Privacy Policy

Who is responsible for your data

Your school or district decides what happens to student records. Veristack, Inc. holds and processes those records on their instructions — under U.S. student-privacy law we act as a “school official” with a legitimate educational interest, which means we may only use the data to provide this service to that school.

In practice: if you want a record changed or removed, your school can direct us to do it, and we will. We do not make our own decisions about student data.

What we collect

Only these things:

• Who you are — name, school email address, role, school, and graduation year for students. Most of this arrives from your school’s roster rather than from you.
• What you do here — opportunities you save, activities you log, hours you record, goals you set, and whether an activity was verified.
• What you tell the assistant — the questions you type, so it can answer them.
• Basic technical records — sign-in times and security logs, which is how we can tell you who accessed what.
• Which opportunity listings you looked at — for students, whether you viewed, opened, or clicked through to a posting. Your school reads these as totals per listing, never as a list of names, and the records behind them delete themselves after thirty days. This is the one thing here we observe rather than being told, so it is the one thing you can switch off, on your cookies page.

We do not collect location, contacts, browsing history, biometrics, or anything from other sites. There is no advertising identifier because there is no advertising.

What we never do

• We never sell, rent or trade personal information. There is no price.
• We never show advertising, and never build advertising profiles.
• We never use student data to train anyone’s AI model.
• We never give organizations that post opportunities any information about students — not names, not counts, not who looked at their listing.
• We never track you across other websites. There are no third-party trackers here.

Who else ever sees it

Five companies, each doing one job, listed with what they receive on the who we share with page. We publish that list rather than describing it in general terms, because “trusted partners” is how policies avoid naming anyone.

Inside your school, who can see a student’s record depends on their role. Counsellors and administrators see students at their own school. Nobody sees students at another school: every query for a student record passes through a scoping layer that adds the school boundary automatically, and a query that forgets to filter is refused rather than answered. Database-level enforcement underneath that is written and tested but not yet switched on, and the security page says so rather than describing it as though it were.

We will disclose data if the law compels it. If we receive such a demand for student data, we will tell the school unless we are legally prohibited from doing so.

The assistant, and what leaves our systems

When you ask the assistant a question, the question and a limited summary of the relevant record are sent to a language-model provider so it can answer. Before that request leaves, directly identifying details are masked. Every request is logged, and usage is capped per school.

The provider does not use these requests to train models. We do not use your data to train models either — not ours, not anyone’s. The current provider is named on the who we share with page, and if we change it we will change that page in the same breath.

How old our users are

This product is offered to high-school students (grades 9-12). We do not knowingly collect information from children under 13, and we are not designed for or marketed to them.

We say that plainly rather than reciting the protections that apply to younger children, because claiming safeguards we do not need would tell you nothing about how we actually behave. If a school ever brings younger students onto this product, that decision changes what the law requires of us and this page will change with it before they are enrolled.

A parent may review their child’s information, ask for corrections, and refuse further collection, whatever their child’s age — see parents’ rights.

When a student turns 18

Rights over a student’s education record transfer from the parent to the student when they turn 18 or enrol in college, whichever happens first. From that point the student controls access to their own record, and a parent’s existing link no longer entitles them to see it without the student’s agreement.

If a parent and a school disagree

This happens, and it deserves a stated answer rather than an improvised one. Education records belong to the school, so where a parent asks us to delete something the school is required to keep, we follow the school and tell the parent we have done so. Where a parent asks us to stop an optional disclosure — directory listings, for example — we honour it immediately, because that is the parent’s decision to make and not the school’s.

How long we keep things

While your school is a customer, records are kept so students keep their history. When a student leaves or graduates, their record stays available to them and to the school unless the school directs otherwise.

If a school or district ends its agreement, we will return or delete its data at their direction. Absent instructions we delete it after 90 days rather than keeping it indefinitely, and we would rather be asked to wait than assume we may keep something.

That is a commitment we act on, not a timer that runs on its own: deletion at the end of an agreement is carried out by a person on request or on schedule, and the same is true of most retention here. We have written down how long every table in the product should live —124 of them — and today a scheduled job enforces that on 54. Saying so is the point — a policy that describes a register as though it ran is the kind of claim that only comes apart when somebody asks us to prove it.

Security and audit logs are the exception that does run on a clock: they are archived and then removed on a fixed schedule your district sets, defaulting to 2555 days. They outlast the account they describe on purpose — they are the record of who accessed what, and deleting them with the account would destroy the only account of what happened.

One deliberate exception to deletion, stated plainly. If you report an organization or a listing as unsafe and later delete your account, we remove your name and the words you wrote, but we keep the fact that a report was made. A pattern of reports about one organization is information about that organization and about other children’s safety, not only about you, and one person leaving should not quietly erase it. Nothing kept this way identifies you, and it is never shown to the organization.

Your rights, and how to use them

Students, parents, counsellors and administrators can download a complete copy of their own record from Settings → Data. Students, parents and administrators can request erasure from the same place.

Teachers and counsellors cannot delete their own accounts here. That is deliberate rather than an omission: a staff account is an employment record tied to the school, so removing one goes through a school administrator. Ask your administrator, or write to us and we will route it.

If you are in California, Colorado, Connecticut, Virginia or another state with a comprehensive privacy law, you have rights to know, correct, delete and to not be discriminated against for exercising them. Everything above is available to you regardless of where you live, because we would rather run one process than five.

If something goes wrong

If personal information is exposed, we will notify affected schools without unreasonable delay and in any case within 30 days of confirming it, with what happened, what was involved and what we are doing. We will not wait for certainty about scope before telling you something happened.

Changes to this policy

If we change how we use data in a way that matters, we will say so plainly and tell schools before it takes effect, rather than quietly updating a date at the top.

Contact

Write to privacy@veristack.dev. A person answers. For security reports, use security@veristack.dev.

Veristack, Inc., Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA