Privacy Policy

SyncIEP LLC (“SyncIEP,” “we,” “us”) makes SyncIEP, a platform special-education teams use to write IEPs, monitor student progress, run IEP meetings, and manage caseloads (the “Service”). This policy explains what information we collect, how we use it, who we share it with, and how we protect and delete it. Most of the information in the Service comes from student education records, and we treat those records with the most care.

If your school or district has signed a Data Privacy Agreement (DPA) or other written agreement with us, that agreement controls wherever it differs from this policy.

1. Our commitments

• Student data belongs to the school, district, or educator who provides it. We process it only to provide the Service.
• We never sell student data or any personal information.
• We never use student data for advertising, and we never show ads in the Service.
• We never use student data to train AI models, and our AI provider is barred from training on it.
• We never build profiles of students except to carry out the educational purpose the school directed.
• We delete student data within 30 days after a school’s written request or the end of its account.
• We notify affected schools within 48 hours of confirming a breach of student data.
• These commitments bind any company that acquires SyncIEP.

2. Information we collect

Account information

For educators and school staff: name, email address, role or provider type, school or district, and state. For parents and guardians invited by a school: name, email address, and the students they hold educational rights for. If you sign in with Google, we receive your name and email address from Google. We store passwords only as one-way hashes.

Student records

Schools and authorized staff bring student information into the Service, either by entering it, uploading documents, or importing a roster. It can include:

• Name, student ID, school, grade, disability category, and enrollment details.
• IEPs, evaluations, assessments, present levels, goals, accommodations, services, and progress data.
• Student work samples and the grading of that work.
• Meeting records, prior written notices, signatures, and consent forms.
• Parent and guardian names and contact details, and notes of contact with families.

We do not ask for Social Security numbers, and we do not require a student’s date of birth or home address. Documents a school uploads may contain other details, such as demographics or health information. We handle anything in those documents as part of the student’s record.

Students do not have accounts, and we do not collect information directly from students.

Information you create in the Service

Drafts, messages, tasks, meeting schedules, messages to the Nora assistant, and support conversations.

Usage and device information

IP address, browser and device type, pages visited, features used, and timestamps. We use this to keep the Service secure, fix problems, and understand how the Service is used. We also keep an audit log of who viewed or changed each student record.

Payment information

Our payment processor collects card details directly. We never see or store full card numbers.

3. How we use information

• To provide the features you and your team use.
• To keep the Service secure, including detecting misuse and investigating incidents.
• To provide support when you ask for it.
• To send service messages, such as invitations, meeting notices, signature requests, and billing notices.
• To send educators occasional product news, which you can unsubscribe from at any time. We never send marketing to parents, guardians, or students.
• To meet our legal obligations.

We will not use student data for any new purpose without the school’s written permission.

4. AI in SyncIEP

SyncIEP uses AI to draft IEP content, grade student work against goals, read uploaded documents, and answer questions in the Nora assistant. Three rules govern it.

• AI drafts; people decide. Everything AI produces is a draft. An educator reviews, edits, and accepts it before it becomes part of a student’s record, and the Service records who accepted it. SyncIEP never makes eligibility, placement, or service decisions about a student.
• No training on student data. Our AI provider, OpenAI, does not use data sent through its API to train its models. OpenAI may keep requests for up to 30 days to monitor for abuse, then deletes them.
• Limited retention on our side. We delete the text of AI requests and responses from our logs after 30 days. Files attached to a Nora conversation are deleted within 24 hours unless you choose to save them to a student’s case.

5. Cookies and similar technologies

We use cookies and browser storage that the Service needs to work, such as keeping you signed in and protecting forms from forgery. We also use them to remember preferences, like a collapsed sidebar, and to understand how features are used so we can improve them.

We do not use advertising or retargeting cookies, and we do not let advertising networks track you in the Service. We do not currently respond to browser Do Not Track signals.

6. How we share information

We share information only in these cases:

• With your school team. Staff see student records according to the roles and permissions their school or district sets.
• With families. Parents and guardians see only what the school team shares with them, and only for students they hold rights for.
• With service providers who help us run the Service, listed in section 7.
• When the law requires it, such as a valid subpoena or court order. Unless the law forbids it, we tell the school first so it can respond.
• In a merger or acquisition, only to a successor that agrees to honor this policy for the data already in the Service. We will notify schools before that happens.
• With the school’s permission, in any other case.

7. Service providers (subprocessors)

Each provider receives only the data it needs for its job and is bound by a contract to protect it and use it only to provide its service to us.

Before we add a provider that will receive student data, we update this list and give district customers at least 30 days’ written notice, so they can raise objections.

