Privacy policy

Last updated October 14, 2026

Who we are

Gradus K12 is classroom management software (hall passes, attendance, a time clock and classroom tools) for high schools. It is operated by Taft Ranch, LLC ("we"). Schools are our customers: we handle student information on the school's behalf and under its direction, and only to provide the service to the school.

Who it's for

Gradus K12 is built for high school students (14 and older) and school staff. It is not directed to children under 13. If a school chooses to use it with younger students, the school gives consent on behalf of parents, as federal law (COPPA) allows, and the information is used only for school purposes.

What we collect

• Students: name, school ID number, classes and teachers, and optionally a photo or ID card number, as provided by the school or its student information system (such as Aeries).
• Activity in the app: hall passes (where, when, how long), office, counselor and nurse visits, check-ins, late arrivals and early checkouts, time clock entries, and, where the school uses them, classroom economy records.
• Special education services (only where the school uses it): a student's IEP service types and minutes (for example, 250 minutes a week of specialized academic instruction) and the minutes delivered, entered by the student's case manager. Not the IEP itself, disability categories or evaluations.
• Staff: name, school email address, role, and settings such as desktop alerts.
• Technical: sign-in records and a log of staff access to student records, kept for security.
• Website visitors: if you use our contact form, your name, email and message, used only to reply to you.

Students don't create original work (essays, uploads) in Gradus K12. Their records can be exported by the school and given to the student or family on request.

What we don't collect

We don't use GPS or track students' physical location, and we don't monitor student devices or browsing. A hall pass records only the destination picked and the times. Photos are used only so staff can recognize students; we don't use facial recognition or any biometrics.

How we use it

Only to provide the service to the school: running passes and attendance, showing staff what they're allowed to see, alerting staff (for example, when the office asks for a student), and keeping the system secure and working. We may use de-identified, combined information (for example, the average length of a hall pass across schools) to improve Gradus K12. We never try to re-identify it, never sell it, and never share it in a way that identifies a student or a school.

What we never do

• We never use student information for advertising of any kind, in Gradus K12 or anywhere else.
• We never build a profile of a student for any purpose other than the school's.
• We never sell or rent student information.
• We don't send student information to AI services or use it to train AI.

FERPA: we work for the school

When we handle education records, we act as a "school official" under FERPA. We work under the school's direct control, use records only for the school's purposes, and don't pass them on except as the school authorizes or the law requires.

Who can see it

• At the school: staff see students in their own classes, unless the school gives their title wider access. Students see only their own records. Special education service minutes are visible only to the student's case manager and staff the school names as special education coordinators, never to other teachers or to students.
• At Gradus K12: only our founder can access student data, only to support or secure the service, and is trained on student privacy and security.
• Service providers, each under a contract that protects data at least as well as this policy: Google Cloud / Firebase (hosting, database, sign-in, email and alerts) and Cloudflare (delivers the website at each school's address). Aeries data is read, with the school's permission, from the school's own Aeries system. We'll tell schools before adding a provider that handles student information.
• Legal requests: if a court or government agency asks for student information, we'll refer it to the school and notify the school before disclosing anything, unless the law forbids it.
• If the company changes hands: student information may move to a new owner only if it keeps following this policy. We'll tell schools first, and they can have their data deleted.

Where it's stored and how it's protected

Data is stored and processed in the United States on Google Cloud, encrypted in transit and at rest. Each school's data is kept separate. Access is controlled by sign-in and role, idle screens sign out, and staff access to student records is logged.

If something goes wrong

If we learn that student information was accessed or disclosed without authorization, we'll notify the affected school within 72 hours of discovering it. We'll explain what happened, what information was involved and what we're doing about it, and we'll help the school notify families as the law requires.

The school's control, and requests from families

The school owns its data. A school can ask us to correct, export or delete its records by writing to privacy@gradusk12.com.

Parents, guardians and students 18 or older can ask their school to see or correct their Gradus K12 records. The school can make most corrections itself or pass the request to us, and we'll respond within 30 days. If you write to us directly, we'll check with your school before acting.

How long we keep it

We keep a school's records while the school uses Gradus K12, so staff can see its history. When a school stops using Gradus K12, or asks us to delete its data, we delete it, including any backup copies, within 90 days, unless the law requires us to keep it longer, and we'll confirm the deletion in writing on request. Sign-in and access logs used for security are kept for up to one year.

Cookies and tracking

We use only the cookies and browser storage needed to sign you in and keep the app working. We don't use advertising cookies or third-party analytics, we don't track you across other websites, and we don't let others do so through our service. Because of this, we don't change anything in response to browser "Do Not Track" signals.

Student privacy laws

We support schools in meeting their obligations under FERPA, COPPA, California's student privacy laws (SOPIPA and Education Code 49073.1) and other states' laws. We'll sign a data privacy agreement with a school or district on request, including state-specific terms such as New York's Parents' Bill of Rights, Illinois SOPPA and Texas requirements. Where California consumer privacy law applies, we act as a service provider to the school.

Changes to this policy

We'll update the date above when this policy changes, and we'll tell schools at least 30 days before a significant change takes effect. We won't change how we use student information in a significant way without the school's agreement. Earlier versions are available on request.

Contact

Gradus K12 is operated by Taft Ranch, LLC. Questions or requests: privacy@gradusk12.com, or our contact form. This policy is governed by the laws of California.