Privacy policy

Sure Step ParaScheduler (“Sure Step,” “we,” “us”) is a scheduling tool that helps school districts assign paraeducators to students who receive support services. We provide the software to districts under a written agreement; the district decides what data is entered and who may access it.

Under the Family Educational Rights and Privacy Act (FERPA), we act as a “school official” performing a service the district would otherwise perform itself, under the district's direct control. The district is the data controller; Sure Step is a processoracting only on the district's instructions and the terms of our data-protection agreement (DPA).

For California districts we also operate consistent with the Student Online Personal Information Protection Act (SOPIPA): we do not use student data for targeted advertising, do not build student profiles for non-educational purposes, and do not sell student data.

• Student data (entered by site administrators): name, a district-assigned student ID, grade, optional gender, class schedule by period, support details such as support level, priority, and lunch/bus supervision needs (including the assigned lunch period), and an optional free-text administrative note used for scheduling context. We do not collect Social Security numbers, health records, or disciplinary records.
• Staff data: paraeducator roster (name, work email/phone, assigned site, active status, and — for agency staff — the staffing agency) and paraeducator attendance records (absence date and an optional reason), used to build coverage and to let district administrators review attendance per site for both district and agency staff. This includes self-contained-classroom (SCC) paraeducators, who are rostered to a classroom and have their own daily attendance (including, for agency staff, optional partial-day hours).
• Agency & billing data (entered by district administrators; not shown to site administrators): the district's approved staffing agencies and their contract terms — hourly rates (including per-agency, per-classroom-level SCC rates and contracted daily hours), optional per-paraeducator rate/hours overrides, and recorded hours/days worked — together with the district's per-site billing rate and invoices, and an optional agency contact email used to send that agency a monthly paraeducator-absence report. This is business and contract information used for cost analysis and invoice reconciliation; it contains no student data.
• Account data: the email address and name of district/site administrators and directors who sign in, plus authentication and audit records (who did what, and when).

We process this data only to provide the scheduling service to the district.

To generate paraeducator assignments, show coverage, track paraeducator attendance, analyze agency staffing costs, support FERPA data requests, and secure and audit access to the system. We do not use student or staff data for advertising, marketing, profiling, or training third-party AI models, and we do not sell it.

We use a small set of vetted infrastructure providers. Real student data is shared with a subprocessor only after the required data terms are in place:

• Supabase — database and authentication hosting.
• Vercel — application hosting.
• Resend — transactional email (account invitations, password resets, schedule-change notifications, and monthly paraeducator-absence reports sent to a staffing agency's contact). Schedule-change emails sent to a paraeducator include the names, classes, teachers, and rooms of the students that paraeducator is assigned to — a permitted disclosure to school staff over the district's own channel. Agency absence reports contain only that agency's paraeducator names and absence dates — no student data. A district-assigned student ID is never included in any email. Used only when email delivery is enabled.
• ClickSend — transactional SMS. Text messages are nudges only (for example, “a schedule change was made — please check your email”). They never contain student names, schedules, student IDs, or any other student data. Used only when SMS delivery is enabled.

We also load client-side libraries from a content delivery network (Cloudflare's cdnjs) so administrators can import and export roster files (a spreadsheet library) and generate PDF reports (a PDF library). Files chosen for import, and the contents of any export, are processed in the administrator's own browser; their contents are not sent to the content delivery network.

• Every database table is protected by row-level security that is closed by default, scoping each user to only their own district or site.
• Data is encrypted in transit (HTTPS/TLS) and at rest by our hosting providers.
• District administrators never see another district's data; within their own district they can view the paraeducator roster (names) and attendance summaries but cannot see any site's student records. Site administrators see only their own site — and never agency contract or cost figures. Sure Step directors cannot see student data at all by default. To assist a single district, a director may enter either a read-only “support mode” (to look only) or, when changes are needed, a “full-access” mode that lets them act as that district's administrator. Both require a stated reason, are limited to that one district, expire automatically after one hour, and are recorded in the district's append-only audit log; any change made in full-access mode is attributed to the director — so the district can see who acted, when, and why.
• Administrative access and data requests are recorded in an append-only audit log.

We retain district data for as long as the district uses the service. A district administrator can request a full data export or a data deletionat any time from within the app. A deletion is confirmed by a director before it runs; it permanently removes student records (including their schedules and assignments), while the staff roster, the district's contract record, and the append-only audit log are retained. A counts-only certification of the deletion (the number of records removed, with no names) is kept as proof that it occurred. On termination, district data is deleted per the DPA.

Because the district controls the educational records in Sure Step, parents and eligible students should direct requests to inspect, correct, or delete records to their school district, which can fulfill them using the export and deletion tools we provide. We support the district in honoring those FERPA rights.

Sure Step is used by district staff, not by students directly, and accounts are created only for authorized adult administrators. Any student information present is entered by the district under FERPA, with the school acting in place of parental consent for educational purposes.

We will update this policy as the service evolves and revise the “last updated” date above. Material changes affecting a district's data will be communicated to the district per our agreement.

This service is provided by Sure Step Education, LLC. Questions about this policy or a district's data can be directed to nick@surestepeducation.com, or to the Sure Step designated contact named in your district's agreement.