8. Google user data

Sign in with Google and calendar sync are optional. If you sign in with Google, we receive only your name and email address. If you connect Google Calendar, SyncIEP adds the meetings you schedule in SyncIEP to your calendar and checks when you are busy while you schedule. For busy times, we read only start and end times and status, never event titles, descriptions, or attendees.

SyncIEP’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We never send Google user data to AI services and never use it to train any AI model. You can disconnect your calendar in Settings at any time, which deletes our stored access tokens. You can also revoke access from your Google account.

9. How we protect information

• Data is encrypted in transit (TLS) and at rest. Sensitive credentials, such as calendar tokens, are encrypted again at the application level.
• Each school, district, or individual account is walled off from every other. Access is denied by default and granted by role.
• Finalized records, such as signed documents and the audit log, are sealed so any tampering can be detected.
• We log access to student records, and schools can review who viewed or changed a record.
• Staff access to production systems is limited to the people who need it.
• We back up the database every night and test that backups can be restored.

If there is a breach

If we confirm unauthorized access to student data, we notify the affected schools and account holders within 48 hours of confirming it, or sooner if a law or contract requires. The notice explains what happened, what data was involved, and what we are doing about it. We work with schools to notify families as their state law requires.

10. Retention and deletion

We keep student data only while the school or educator has an active account and needs it to provide education services and meet legal obligations.

• When an account ends (the school or educator closes it, or a subscription lapses), we delete its student data within 30 days. Before that, you can export your records. Schools can instead ask us to return the data to them.
• On request. A school can ask us to delete a specific student’s data at any time. We finish within 30 days and confirm in writing if asked.
• Backups are deleted as they expire on our normal backup schedule. We never restore deleted data from a backup back into use.
• Exceptions. We keep data longer only when the law requires it or when a school places a legal hold, and only for as long as needed.

To delete your own account information, email us at the address below. We will verify the request and complete it, subject to the retention rules above.

11. Parents, guardians, and eligible students

Under FERPA and IDEA, parents and guardians have the right to review a student’s education records, ask for corrections, and in some cases ask for deletion. The school controls the records, so these requests go through the school. If a family contacts us directly, we forward the request to the school promptly and help the school respond within the time the law allows (45 days under FERPA).

Parents and guardians who use the parent portal see only what the school team shares with them.

12. FERPA

SyncIEP acts as a “school official” with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)). We perform a service the school would otherwise do itself, remain under the school’s direct control over how records are used and kept, use records only for the purposes the school authorizes, and do not disclose them to anyone else except as this policy and FERPA permit.

13. Children’s privacy and COPPA

SyncIEP is built for educators and families, not for children. Students do not create accounts or use the Service, and we do not knowingly collect personal information directly from children under 13. When a school provides information about students under 13, it does so for an educational purpose under the school’s authority, as COPPA allows, and we use it only to provide the Service to that school. If we learn that a child has given us personal information directly, we delete it.

14. California privacy rights

We follow California’s Student Online Personal Information Protection Act (SOPIPA) and Education Code § 49073.1 (AB 1584). We do not use student data for targeted advertising, do not build profiles of students for non-educational purposes, do not sell student data, and delete it when the school asks. Students’ records stay the property and under the control of the school.

California residents also have rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA, to:

• Know what personal information we collect about them and how we use and share it (sections 2, 3, and 6).
• Access, correct, and delete that information.
• Opt out of the sale or sharing of personal information for cross-context behavioral advertising. We do not sell or share personal information for that purpose, and have not in the past 12 months.
• Limit the use of sensitive personal information. We use it only to provide the Service.
• Not be treated differently for using these rights.

To make a request, email us. You may use an authorized agent with written permission. We will verify your identity before acting and respond within the time the law requires. Requests about a student’s education records go to the student’s school, as described in section 11.

15. Other state student-privacy laws

We follow the student-privacy laws of the states where our customers are located, including:

• New York Education Law § 2-d. We provide New York districts with the Parents’ Bill of Rights for Data Privacy and Security and our supplemental information as part of their data privacy agreement, and we meet § 2-d breach-notification requirements.
• Illinois Student Online Personal Protection Act (SOPPA). We sign written agreements with Illinois districts, give them the list of data elements we collect, and meet SOPPA’s breach-notification and deletion requirements.

We also support the Student Data Privacy Consortium’s National Data Privacy Agreement and its state versions.

16. Changes to this policy

If we make a material change, we will email account holders and post a notice in the Service at least 30 days before the change takes effect, and update the date at the top of this page. We will never weaken protections for student data already in the Service without the school’s consent. We record which version of this policy each account accepted.

17. Contact us

Questions, requests, or concerns about privacy:
support@synciep.com
SyncIEP LLC, 101 Springhurst Road, Bedford Hills, NY 10507