How We Handle Your Personal Information
boardofeducations.org/ takes data protection seriously. This page sets out what we collect from you as a visitor, why, and the rights you have under CCPA/CPRA, the Texas TDPSA, the Florida Digital Bill of Rights, and other applicable U.S. state privacy laws — plus a clear note about why we do not collect any FERPA-protected student information.
What’s on this page
- Who we are
- Scope of this policy
- Information we collect
- FERPA carve-out — student records
- How we collect it
- Why we collect it
- Who we share with
- “Sale” and “sharing”
- Cookies and analytics
- Retention
- California rights
- Texas rights
- Florida rights
- Other state rights
- How to exercise rights
- Children — COPPA
- Security
- International visitors
- Changes to this policy
1. Who We Are
boardofeducations.org/ is an independent informational guide that publishes practical, step-by-step guides to U.S. State Boards of Education, state Departments of Education, local school district boards, and the federal K-12 oversight framework. We are the business and the controller for the personal information described on this page.
For any privacy-related question, contact us at info@boardofeducations.org with the subject line “Privacy request” and we will respond within the time limits set out below.
2. Scope of This Policy — Important
This privacy policy covers personal information about you, the visitor to boardofeducations.org/. It does not cover student records, education records, IEPs, transcripts, or any other information protected under the federal Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. §1232g) or state student-data-privacy laws — those are separate, third-party records held by schools, districts, and state Departments of Education. We do not host, collect, or process them. Concerns about a student record should be raised with the school or district that holds it, not with us. Section 4 below explains the FERPA carve-out in full.
3. The Personal Information We Collect About You
| Category | Examples | Source |
|---|---|---|
| Identifiers | Email address, name (if provided), IP address | You · Your browser, automatically |
| Contact content | The content of messages you send us | You — when you email us or use a contact form |
| Internet/network activity | Pages visited, time on page, click paths, referring URL | Cookies and analytics, when you consent |
| Device and technical data | Browser, device type, OS, approximate location from IP | Your browser, automatically |
| Inferences | Aggregate inferences about which content is most useful | Derived from analytics, where consented |
| Advertising identifiers | Identifiers used to limit ad frequency and measure ad performance | Third-party advertising networks, when you consent |
We do not collect Sensitive Personal Information as defined under CCPA/CPRA — no Social Security numbers, government identification numbers, financial accounts, precise geolocation, racial or ethnic origin, religious beliefs, union membership, contents of mail/email/text, genetic data, biometric data, sex-life or sexual-orientation data, or specific health information about you. We do not ask for it and you should not send it through our contact channel.
4. Student Records and Education Records — FERPA Carve-Out
The Family Educational Rights and Privacy Act of 1974 (FERPA), 20 U.S.C. §1232g, protects the privacy of student education records held by schools that receive federal funding. FERPA-protected records include grades, transcripts, IEPs (Individualized Education Programs), 504 plans, attendance, disciplinary records, and other personally identifiable student information. boardofeducations.org/ does not host, request, collect, store, or process any FERPA-protected information about students.
If you have a question about a specific student record, contact the school, district, or state Department of Education that holds the record. FERPA gives parents (and students 18+) the right to inspect and review their own (or their child’s) education records. FERPA complaints go to the U.S. Department of Education’s Student Privacy Policy Office at studentprivacy.ed.gov.
If you accidentally include student-identifying information in a message to us — a child’s name and IEP details, for example — we will not use it, and we will delete the message after responding (or sooner if requested). We strongly suggest not sending student-specific information through any unsecured channel, including email.
5. How We Collect Personal Information
- Directly from you — when you email us, complete a contact form, or set cookie preferences.
- Automatically — when you visit the site, your browser sends standard technical information so the page can load.
- From third-party services we use — analytics and advertising providers, but only after you have given consent through our cookie banner.
6. Business Purposes for Collection and Use
- Providing the website and its content
- Responding to questions, corrections, and feedback
- Securing the site and protecting against abuse, fraud, and unauthorized access
- Auditing interactions and measuring site performance (analytics, where consented)
- Supporting display advertising that funds the site (where consented)
- Complying with legal obligations and responding to lawful requests
We do not use personal information for automated decision-making with legal or similarly significant effects, and do not engage in profiling within the meaning of state privacy laws.
8. “Sale” and “Sharing” of Personal Information
We do not sell personal information for money. However, under CCPA/CPRA the term “sale” is broad, and use of certain advertising cookies may meet the CCPA/CPRA definition of “sharing for cross-context behavioral advertising.” Where that applies, you have the right to opt out — see Section 11 for the California-specific procedure and Section 9 for the cookie controls.
The site honors the Global Privacy Control (GPC) signal as a valid opt-out of “sale” and “sharing” under CCPA/CPRA, the Colorado Privacy Act, and the Connecticut Data Privacy Act.
9. Cookies, Analytics, and Advertising
For full detail — including the cookies used, third-party services, and how to manage them — see our Cookie Policy. Key controls: the cookie banner, the “Cookie settings” link in the footer, browser-level controls, and industry opt-outs (NAI, DAA).
