Compliance

Designed for FERPA Compliance

For districts evaluating Gregarious. Plain English, no jargon.

Last updated: April 10, 2026·Questions? Email cgb003@gmail.com

Who this page is for

This page is written for district IT administrators, privacy officers, and anyone responsible for vetting edtech tools before classroom deployment. It explains how Gregarious approaches student data with FERPA requirements in mind, and how to reach us for Data Processing Agreements (DPAs) or Business Associate Agreements (BAAs).

What FERPA requiresThe law

▼

The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. 1232g, is a federal law that protects the privacy of student education records. It gives parents rights over their children's records, and transfers those rights to students when they reach 18 or attend a postsecondary institution.

Key FERPA requirements relevant to edtech vendors:

Education records may not be disclosed to third parties without written parental consent, with specific exceptions

Vendors acting as "school officials" with a "legitimate educational interest" are a recognized exception, but must be under direct control of the school

Parents have the right to inspect and review their child's education records

Parents have the right to request amendment of records they believe are inaccurate

Schools must maintain records of disclosures (with limited exceptions)

Student data may not be used for non-educational purposes by school officials or their vendors

Source: U.S. Department of Education: FERPA Overview

How Gregarious is designed to comply: point by pointCompliance

▼

When a school or district contracts with Gregarious, we act as a "school official" with a "legitimate educational interest" in student records under 34 CFR 99.31(a)(1). This is the standard legal basis for edtech vendors. Here is exactly how we fulfill our obligations under that framework:

Student data used only for educational purposes

Student data is used exclusively to personalize learning, measure academic growth, and improve question quality. It is never used for advertising, profiling, or any commercial purpose unrelated to education.

No unauthorized disclosure

Student data is never shared with third parties without written consent. Our third-party service providers (Supabase, Vercel, Anthropic) receive only what they need to operate the platform, under data processing agreements that prohibit secondary use.

Parent access rights honored

Parents can request a complete copy of their child's data at any time by emailing cgb003@gmail.com. We respond within 30 days. School administrators can also pull student records through the Admin Dashboard.

School retains control

The school is the Data Controller. Gregarious is the Data Processor. Schools can audit our data handling, request data exports, or instruct us to delete records at any time. We respond to school data instructions within 5 business days.

Disclosure logging

Every access to student data within the platform is logged in an immutable audit trail. Logs are available to school administrators on request.

Data deletion on contract end

When a school contract ends, student data is retained for 60 days to allow data export, then permanently deleted unless the school requests longer retention in writing.

Student placement tool: client-side processing explainedTechnical

▼

The Gregarious Student Placement Tool (used by administrators to organize students using the BBCard format) is built entirely as a client-side application. This is a deliberate FERPA-by-design architectural decision.

Here is exactly what happens when an administrator uses the placement tool:

The administrator uploads or pastes student placement data (names, scores, demographic flags) into their browser

All processing (sorting, grouping, snake-draft distribution) happens in JavaScript running on the administrator's local machine

The processed placement data is displayed in the browser and can be exported as a spreadsheet

No student placement data is transmitted to Gregarious servers at any point during this process

No student placement data is stored in our database

The only data that persists is the final class/group assignment, which is stored as a class roster with anonymized student IDs, not names or demographic data

Why this matters for FERPA

Student placement data often includes sensitive demographic and assessment information. By processing this entirely in the browser, we eliminate any possibility of this data being intercepted, stored, or accessed by our servers. The school never has to transmit the most sensitive student data over the network to us at all.

AI anonymization: how student names are strippedTechnical

▼

Gregarious uses Anthropic's Claude API to generate adaptive feedback, tutoring hints, and teacher-facing analytics. Every AI prompt goes through a mandatory anonymization pipeline before being sent to the API.

The anonymization pipeline works as follows:

Student name is replaced with a session-scoped anonymous identifier (e.g., "Student-7f3a") before any data is sent to the AI

School name, teacher name, and any other identifying context are stripped from the prompt

Only anonymized learning data is included: skill level, question ID, response correctness, and hint count

The AI receives context like "Student-7f3a, skill level 650, answered question #4412 incorrectly on second attempt." Never a real name.

The anonymous identifier is discarded at the end of the session. It cannot be reverse-mapped to a student identity.

