Student Data Privacy Statement
Effective October 31, 2026
Schools trust us with information about their students, and we take that seriously. This statement explains, in plain language, what student data TardySweep collects, how we use and protect it, and the promises we make to every school we work with. It applies to all schools and districts using TardySweep, whether or not they have signed a separate data privacy agreement with us.
Our commitments
- We never sell student data. Not to advertisers, data brokers or anyone else.
- No advertising. We never use student data to show ads or build marketing profiles.
- Your school owns its data. We use it only to provide TardySweep to your school, under your school's direction.
- No student or parent accounts. TardySweep is run by school staff. Students and parents never have accounts, and we never contact students or parents. At classroom stations, a student can enter their own student ID to record a tardy, but cannot see or change anything else.
- You can take it with you. Your school can export its data at any time and ask us to delete it.
- We'll sign your agreement. We are glad to sign your district's student data privacy agreement.
What data we collect
We collect only what's needed to log and report tardies.
| Type | What it includes | Where it comes from |
|---|---|---|
| Student information | Name, student ID number (and barcode value), school, and grade level if your school provides it | Your school's student database import or integration |
| Tardy records | Date, time, bell period and location of each tardy | Logged by school staff, or by the student at a classroom station |
| Interventions | Tardy milestones reached and interventions assigned | Your school's Event Rules and staff |
| Staff accounts | Name, email, role and school | Your school |
| Activity records | Which staff account or classroom station logged each tardy | Recorded automatically |
What we don't collect: student or parent contact information, photos, biometric data, health information or Social Security numbers.
How we use and share it
We use student data only to run TardySweep for your school: logging tardies, applying your Event Rules, printing passes, producing your reports, providing support and keeping the service secure and working well.
We share student data only with:
- Your school's authorized staff, based on the roles your school assigns.
- Service providers that host and operate TardySweep on our behalf, located in the United States and bound by written agreements to protect the data at least as carefully as we do. Districts can request the list as part of a data privacy agreement.
- Authorities, only when legally required. If we receive a court order or similar legal demand, we will notify your school first unless the law prohibits it.
We may use data that has been fully de-identified, so no student can be identified, to improve TardySweep. We never try to re-identify it.
How we protect it
- Encryption: data is encrypted in transit using TLS and at rest using AES-256.
- Secure hosting: TardySweep runs on Amazon Web Services infrastructure in the United States.
- Role-based access: each staff member sees only the schools and data their role allows; district administrators see only the schools they oversee.
- Limited internal access: our team accesses student data only when needed to support your school or maintain the service.
- Password protection: passwords are never stored in readable form.
FERPA and state privacy laws
FERPA is a federal law that governs how schools handle student education records. TardySweep is designed to support your school's compliance. We act as a "school official" under FERPA: we provide a service your school would otherwise do itself, we follow your school's direction on how student data is used, and we use it only for that purpose.
Many states also have their own student privacy laws. We follow the requirements that apply where your school is located, and we are glad to sign your district's student data privacy agreement, including state-specific agreements and the National Data Privacy Agreement.
Keeping and deleting data
We keep your school's data for as long as your school uses TardySweep, so your tardy history stays available from year to year. Your school's administrators can export records to CSV at any time, and can ask us to delete specific data whenever they want; we'll do so within 30 days.
When your school's subscription ends, we delete its student data within 60 days, after providing an export if you ask for one. Copies may remain for a limited time in our hosting provider's encrypted disaster-recovery backups, which are overwritten automatically and never restored except to recover from a system failure. On request, we'll confirm the deletion in writing.
If something goes wrong
If we confirm that student data was accessed or disclosed without authorization, we will notify your school within 72 hours, or sooner if the law requires. We'll explain what happened, what data and how many students were affected, and what we're doing about it, and we'll work with your school on any notices to families that the law requires.
Requests from parents and students
Because your school owns and controls its student data, parents, guardians and students aged 18 or older should contact their school to review or correct records. If a parent or student contacts us directly, we'll refer them to their school and help the school respond.
Changes and contact
If we change this statement, we'll update the effective date above and notify our school customers of any material change before it takes effect. We will never weaken our protections for data we have already collected without the school's consent.
Questions, or want our data privacy agreement? Contact us at info@tardysweep.com or through https://tardysweep.com/contact.