data, student browsing history, social media data, advertising identifiers, or third-party analytics or tracking cookies anywhere in the application. There are no student- or family-facing accounts or chat.

4. How we use data

Solely to provide the attendance case management service the LEA authorizes: keeping a working copy of roster and attendance records, organizing case notes, contact logs, support plans, and meetings, supporting staff follow-ups and oversight, and preparing family message drafts, monthly summaries, and draft state-report worksheets for staff review. Attendance flags come from district-set rules and thresholds, not AI. Agenteach does not change SIS attendance, send family messages, automate child-welfare reports, or file reports with any agency. Aggregated, de-identified data may be used to maintain and improve service reliability; de-identification follows NIST-aligned standards and we commit not to attempt re-identification.

5. AI features

• AI (Google Vertex AI / Gemini, under Google Cloud's enterprise terms) helps draft family messages and monthly attendance summaries, and summarize case histories for staff. Staff review every AI draft before relying on it or saving it as a record. A person approves family messages before staff send them through district channels; Agenteach never sends them.
• AI never makes decisions about students: no risk scores, predictions, grading, discipline, eligibility, referral decisions, or diagnostic determinations. Flags use district-set rules and thresholds, not AI. AI output is never auto-sent.
• Student data is never used to train AI models — ours or Google's. Vertex AI is used under terms that exclude training on customer data.
• Before Attend handles real district data, we will enforce AI-context minimization: only the context needed for the staff-requested draft or summary, omitting unnecessary identifiers and contact details. We will enforce restricted-note permissions in every AI-context request.
• Before Attend handles real district data, we will enforce append-only auditing of every AI call (provider, model, purpose — never raw content).

6. Third parties and subprocessors

We share data only with subprocessors necessary to run the service, bound by agreements with confidentiality, security, deletion, and breach-notification obligations. Ednition is bound by its agreement with Agenteach to the obligations described in §7.4. Current subprocessors (see the Subprocessor List for the maintained version):

We provide advance notice of subprocessor changes to LEAs under agreement, and any new subprocessor is bound to equivalent terms. We never sell data, never share it for advertising, and never disclose it except as this policy and our LEA agreements describe or as law requires.

7. Our integration partner: Ednition

Districts run many different student information systems (SIS), learning platforms, and sign-on providers. Rather than ask each district to build and maintain a custom connection to Agenteach, we partner with Ednition, Inc. (a Delaware corporation headquartered in Kaysville, Utah) and its RosterStream platform — rostering and data-interoperability infrastructure built specifically for K-12 vendors. Ednition is an infrastructure subprocessor working under our direction. It does not own, license, or independently use any district data, and Agenteach remains the single party accountable to the LEA for everything in this policy.

7.1 What Ednition does for Agenteach

• Roster and enrollment sync from the source the district approves: PowerSchool, Infinite Campus, Skyward and other OneRoster-compliant SIS platforms, Clever, ClassLink, or an Ed-Fi data exchange. Students, staff, schools, courses, and section enrollments arrive already normalized to the 1EdTech OneRoster standard.
• Single sign-on through the district's existing identity provider (Google, Microsoft, Clever, ClassLink, SAML, or OpenID Connect), so staff keep using their district login and the district's MFA policy continues to apply. Agenteach never holds staff passwords.
• District control at the source. Every connection is created, scoped, and approved by the district's technology team, and the district can revoke it at the source at any time. Districts see Agenteach throughout the connection process; Ednition operates behind the scenes as our infrastructure.

Attendance records and optional counselor grades arrive through the district-approved Ednition connection. Agenteach does not send family messages or write attendance back to the SIS.

7.2 What Ednition processes — and what it never sees

Ednition's own privacy statement describes the student data it handles as student names and class schedules, times, and locations — roster data — and commits Ednition to process it only as instructed by its customer and only to provide the service. Under our agreement, that customer is Agenteach, and our instructions are limited to the purposes in §4.

7.3 Ednition's security and privacy posture

Ednition publishes its controls and independent assurance reports through a real-time Trust Center at trust.ednition.com. As published there and on Ednition's site, Ednition brings the following to our partnership:

• SOC 2 Type 2 attestation across the Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, and Privacy), held continuously since RosterStream launched, with the report available to districts on request.
• ISO/IEC 27001:2022 certification, audited annually by an accredited certification body and covering the platform, its student-data handling, and its information security management system.
• Annual third-party penetration testing, with results available through the Trust Center, plus continuous automated control monitoring published in real time.
• Encryption: TLS 1.2 or higher for all data in transit, and AES-256 encryption at rest for roster, identity, and extended data.
• Least-access data principles: role-based access controls designed for FERPA, so a vendor receives only the data elements it is authorized to use.
• Hosting on Amazon Web Services as an AWS Partner Network member. RosterStream supports region-pinned hosting; Agenteach's tenancy is pinned to United States regions (§9).
• Open standards and edtech privacy commitments: 1EdTech member, 1EdTech OneRoster 1.1 and 1.2 certified, built on the Ed-Fi Unifying Data Model, and a signatory of the 1EdTech TrustEd Apps Pledge.
• Written no-training and purpose-limitation commitments: Ednition's terms contractually bind its own contractors and service providers never to use customer or student data to train any large language model or other AI model, and prohibit disclosure or use of student data for any purpose other than providing the service. Ednition does not sell student data, use it for advertising, or build profiles.
• Bounded retention: Ednition's terms cap retention of customer data at 60 days after termination, inside our own 60-day deletion commitment (§10).
• Cyber-insurance documentation and security questionnaires are available through the Trust Center for district vendor-risk reviews.

