CoOpNavigatorCoOpNavigatorTerms of Service

CoOpNavigator Privacy Policy

Effective date: [EFFECTIVE DATE]

DRAFT – NOT LEGAL ADVICE. This document is a draft. Have a licensed attorney review it before you publish or rely on it. Pay special attention to the Children's Privacy, COPPA, and FERPA section (Section 9).

This Privacy Policy explains how [LEGAL BUSINESS NAME] ("CoOpNavigator," "we," "us," or "our") collects, uses, shares, and protects information through https://coopnavigator.com and our related services (the "Service"). The Service is used by homeschool co-ops, microschools, and similar organizations ("Schools") and their administrators, teachers, and parents/guardians. This policy is part of our Terms of Service.

1. Our Role

For information that a School and its users enter about the School's community, including students and children, we act as a service provider processing data on behalf of, and at the direction of, the School. The School controls that data and decides how it is used. For account, billing, and website usage information we collect directly, we act on our own behalf as described in this policy.

2. Information We Collect

2.1 Account information. Names, email addresses, passwords (stored only as secure hashes), role and permissions (Admin, teacher, parent/guardian), notification preferences, and the date and version of the Terms you accepted. For each School: name, contact email, website, address, time zone, logo, fee and enrollment settings, and plan/billing status.

2.2 Student and child information. Children do not have accounts. A School or parent may enter, for each student: name, grade, the linked parent/guardian, enrollment status, class enrollments, attendance records, progress notes and grades from teachers, and any free-text notes the School chooses to enter. We collect this only as provided by the School and its authorized users. Schools should not enter sensitive health or other sensitive information about children unless it is genuinely needed.

2.3 Messages and activity. Announcements and read receipts, direct message threads, lessons and assignments (titles, text, links, due dates), event reminders and RSVPs, volunteer shift sign-ups and hours, and invitations.

2.4 Payment information. Subscription payments and card payments between families and Schools are processed by Stripe. We store Stripe customer, subscription, and payment identifiers and records of charges, payments, refunds, and installment plans (amounts, descriptions, dates, method, and status). Card details are entered directly with Stripe; we do not receive or store card numbers.

2.5 Security and usage information. Sign-in attempts (email, IP address, time, and result), sessions, an audit log of administrative actions, server logs, and aggregated, cookieless web analytics from Cloudflare.

3. How We Use Information

We use information to:

  • provide, operate, and maintain the Service for the School;
  • create and manage accounts, roles, and permissions;
  • process subscriptions and enable School-to-family payments through Stripe;
  • send service emails, such as invitations, announcements, receipts, payment notices, and export and account-end reminders;
  • provide support and respond to requests;
  • secure the Service, prevent fraud and abuse, and enforce our Terms;
  • monitor and improve the Service, including using de-identified or aggregated data;
  • comply with legal obligations.

We do not use student or child information for advertising, and we do not build profiles of students except as needed to provide the Service to the School.

4. We Do Not Sell Personal Information

We do not sell, rent, or trade personal information, and we do not share it for cross-context behavioral advertising.

5. How We Share Information

We share information only:

  • With the School and its authorized users, according to the roles and permissions the School's Admins assign;
  • With service providers (processors) who help us run the Service under contractual obligations to protect the information, including:
  • DreamHost (VPS) – virtual private server hosting for the application;
  • PostgreSQL database – self-hosted on our DreamHost server (no separate database provider), including encrypted backups;
  • Cloudflare – DNS, reverse proxy and content delivery network (CDN), TLS termination and security (all web traffic passes through Cloudflare), and cookieless Web Analytics;
  • Stripe – subscription billing and School-to-family card payments;
  • Resend – transactional and notification email delivery;
  • With authorized CoOpNavigator personnel. Our platform administrators can open any School's account and data, but only as needed for support, security, billing, legal compliance, or at the School's request. Access is limited by role and recorded in an audit log;
  • For legal reasons, when we believe in good faith it is required by law, subpoena, or legal process, or necessary to protect the rights, safety, or property of us, our users, or others;
  • In a business transfer, such as a merger, acquisition, or sale of assets, subject to this policy's protections;
  • With consent or at the School's direction.

