Student data privacy agreement

A plain-language summary of what we commit to when we sign the SDPC National Data Privacy Agreement. The signed agreement is what governs; this page is a summary, not legal advice.

Agreement

We sign the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement (NDPA), with your state's Exhibit if needed, on request for school and district customers.

Role under FERPA

Under a school agreement, Homeroom acts as a school official with a legitimate educational interest, under the school's direct control for student records.

Data minimization

Student and parent names, emails, and phone numbers are replaced with placeholders before text reaches an AI model. There are no student accounts.

No secondary use

We never sell data, never use it for advertising, and never use customer content to train AI models.

Retention and deletion

Email content and drafts are deleted automatically after 30 days. Teachers can delete everything instantly; schools can request deletion at any time, completed within 30 days.

Security

Encryption in transit (TLS) and at rest (AES-256-GCM application-level encryption for teacher content and inbox tokens). Inbox access is limited to reading recent mail and creating drafts; Homeroom never sends email.

Subprocessors

Cloudflare (hosting, storage, and Workers AI model inference on tokenized text only). Payment processing by Stripe for paid plans. We'll notify schools before adding subprocessors.

Breach notification

We notify affected schools without unreasonable delay and within the timeframe the NDPA or state law requires.