SFTS Carline Privacy Policy

Last Updated: February 8, 2026

1. Introduction

Saint-Fleur Technology Solutions LLC ("we", "us", or "our") operates the SFTS Carline mobile application and web dashboard (the "Service"). This Privacy Policy informs you of our policies regarding the collection, use, and disclosure of personal information when you use our Service.

This app is intended for use by authorized school staff members only. We are committed to protecting the privacy of student information in compliance with FERPA (20 U.S.C. § 1232g; 34 CFR Part 99).

2. Information We Collect

2.1 School Official Information

When you create an account as a staff member, we collect:

• Email address (for authentication)
• Display name
• School ID and role (admin, staff, teacher, principal)
• Device information (for mobile app functionality)

2.2 Student Information (Protected under FERPA)

Our Service processes limited student information necessary for dismissal operations:

• Student names
• Grade level
• Teacher assignment
• Dismissal group designation
• Family association (for pickup coordination)

Important: We do NOT collect or store:

• Student social security numbers
• Student home addresses
• Student birth dates
• Student photographs
• Academic performance data
• Disciplinary records
• Medical information

2.3 Family Information

• Family code (unique identifier for pickup)
• QR code token (for scanning purposes)
• Associated student names

2.4 Operational Data

• Dismissal scan timestamps
• Lane assignments
• Audit logs (staff actions for accountability)

3. How We Use Your Information

3.1 Legitimate Educational Interest

Under FERPA, school officials with legitimate educational interests may access student information. Our Service uses data exclusively for:

• Coordinating safe and efficient student dismissal
• Identifying arriving families via QR code scanning
• Notifying classroom teachers of student pickup
• Generating operational reports for school administrators
• Maintaining audit trails for security and compliance

3.2 School Official Definition

Per FERPA guidelines, a "school official" is a person employed by the school in an administrative, supervisory, academic, or support staff position. All users of this Service must be authorized school officials with legitimate educational interests in accessing student dismissal information.

4. Data Storage and Security

4.1 Cloud Infrastructure

All data is stored securely using Google Firebase services:

• Firebase Authentication: Secure email/password authentication with industry-standard encryption
• Cloud Firestore: Encrypted database with role-based access controls
• Cloud Functions: Server-side processing in secure, isolated environments

4.2 Security Measures

• All data transmitted over HTTPS/TLS encryption
• Role-based access controls (admin, staff, teacher, principal)
• Database security rules prevent unauthorized access
• Audit logs track all data access and modifications
• Nightly data cleanup removes temporary operational data
• Regular security audits and updates

4.3 Data Retention

• Student/Family Data: Retained for current school year only; deleted at year-end or upon school request
• Audit Logs: Retained for 1 year for compliance and security purposes
• Analytics Reports: Retained for 90 days in aggregate form only (no personally identifiable information)
• Operational Data: Reset nightly; dismissal state cleared daily

5. Data Sharing and Disclosure

5.1 No Third-Party Sharing

We do NOT share, sell, or rent student information to third parties for any purpose.

5.2 Limited Disclosure Circumstances

We may disclose information only in the following limited circumstances:

• With School Officials: As described in Section 3.1, authorized staff with legitimate educational interests
• With Parent/Guardian Consent: If explicitly authorized by the school in writing
• Legal Requirements: When required by law, court order, or subpoena (we will notify the school unless legally prohibited)
• Emergency Situations: To protect the health or safety of students (as permitted under FERPA § 99.36)

5.3 Service Providers

We use Google Firebase as our infrastructure provider. Google's compliance with data protection standards:

• Google Cloud is FERPA-compliant
• Covered under Google's Data Processing Amendment
• Subject to standard contractual clauses for data protection

6. Parent and Student Rights (FERPA)

6.1 Right to Inspect Records

Parents and eligible students (18+ or attending post-secondary institution) have the right to:

• Inspect and review student information maintained by the school
• Request corrections to inaccurate or misleading information
• Request deletion of student information (subject to school policy)

6.2 How to Exercise Rights

To exercise FERPA rights, parents/guardians should contact their school administrator directly. Requests will be processed within 45 days as required by federal law.

6.3 Filing Complaints

Parents have the right to file a complaint with the U.S. Department of Education if they believe their FERPA rights have been violated:

Family Policy Compliance Office
U.S. Department of Education
400 Maryland Avenue, SW
Washington, DC 20202-8520

7. Children's Privacy (COPPA)

While this application processes information about minors under 13, it is a school-authorized educational service operated exclusively by school officials. Under the Children's Online Privacy Protection Act (COPPA), schools may consent to the collection of student information on behalf of parents when used solely for educational purposes.

This app does NOT:

• Allow children to create accounts or access the service directly
• Collect information directly from children
• Display advertising to children
• Enable public disclosure of student information

8. Analytics and Cookies

8.1 Analytics Data

We collect anonymous, aggregate analytics to improve service performance:

• App usage statistics (anonymized)
• Performance metrics (load times, error rates)
• Feature usage patterns (no personally identifiable information)

Analytics are provided by Google Analytics for Firebase and do NOT include student names, identifiers, or other personally identifiable information.

8.2 Cookies

Our web dashboard uses essential cookies for:

• User authentication (session management)
• Security (CSRF protection)
• Functionality (user preferences)

We do NOT use:

• Third-party advertising cookies
• Tracking cookies for marketing purposes
• Social media pixels or trackers

9. Data Breach Notification

In the event of a data breach that compromises student information, we will:

1. Notify affected schools within 48 hours
2. Provide detailed incident report and affected data scope
3. Cooperate fully with school's notification requirements
4. Implement remediation measures immediately

10. School Control and Ownership

Important: The school retains full ownership and control of all student data. Schools may:

• Request data export at any time (provided in standard CSV/JSON format)
• Request immediate data deletion
• Revoke access for specific staff members
• Audit data access logs
• Terminate service and receive data export within 30 days

11. International Users

This Service is intended for use within the United States. Data is stored on servers located in the United States and is subject to U.S. laws, including FERPA.

12. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify schools of any material changes by:

• Email notification to school administrators
• In-app notification to all users
• Updating the "Last Updated" date at the top of this policy

Schools have 30 days to review changes and may terminate service if changes are unacceptable.

13. Your Consent

By using this Service, school officials acknowledge they have read and understood this Privacy Policy and agree to its terms. Schools are responsible for ensuring compliance with applicable state and local privacy laws.

References:
• Family Educational Rights and Privacy Act (FERPA) - 20 U.S.C. § 1232g
• FERPA Regulations - 34 CFR Part 99
• Children's Online Privacy Protection Act (COPPA) - 15 U.S.C. §§ 6501-6506
• Google Cloud FERPA Compliance: cloud.google.com/security/compliance/ferpa