We may change our service providers. We will update this list and, for material changes, notify School Admins in advance as described in Section 13.

6. Data Retention and Deletion

We keep School data while the School's subscription is active. Access ends when your paid period ends. Data may be permanently deleted at any time after that and will be deleted within 90 days. We don't guarantee it can be recovered. The School's Admins receive export reminder emails and should export any data they want to keep before the end date. Admins can export their School's data at any time while the plan is active, as a ZIP file of CSV spreadsheets; parents can export their family's data as CSV or JSON. Data is removed from our live systems first, and encrypted database backups roll off on a rolling schedule of no more than [30] days, so that all copies are gone within 90 days after the paid period ends. After deletion, we retain only records we are required to keep by law or for legitimate legal, tax, accounting, or fraud-prevention purposes, such as payment and refund records held by us or Stripe.

7. Security

We use reasonable administrative, technical, and physical safeguards designed to protect information, including encrypted connections (HTTPS), hashed passwords, and role-based access controls. However, no system is completely secure, and we cannot guarantee the security of information. Schools and users are responsible for safeguarding their login credentials and for the permissions they grant. If we confirm a security incident involving School data, we will notify the affected School's Admins without undue delay, and in any event within 72 hours after confirmation (or sooner if the law requires), with the information reasonably available at the time, and will update them as we learn more.

8. Cookies

We use only essential cookies: a secure, HTTP-only session cookie that keeps you signed in. Cloudflare Web Analytics is cookieless and does not track you across sites. Cloudflare may set security cookies (such as __cf_bm) to protect the Service from bots, and Stripe sets fraud-prevention cookies on payment pages. We do not use advertising or cross-site tracking cookies.

9. Children's Privacy, COPPA, and FERPA

9.1 Schools obtain consent. The Service is not directed to children for independent use. Information about children, including children under 13, is entered by or at the direction of the School. The School is responsible for providing required notices and obtaining parental or guardian consent before entering any child's information.

9.2 COPPA. Where COPPA applies, the School consents on behalf of parents to our collection of children's personal information solely for the School's educational purposes and for no other commercial purpose. We collect only the information needed to provide the Service.

9.3 FERPA. Where FERPA applies, we act as a "school official" with a legitimate educational interest, under the School's direct control, and use education records only to provide the Service to the School.

9.4 Parent rights. Parents and guardians may review, correct, or request deletion of their child's information, or refuse further collection, by contacting their School. We will support the School in responding.

If we learn that we have collected a child's personal information without the required consent, we will work with the School to delete it.

10. Your Choices and Requests

Because Schools control the data in their accounts, requests to access, correct, export, or delete information should be directed to your School's Admin. If you contact us directly, we will refer you to your School and help the School respond as required by law. Account holders may update certain profile information in their settings. Depending on where you live, you may have additional rights under local law; we will honor such rights as required, in coordination with the School.

11. Emails

We send service-related emails (such as invitations, receipts, payment notices, and export reminders) that are needed to operate your account. These cannot be turned off while you have an account. School announcements are sent at the School's direction.

12. Data Location

We are based in the United States, and School data is primarily stored in the United States. Our service providers, including Cloudflare's global network, may process data in other countries. The Service is intended for users in the United States.

13. Changes to This Policy

We may update this policy. If we make material changes, we will notify School Admins by email and/or by notice in the Service at least [30] days before the changes take effect, and update the "Effective date" above. We will not make material changes to how children's information is used without first giving Schools notice so they can obtain any new parental consent the law requires. Continued use of the Service after changes take effect means you accept the updated policy.

14. Contact

[LEGAL BUSINESS NAME]
Email: [CONTACT EMAIL]
Website: https://coopnavigator.com