Student Data & School Privacy

Our role

Sub is built for school operations such as leave management, substitution coverage, classroom assignments, and related administrative workflows. The school or district decides what information is entered into the product and how it is used. In those cases, the school or district is the controller and Sub acts as a processor or service provider.

Data minimization

• We expect customers to avoid storing more personal information than needed for the workflow.
• The service is intended primarily for staff, scheduling, and school operations data.
• If customer workflows involve student-related information, that data should be limited to what is necessary for legitimate school operations.

No advertising use

We do not use student or school data for behavioral advertising, profile building, or unrelated commercial targeting.

School control and requests

Schools and districts control user permissions, workflow access, and the underlying records they submit to the product. Requests to access, correct, export, or delete school-managed records should generally be made through the school or district first.

Vendors and subprocessors

We may use service providers to host, secure, or support the product. Those providers are expected to process customer data only for authorized service purposes and under appropriate confidentiality and data protection commitments.

Retention

We retain school data only as long as needed to provide the service, meet contractual commitments, satisfy legal obligations, and maintain secure backups or audit trails. Customers may request return or deletion of their workspace data subject to those obligations.