Additionally:

We have enabled Anthropic's Zero Data Retention (ZDR) option. Anthropic does not store or train on any inputs or outputs from our API calls.

AI interaction logs on our side are automatically deleted after 90 days.

No student data is ever used to train any AI model without explicit written consent from the school and parent.

Data access controls: row-level security explainedTechnical

▼

Gregarious uses Supabase as its database layer. All access to student data is governed by Row Level Security (RLS) policies enforced at the database level, not just at the application layer.

Here is what RLS means in plain English:

Without RLS (how many apps work)

The application code decides who can see what. If there is a bug in the application, or if an attacker bypasses the application layer, they could potentially query any data in the database.

With RLS (how Gregarious works)

Access rules are enforced by the database itself. A query for Student A's data, issued while authenticated as Student B, will return zero rows, not an error, not a permission denied message, just zero rows. Even if an attacker gained database access, they could only read data they are authorized to see. The database enforces the policy, not just the app.

Specific RLS policies in effect:

Students can only read their own learning records, mastery scores, and Studio content

Teachers can read records for students enrolled in their classes only

Parents can read records for their linked child only

Administrators can read records for students enrolled in their school only

No user role can write to another user's records

Gregarious system processes use service-role credentials that are audit-logged and restricted to specific operations

For district IT administrators: BAA and DPAFor IT

▼

Gregarious is prepared to enter into the following agreements with districts and schools:

Data Processing Agreement (DPA)

Our standard DPA establishes Gregarious as a Data Processor acting under the school's (Data Controller's) instructions. It covers data handling obligations, breach notification timelines, subprocessor disclosures, and data deletion requirements. We use the Student Data Privacy Consortium (SDPC) standard DPA framework.

Business Associate Agreement (BAA)

If your district uses Gregarious in a context that involves health-related student data (e.g., schools for students with health-related learning needs), we can execute a BAA. Note: Gregarious does not process Protected Health Information (PHI) by default.

State-specific privacy addenda

Many states have student privacy laws beyond FERPA (California SOPIPA, New York Education Law 2-d, etc.). We will review and sign state-specific addenda on request. Contact us to discuss your state's requirements.

Request agreements

To request a DPA, BAA, or state-specific privacy addendum, email Brian Adams directly. Include your district name, state, and which agreement you need. We typically turn around a signed DPA within 5 business days.

Email cgb003@gmail.com to request a DPA

Frequently asked questions

Can the AI read my students' names?▼

No. Student names are stripped by our anonymization pipeline before any data is sent to the AI. The AI receives only anonymized learning context (skill level, question ID, response data). It has no way to identify who a student is.

Does Gregarious sell student data?▼

Never. We do not sell, rent, trade, or share student data with advertisers, data brokers, or any third party for commercial purposes. Full stop. This is not a disclosure we bury in the fine print. It is the first thing we say in our Privacy Policy.

Can parents see their child's data?▼

Yes. Parents can request a complete export of all data associated with their child at any time by emailing cgb003@gmail.com. We respond within 30 days. School administrators also have access to student records through the Admin Dashboard and can share them with parents on request.

Where is student data stored?▼

All student data is stored in Supabase, hosted on Amazon Web Services (AWS) in the us-east-1 region (Northern Virginia). No student data is stored outside the United States.

Does Gregarious comply with COPPA?▼

Yes. Gregarious does not collect personal information from students under 13 without verifiable parental consent. In a school setting, the school provides this consent under applicable FERPA provisions. We never use children's data for advertising or commercial profiling.

What happens to student data when our school's contract ends?▼

Student data is retained for 60 days after the contract end date to allow data export. After 60 days, all student data is permanently deleted unless the school requests longer retention in writing. We will notify your account administrator 30 days before deletion.

Has Gregarious had any data breaches?▼

No. Gregarious has not experienced any data breaches. In the event of a breach affecting student data, we will notify affected schools within 72 hours and affected individuals within the timeframe required by applicable law.

Who do we contact for a security vulnerability?▼

Please email cgb003@gmail.com with the subject line 'Security Vulnerability'. We will acknowledge within 24 hours and provide a response within 72 hours. Please do not publicly disclose vulnerabilities before we have had a chance to address them.

Last updated April 10, 2026 · Questions: cgb003@gmail.com