Privacy Policy
BehaviorDash is used by schools and behavioral teams to record and review behavior data. Most of that data is about children. This policy explains exactly what we hold, what we deliberately do not hold, who else touches it, and how long it stays.
1. Our role
When a school or district uses BehaviorDash, the school remains the owner of the student data. We process it only on the school's behalf and only to provide the service. We do not acquire ownership of student records by holding them.
Under the Family Educational Rights and Privacy Act (FERPA), we act as a school official with a legitimate educational interest, under the direct control of the school with respect to the use and maintenance of education records. We use student data only for the purposes the school authorizes, and we do not re-disclose it except as described in this policy or as the school directs.
There is no such thing as being “FERPA certified.” FERPA places obligations on the school. What a vendor can do is operate within the school-official exception and contract accordingly — which is what we do, and what the commitments in this policy describe.
2. What we collect
Only what the service needs to function. Specifically:
| Category | Fields |
|---|---|
| Student identity | First name, last name, preferred name, a school-assigned student code, an optional external student ID, enrolment status, assigned location, and the date a student exited the program. |
| Behavior data | Session records — the behaviors targeted, counts, durations, intervals, latencies, trial results, task-analysis steps and ratings — plus session notes, the phase in effect, and arrival and dismissal times. |
| Incident records | Antecedent, behavior and consequence descriptions, structured categories for each, and a hypothesized function. |
| Behavior plans | Targets, goals, baselines, mastery criteria, replacement skills, antecedent strategies and response procedures. |
| Sign-off | A staff member's drawn signature image, the time it was captured, and the review decisions and comments attached to a session. |
| Staff account data | Email address, first and last name, organization role, and — where the school uses timekeeping — clock-in and clock-out times and any correction reason. |
| Activity records | An audit log of changes: who acted, what changed, when, and a before-and-after snapshot of the affected record. |
| Scheduling | Appointments, assigned staff, locations and school calendar days. |
3. What we do not collect
This is as important as the list above, and it is verifiable in our data model. BehaviorDash holds no field anywhere for:
- Date of birth or age
- Home address, telephone number or any family contact detail
- Parent or guardian names
- Diagnosis, medical records, medications or allergies
- Insurance, Medicaid or payment information
- Social Security numbers or other government identifiers
- Race, ethnicity or gender
- Biometric identifiers, precise location, or device advertising identifiers
We do not collect these because the service does not need them. A behavior record is useful without them, and data we never hold cannot be exposed.
4. How we use it
To operate the service for the school that entered the data: recording sessions, generating graphs and reports, routing sessions for supervisor review, maintaining the audit log, and providing support when the school asks for it.
We use aggregate, non-identifying operational metrics — such as error rates and feature usage counts — to keep the product working. These never contain student names, student codes or session content.
5. What we never do
- We never sell personal information. Not student data, not staff data, in any form, to anyone.
- We never use student data for advertising, behavioral targeting, or building a profile for any purpose other than the educational one the school authorized.
- We never use student data to train machine-learning or AI models, our own or anyone else's.
- We never share one organization's data with another. Isolation is enforced in the database itself, not only in the application.
- We never disclose student data to third parties except the processors listed below, or where the school directs us to, or where we are legally compelled — and in that last case we will notify the school unless the law forbids it.
6. Who processes it
We use a small number of infrastructure providers. They process data solely to host the service and are bound by their agreements with us:
| Provider | Purpose |
|---|---|
| Supabase | Database hosting, authentication and file storage. Student and staff data is stored here. |
| Cloudflare | Serves the application and website. Handles requests in transit; does not store student records. |
Student records are stored in our Supabase database instance. A school may ask us for the specific hosting region for its agreement or security review, and we will provide it in writing. We will update this policy and notify schools before adding any processor that handles student data.
7. Security
- Two-factor authentication is required for every user, in every role, with no opt-out. Not just administrators.
- Organization isolation is enforced at the database layer using row-level security, so one school's records are unreachable from another school's session even in the event of an application fault.
- Data is encrypted in transit and at rest by our hosting platform.
- Repeated failed sign-in attempts pause sign-in for a cooling-off period.
- Changes are recorded in an audit log that administrators can read, showing who changed what and when.
- Reports can be produced de-identified, and an organization can choose to display students by code rather than by name, as an organization-wide setting rather than a step someone has to remember.
No system is perfectly secure. If a breach affects a school's data, we will notify that school without undue delay and no later than 72 hours after we confirm it, with what we know about scope and remediation.
8. Retention and deletion
Behavior records are retained for seven years by default, which reflects the record-retention period commonly expected for special-education records. An organization can ask us to set a different period; there is no self-serve control for it in the application, and the period in effect is shown to administrators under Settings → Students & privacy.
Retention is counted from the date a student leaves, and reaching the end of the period makes a record eligible for review rather than deleting it. Nothing is deleted automatically or on a schedule. A purge is a deliberate act, carried out one student at a time and recorded.
A school may request export or deletion of its data at any time. On termination, we will return or delete the school's data on request; absent instructions, we delete it within 90 days. Backups are purged on their normal rotation.
9. Family and staff rights
Parents and eligible students: your rights to inspect, review and request correction of education records run through the school, not through us. FERPA gives the school the responsibility of responding, and the school controls the record. Contact the school directly; if the school asks us to help fulfil a request, we will.
Staff: you may access and correct your own account information in the application, and ask your organization's administrator about the time and activity records held about you.
Where state law grants additional rights — including under state student-privacy statutes — we honour them through the school's agreement with us.
10. Children's privacy
BehaviorDash is not offered directly to children or to families. It is provided to schools and behavioral organizations, and accounts are created only by those organizations for their staff.
Where student data concerns a child under 13, the school provides the necessary consent or authorization under the applicable framework, in the same way it does for other educational service providers. We do not knowingly collect personal information directly from a child.
11. The public website
This website is separate from the application. If you submit an email address to request access, we use it only to contact you about BehaviorDash and you can ask us to remove it at any time. We do not sell it and we do not pass it to advertisers.
This website sets no cookies and runs no analytics. There is no Google Analytics, no tag manager, no advertising pixel, no session recorder, and nothing is written to your browser's storage. We do not track you across sites, and there is no consent banner because there is nothing to consent to.
One third party is involved: the site loads its typefaces from Google Fonts, and your browser's request for those files reveals your IP address to Google. We do not control that, and we mention it because it is the only external request the page makes.
12. Changes to this policy
If we make a material change affecting how student data is handled, we will notify the schools using BehaviorDash before it takes effect, and update the date at the top of this page. We will not apply a materially different use to data already collected without the school's agreement.
13. Contact
Questions about this policy, requests from schools, and security reports: [email protected].
BehaviorDash
[email protected]
Schools requiring a signed data privacy agreement, a completed security questionnaire, or our registered business details for procurement should contact us at the address above and we will provide them.