FERPA & COPPA Notice

The Family Educational Rights and Privacy Act (“FERPA”) is a United States federal law that protects the privacy of student education records.

FERPA gives parents and eligible students certain rights with respect to education records and limits how schools may disclose personally identifiable information from those records without consent.

In some circumstances, FERPA allows schools to disclose student information to contractors or service providers that perform institutional services or functions for the school, provided applicable FERPA requirements are met.

Grade Harbor is designed to operate as a school service provider when Student Data is provided to the Service by or on behalf of a teacher, school, district, or other authorized educational institution.

For Student Data subject to FERPA, Grade Harbor processes that data only for the educational purpose of providing the Service and only as directed by the applicable school, district, teacher, or authorized educational institution.

Grade Harbor does not claim independent ownership of Student Data and does not have independent rights to use Student Data for purposes unrelated to providing the Service.

Where applicable, Grade Harbor may process Student Data under FERPA's school official exception, subject to the school's control and the terms of any applicable agreement.

“Student Data” means student-related information provided to Grade Harbor by or on behalf of a teacher, school, district, or educational institution.

Student Data may include:

• Student writing or essay text
• Assignment prompts
• Rubrics
• Teacher instructions
• Draft scores
• Grades
• AI-generated feedback
• Teacher feedback
• Class, course, or assignment information
• Other information included in uploaded or entered educational materials

Grade Harbor does not require student names, student email addresses, student phone numbers, student photos, or student account credentials to provide the Service.

Because student writing and teacher-uploaded materials may contain free-form text, those materials may accidentally include personal information that Grade Harbor did not request. Teachers and schools should avoid uploading unnecessary personal information and should remove student names or direct identifiers where practical.

Grade Harbor does not:

• Sell Student Data
• Rent Student Data
• Use Student Data for targeted advertising
• Use Student Data to build non-educational profiles
• Use Student Data for unrelated commercial purposes
• Share Student Data with advertising networks
• Require students to create accounts
• Collect information directly from students
• Use Student Data to train generalized AI models without explicit written authorization from the applicable school, district, or authorized educational institution

Grade Harbor uses Student Data only to provide, maintain, secure, and support the educational Service, as described in our Privacy Policy, Terms of Service, and any applicable written agreement.

Grade Harbor uses AI technology to help teachers review, grade, and provide feedback on student writing.

AI-generated grading suggestions, rubric analysis, comments, and feedback are draft suggestions only.

Teachers remain responsible for reviewing, validating, modifying, and approving all final grades, scores, comments, feedback, and instructional decisions.

Schools and districts may request a Data Processing Agreement, Student Data Privacy Agreement, or similar written agreement where required for FERPA, COPPA, state student privacy laws, district procurement rules, or school policy.

A Grade Harbor data agreement may address topics such as:

• Permitted uses of Student Data
• Restrictions on disclosure and re-disclosure
• Service provider obligations
• Data security safeguards
• Data retention and deletion
• Return or deletion of Student Data
• Breach notification procedures
• Subprocessor or service provider requirements
• Support for school-managed parent or eligible student requests

To request a data agreement, contact: [email protected]

The Children's Online Privacy Protection Act (“COPPA”) applies to certain online services that collect personal information from children under 13.

Grade Harbor is a teacher-facing educational tool. Students do not create Grade Harbor accounts, and Grade Harbor does not knowingly collect personal information directly from children under 13.

When Grade Harbor is used with information about students under 13, the Service is intended to be used under the direction and authorization of the applicable teacher, school, district, or educational institution.

Grade Harbor uses student information only for school-authorized educational purposes and not for advertising or unrelated commercial purposes.

If we learn that a child has submitted personal information directly to Grade Harbor without appropriate authorization, we will take reasonable steps to delete that information or coordinate with the applicable school, district, parent, or guardian as appropriate.

To report an inadvertently created student account or direct student submission, contact: [email protected]

Parents, guardians, and eligible students should direct requests to access, correct, or delete Student Data to the applicable school, district, or educational institution.

Because Grade Harbor processes Student Data on behalf of schools and authorized educational users, Grade Harbor responds to Student Data requests under the direction of the applicable school or district.

Grade Harbor will reasonably assist schools and districts in responding to authorized requests as required by applicable law and contract.

In addition to FERPA and COPPA, some states have student data privacy laws or contract requirements that may apply to certain schools, districts, or educational technology providers.

Examples may include laws or requirements in states such as California, New York, Texas, and others.

Grade Harbor will work with schools and districts to support applicable student privacy requirements, including through written data agreements where required.

Because state requirements vary, school administrators with state-specific privacy or procurement questions should contact: [email protected]

Grade Harbor uses reasonable administrative, technical, and organizational safeguards designed to protect Student Data from unauthorized access, use, disclosure, alteration, or destruction.

These safeguards may include:

• Encryption in transit
• Encryption at rest where supported by our infrastructure providers
• Access controls
• Authentication requirements
• Least-privilege access
• Logging and monitoring
• Security reviews
• Incident response procedures

Grade Harbor retains and deletes Student Data as described in our Privacy Policy and any applicable written agreement with a school or district. Deletion and retention schedules are enforced by automated backend processes.

Unless a school agreement states otherwise, Student Data may be retained for a configurable period after subscription expiration or account inactivity (the platform default is subscription duration plus 12 months), unless deletion is requested earlier. Student Data is deleted from active systems upon automated processing of an account deletion request. Teachers may submit a deletion request at any time via their account settings. Deleted information may remain in encrypted backups for a limited period until those backups are overwritten or deleted in the ordinary course of business.

This Notice should be read together with Grade Harbor's:

• Privacy Policy
• Terms of Service
• AI Use Policy, if applicable
• Data Processing Agreement, if applicable
• Any signed school or district agreement, if applicable

If a signed agreement with a school or district provides additional protections or different requirements, that signed agreement will control to the extent stated in the agreement or required by applicable law.

School administrators, district representatives, teachers, parents, guardians, or eligible students with FERPA, COPPA, student privacy, or data agreement questions may contact:

Grade Harbor LLC
Email: [email protected]