Skip to content
Expanding Minds

Legal

Privacy Policy

Effective Date: June 1, 2026

This Privacy Policy explains how Expanding Minds Inc. ("we," "our," or "us"), a Massachusetts-based corporation, collects, uses, protects, and discloses information when you use our school management platform, website, and related services (collectively, the "Service").

We act as a Data Processor for the student and institutional data managed by our school clients, who act as the Data Collectors and Controllers.

1. Information We Collect

We collect information provided by you or your school, information generated automatically through your use of our platform, and information from third-party integrations authorized by your school.

  • School Administration Data: Names, job titles, business email addresses, phone numbers, and billing information of school staff users.
  • Student and Family Data (Provided by Schools): Student names, enrollment status, and parent/guardian contact details provided through admissions and enrollment workflows.
  • Applicant Data: Information submitted via school admissions portals, including inquiry forms and applications.
  • Usage and Technical Data: IP addresses, browser types, device information, and activity logs tracking platform interactions.

2. How We Use Information

We process data strictly to deliver and optimize our services, including:

  • Managing school admissions, enrollment, and communication pipelines.
  • Processing subscription billing and transactions securely.
  • Providing customer support, system maintenance, and troubleshooting.
  • Ensuring platform security, monitoring for fraud, and verifying identities.

3. Student Privacy & Regulatory Compliance Commitments

Because our service handles student information, we strictly adhere to federal, state, and educational privacy frameworks:

  • FERPA Compliance:We handle student education records as a "school official" under the Family Educational Rights and Privacy Act (FERPA) and process data solely for authorized educational purposes.
  • COPPA Compliance: We do not knowingly collect personal information directly from children under 13 without verifiable school or parental consent.
  • Massachusetts Data Privacy (201 CMR 17.00): We maintain a comprehensive Written Information Security Program (WISP) to protect the personal information of Massachusetts residents against unauthorized access.
  • No Commercialization: We never sell student or family data, nor do we use it to build advertising profiles.

4. Data Sharing and Third Parties

We only share information with trusted third parties under strict confidentiality terms:

  • Authorized Sub-processors: Leading cloud infrastructure providers, secure payment processors, and transactional email delivery systems.
  • School Integrations: Third-party software tools (e.g., LMS platforms, accounting software) explicitly connected to the service by the school administrator.
  • Legal Compliance: When required by law, subpoena, or valid court order.

5. Data Security and Retention

  • Security Measures: In compliance with Massachusetts standards, we implement enterprise-grade security, including AES encryption for data at rest, TLS encryption for data in transit, multi-factor authentication (MFA), and routine vulnerability scans.
  • Retention: We retain school-controlled data only for the duration specified in our contract with the school. Upon contract termination, data is securely deleted or returned in accordance with our data destruction policy.

6. User Rights & Contact Information

Depending on your jurisdiction, users may have the right to access, correct, or delete their personal data. For requests regarding student records, parents must contact the respective school administration directly.

For inquiries about this policy, contact us at [email protected].