The records your schools keep in Hajos belong to the district, not to us. Where your district names us a FERPA school official, we work under its direct control and use its records only for what it authorizes. Erasure is the district’s call; its staff raise the request and we carry it out.
In the policy: Who controls school data →Every message gets a keyword check on our own servers as it is sent, before anyone is notified. What a student writes on their own team goes no further, under any setting, and that boundary is enforced in three separate places in the code. AI review exists for messages from coaches and parents, and only where a district turns it on.
In the policy: Message safety, and where AI comes in →Opening someone else’s private conversation takes a safety review: a re-entered password, an emailed code, a written reason, and a session that ends after five idle minutes. Every conversation opened, every parent view and every export is logged with who and when. The audit log is never deleted on a schedule.
In the policy: Who can see what inside your school →Your district decides how long messages and team documents are kept; the default is seven years. A legal hold outranks the schedule and any erasure. A student under 13 cannot open an account, and parent views of a student’s conversations end on their 18th birthday.
In the policy: How long we keep it, and how it gets deleted →Every connection is HTTPS. The database, its daily backups and file storage are encrypted where they sit. Everything behind a sign-in is checked on our servers against who you are and what your role lets you reach, and sign-in attempts are limited per address.
In the policy: How we protect it →If personal data is lost, exposed or reached by someone who should not have it, we tell the affected districts without delay and within 72 hours of confirming it, with what happened, what data, whose, and what we recommend. Your district decides how families are told.
In the policy: If something goes wrong →