10. How Long We Keep Personal Information
| Category | Retention |
|---|---|
| Email correspondence and contact-form messages | Up to 24 months from last contact, then deleted unless an active matter requires longer retention |
| Server access logs (IP addresses, request data) | Up to 90 days, then aggregated or deleted |
| Analytics data | Aggregated; identifiable data retained no longer than 14 months |
| Cookie consent records | 12 months from when you set your preference |
| Backups | Rotating backups deleted on a 30–90 day cycle |
11. California Rights (CCPA / CPRA)
Right to know
Categories and specific pieces of personal information we have collected, sources, business purposes, and recipients.
Right to delete
To request deletion of personal information we hold, subject to legal exceptions.
Right to correct
To request correction of inaccurate personal information.
Right to opt out of sale/sharing
To opt out of any “sale” or cross-context behavioral advertising “sharing.” We honor the Global Privacy Control signal.
Right to limit use of sensitive PI
We do not collect Sensitive Personal Information, but the right exists in principle.
Right to non-discrimination
You will not be denied service or charged more for exercising these rights.
To exercise these rights, email info@boardofeducations.org with the subject line “California privacy request.” We respond within 45 days as required by CCPA, with one possible 45-day extension. You may also escalate to the California Privacy Protection Agency at cppa.ca.gov or the California Attorney General.
12. Texas Rights (TDPSA)
If you are a Texas resident, the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024, gives you:
- Right to confirm and access — to confirm processing and access your personal data
- Right to correct — to correct inaccuracies
- Right to delete — to delete personal data
- Right to data portability — to obtain a copy in a portable, technically feasible format
- Right to opt out — of (a) targeted advertising, (b) sale of personal data, and (c) profiling that produces legal or similarly significant effects
To exercise your TDPSA rights, email us with subject “Texas privacy request.” We respond within 45 days. Escalation: Texas Attorney General at texasattorneygeneral.gov.
13. Florida Rights (FDBR)
Florida residents have rights under the Florida Digital Bill of Rights (FDBR), effective July 1, 2024 (with size thresholds for which businesses are covered):
- Right to confirm processing and access personal data
- Right to correct inaccurate personal data
- Right to delete personal data provided by or obtained about you
- Right to data portability
- Right to opt out of targeted advertising, sale of personal data, and profiling for decisions that produce legal or similarly significant effects
To exercise FDBR rights, email us with subject “Florida privacy request.” Escalation: Florida Attorney General at myfloridalegal.com.
14. Other State Privacy Rights
| State | Law |
|---|---|
| Virginia | Virginia Consumer Data Protection Act (VCDPA) |
| Colorado | Colorado Privacy Act (CPA) — recognizes Universal Opt-Out Mechanisms |
| Connecticut | Connecticut Data Privacy Act (CTDPA) |
| Utah | Utah Consumer Privacy Act (UCPA) |
| Oregon | Oregon Consumer Privacy Act (OCPA) |
| Montana | Montana Consumer Data Privacy Act (MCDPA) |
| Delaware, Iowa, Indiana, Tennessee, New Jersey, New Hampshire, Kentucky, Minnesota, Maryland, Rhode Island | Comprehensive state privacy laws (effective dates vary) |
To exercise these rights, email us with the subject line “[State] privacy request.” We respond within the period required by the applicable law (typically 45 days, with possible extensions).
15. How to Exercise Your Rights
For all privacy requests, email info@boardofeducations.org. Include enough information for us to identify the data you’re asking about. We may need to verify your identity before responding — most commonly by confirming you control the email address that submitted the request.
Under CCPA and similar state laws, you may use an authorized agent to submit requests on your behalf. We may require written authorization and verification of the agent’s identity before processing.
16. Children — COPPA Compliance
This site is not directed at children under 13 and we do not knowingly collect personal information from children under 13. We comply with the federal Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§6501–6506, and its implementing regulations at 16 C.F.R. Part 312. If we learn we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly.
boardofeducations.org/ is not an EdTech service and does not contract with schools or districts. The COPPA "school authorization" pathway used by some EdTech vendors does not apply to us — we don't operate in that capacity.
17. Security
We apply technical and organizational measures appropriate to the risk: encryption of data in transit (HTTPS across the site), access controls on administrative tools, regular software updates, secure authentication for our editorial team, and contractual security commitments from vendors. If we become aware of a breach involving your personal information, we will notify you and applicable authorities consistent with state breach-notification laws including those of Texas (Tex. Bus. & Com. Code §521.053), California (Cal. Civ. Code §1798.82), and similar laws in other states.
18. International Visitors (GDPR / UK GDPR)
The site is operated for a U.S. audience but is accessible globally. EU and UK visitors have rights under the EU GDPR and UK GDPR — access, rectification, erasure, restriction, portability, and objection. UK residents may complain to the Information Commissioner’s Office at ico.org.uk.
19. Changes to This Policy
We update this policy when our practices change or when state privacy laws change. The “Last reviewed” date at the top reflects the current version. Substantive changes will be flagged on the homepage banner for at least 30 days. This policy is read alongside our Cookie Policy, Terms of Service, and Disclaimer.
Questions About Your Personal Information?
Email us. We respond to general privacy questions within seven business days, and to formal state-law requests within the deadline set by the applicable law.
📧 info@boardofeducations.org