7.4 How Ednition is bound to this policy

• Binding obligations. Ednition is bound by its agreement with Agenteach to process student data only as instructed by Agenteach, use it only to provide the service, prohibit AI training on it, keep it confidential, and delete it within 60 days of termination. Ednition's Privacy Statement also states that it does not sell student data, use it for advertising, or build profiles.
• Incident notification. Ednition's terms require it to promptly notify Agenteach in writing of any breach or potential breach affecting district data, so that we can meet the LEA notification timelines in §13. Agenteach, not Ednition, notifies the LEA.
• Deletion on request or exit. When a district disconnects an integration or its agreement ends, we direct Ednition to delete all district data it processes for Agenteach under §7.2; Ednition's contractual maximum is 60 days, and we confirm destruction in writing as part of our own exit process. Student-level erasure requests (§10) are propagated to Ednition for records it processes through the district-approved connection.
• Subprocessor transparency. Ednition is listed on our public Subprocessor List, and LEAs under agreement receive advance notice of any change to that list, per §6.
• Assurance for your review team. On request, and under Ednition's standard confidentiality terms, we provide Ednition's SOC 2 Type 2 report, ISO/IEC 27001 certificate, and penetration-test summary as part of our district procurement pack, or your team can request them directly from trust.ednition.com.

7.5 How the partnership maps to the frameworks districts review against

Ednition's certifications and attestations are Ednition's, verified by its independent auditors and published on its Trust Center; they do not transfer to Agenteach, and our own third-party certifications remain roadmap items as described on our Security & Privacy Architecture page.

8. Security

• TLS 1.2+ encryption in transit everywhere; HSTS on all production hosts.
• Encryption at rest for databases, file storage, and backups; OAuth tokens are additionally application-layer encrypted (Fernet with key rotation).
• Before Attend handles real district data, we will enforce server-side district, school, role, and assigned staff-student checks for every request. Counselor-only restricted notes and the optional counselor academic view will require explicit permissions, including in reports, exports, and AI context. An oversight or administration role does not by itself grant access to restricted notes.
• Before Attend handles real district data, we will enforce database-level append-only audit logging of sensitive reads (including restricted-note views), writes, exports, erasures, and every AI call. AI-call entries will contain provider, model, and purpose, never raw content.
• Rate limiting, single sign-on via the district's Google or Microsoft identity (or the district's Clever, ClassLink, SAML, or OpenID Connect provider through Ednition SSO Connect), and least-privilege scopes for district-approved connections.
• Staff sign-in uses the district-approved single sign-on provider and inherits the district's multi-factor authentication policy. Agenteach does not maintain separate passwords for staff.

9. Data residency

All student data is stored and processed exclusively in United States regions. Application hosting and databases run in Microsoft Azure US regions (Central US), and AI processing runs in Google Cloud Vertex AI's us-central1 (Iowa) region. District data processed through our integration partner Ednition (§7) is held in Ednition's Amazon Web Services environment in United States regions; although RosterStream offers multi-region hosting, Agenteach's tenancy is pinned to the US. No student data is stored or processed outside the United States, and our infrastructure configuration pins these regions explicitly rather than relying on provider defaults.

10. Retention and deletion

• We keep student data only while the LEA authorizes the service, plus the retention windows in our published Data Retention & Deletion Schedule (e.g., unsent family message drafts ≤ 365 days, resolved alerts ≤ 180 days). Before Attend handles real district data, we will apply LEA-configurable retention and automated daily purging to every Attend record class, with export, erasure, audit, and legal-hold coverage. The schedule maps the new classes to district-directed retention; it does not assign new default windows.
• On LEA request or contract termination, student data is exported (if requested) and deleted within 60 days, consistent with NDPA § 4.6 and Texas Education Code § 32.156. Legal holds and correction-record obligations can defer specific records, and deletion propagates to backups on the backup rotation cycle — we never promise instantaneous eradication from every backup medium, and we say so honestly.
• Deletion extends to our subprocessors. All district data held by Ednition for Agenteach is covered by deletion when the district disconnects or the agreement ends (contractual maximum 60 days), and student-level erasures are propagated for records Ednition processes through the approved connection (§7.4).
• Parents and eligible students exercise access/correction/deletion rights through their LEA; we support LEA requests within 30 days.

11. Cookies

Agenteach uses only strictly necessary cookies:

No advertising, analytics, or tracking cookies. The app (portal.agentea.ch) and API (api.agentea.ch) are subdomains of the same site; these cookies are scoped to agentea.ch, marked Secure, sent only over HTTPS, and never shared with any third party.

12. Children's privacy (COPPA)

Agenteach Attend is staff-facing; students and families never use it directly or have accounts. Where student records include data about children under 13, we process it solely for the school's educational purposes under the school-consent framework, with the protections in this policy (no ads, no profiling, no sale, no AI training, published retention limits, written security program). If we add any student-facing features, we will implement full COPPA notice and consent controls first.

13. Breach notification

We maintain a written incident response plan. If a breach affects student data, we notify affected LEAs without unreasonable delay and within the timelines our agreements and applicable law require (72 hours under NDPA v2.2, and Texas Business & Commerce Code § 521.053 timelines for Texas individuals/AG where applicable), including the nature of the breach, data involved, steps taken, and contact information. Our subprocessors, including Ednition, are contractually required to notify us of incidents affecting district data so that these windows are met regardless of where an incident originates.

14. Changes to this policy

We post changes here with an updated last-updated date, version, and change log, retaining the original effective date, and we notify LEA contacts and account holders (email or in-app) in advance of material changes.

15. Contact

Agenteach Inc.
privacy@agentea.ch