GraduateSmart

FERPA Compliance & Student Data Rights

Last updated: April 2, 2026

Our Commitment to Student Privacy

GraduateSmart is a 501(c)(3) nonprofit. We never sell student data. We never share personally identifiable information with third parties for commercial purposes. Student data belongs to the student — and we protect it accordingly.

FERPA

Family Educational Rights and Privacy Act — we align with all FERPA principles for student record privacy.

COPPA

Children's Online Privacy Protection Act — no personal data collected from children under 13 without parental consent.

CCPA / NY SHIELD

California Consumer Privacy Act and NY SHIELD Act — additional rights for California and New York residents.

1. What is FERPA?

The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. It applies to schools that receive federal funding and governs how student records can be accessed, shared, and corrected.

While FERPA primarily applies to educational institutions, GraduateSmart voluntarily aligns with FERPA principles as part of our commitment to student privacy. Any school district that partners with GraduateSmart and shares student data with us is governed by a Data Processing Agreement that reflects these principles.

2. What Data GraduateSmart Collects

GraduateSmart collects only the data necessary to provide the service:

Account Data

Name, email address, and password (stored encrypted)
Role (student, counselor, parent, org admin)
Account creation date

Academic Profile Data (students only)

Grade level, current school, GPA
SAT/ACT scores (optional)
State, city, ZIP code
Career interests and extracurricular activities

Sensitive Data (optional, student-controlled)

These fields are entirely optional and used only for scholarship matching:

Race, ethnicity, gender identity
Disability status
Household income range
Citizenship status
Military/veteran family status
First-generation college student status

This data is never shared with counselors, parents, organizations, or any third party.It is used exclusively within the platform's scholarship matching algorithm and can be deleted by the student at any time from their Profile page.

3. How GraduateSmart Uses Student Data

To provide personalized career, school, and scholarship recommendations
To calculate College Match scores and CLEP savings estimates
To allow counselors to monitor their assigned students' academic planning progress
To allow parents to view (read-only) their linked student's Roadmap Plan and progress
To generate anonymized aggregate statistics (e.g., "students collectively saved $X in tuition")

GraduateSmart does not use student data for advertising, does not sell data to colleges or universities, and does not share individual student data with any commercial third party.

4. Who Can Access Student Data

Data Type	Student	Counselor	Parent	Third Party
Name, grade, school	✅ Full	✅ Read	✅ Read	❌ Never
GPA, test scores	✅ Full	✅ Read	✅ Read	❌ Never
Roadmap & progress	✅ Full	✅ Read	✅ Read	❌ Never
Scholarship applications	✅ Full	✅ Read	✅ Read	❌ Never
Race, ethnicity, gender	✅ Full	❌ Never	❌ Never	❌ Never
Income, disability status	✅ Full	❌ Never	❌ Never	❌ Never
Email address	✅ Full	✅ Read	❌ Never	❌ Never

5. Student Rights

Every GraduateSmart student has the following rights:

Right to Access — You can view all data GraduateSmart holds about you from your Profile page.
Right to Correct — You can edit your profile data at any time from the Profile page.
Right to Delete Sensitive Data — Race, ethnicity, gender, disability, income, and citizenship fields can be cleared directly from your Profile page at any time.
Right to Delete Your Account — You can request full deletion of your account and all associated data by emailing privacy@graduatesmart.org. We will process the request within 30 days.
Right to Data Portability — You can request a copy of all data we hold about you in a machine-readable format by emailing privacy@graduatesmart.org.
Right to Opt Out — Sensitive demographic fields are optional. Not providing them does not affect platform access — scholarship matching will simply show all opportunities regardless of eligibility filters.

6. COPPA — Children Under 13

GraduateSmart does not knowingly collect personal information from children under 13 without verifiable parental consent. If you believe a child under 13 has created an account without parental consent, please contact us immediately at privacy@graduatesmart.org and we will delete the account promptly.

7. School District Partnerships & Data Processing Agreements

When a school district shares student data with GraduateSmart (for example, by providing student email lists for counselor assignment), we require a signed Data Processing Agreement (DPA) before any data transfer occurs.

Our DPA covers:

The specific categories of data being shared
The lawful basis for processing under FERPA
Data security and breach notification obligations
Data retention and deletion schedules
Subprocessor disclosure (Supabase, Vercel, Anthropic)
Student and parent rights under FERPA and applicable state law

To request a Data Processing Agreement for your school or district, contact us at partnerships@graduatesmart.org.

8. Security

All data encrypted in transit via HTTPS/TLS
Database protected by Row Level Security (RLS) on all tables — users can only access their own data
Passwords stored using bcrypt hashing — never stored in plain text
Authentication managed by Supabase Auth with JWT session tokens
Sensitive demographic data stored separately and never joined into counselor or parent queries

9. Data Retention

GraduateSmart retains student data for as long as the account is active. When a student requests account deletion:

All personally identifiable information is deleted within 30 days
Roadmap Plans, saved schools, and scholarship applications are deleted
Anonymized aggregate statistics (not linked to any individual) may be retained for reporting
Backup copies are purged within 90 days per our backup rotation schedule

10. Contact Us

For any privacy questions, data requests, or to exercise your rights under FERPA, COPPA, CCPA, or the NY SHIELD Act:

General Privacy: privacy@graduatesmart.org

School Partnerships & DPA Requests: partnerships@graduatesmart.org

Mailing Address: GraduateSmart Inc., New York, NY

Request Account Deletion

To permanently delete your GraduateSmart account and all associated data, email us from the email address associated with your account. We will process the request within 30 days.

privacy@graduatesmart.org

GraduateSmart