Grad Pass Privacy Policy

Effective Date: December 16, 2025

Grad Pass ("we," "our," or "us") is committed to protecting the privacy and security of student information. This Privacy Policy explains how we collect, use, store, share, and protect personal data in compliance with applicable U.S. student privacy laws, including FERPA, COPPA, PPRA, and the Maryland Student Privacy Act.

This policy applies to all users of the Grad Pass platform, including students, parents or guardians, school administrators, and organization administrators.

1. Information We Collect

Grad Pass collects only the information necessary to provide educational and student service-learning functionality.

Student Information

Full name
Date of birth
School name and grade level
Student Service Learning (SSL) hours
Organization participation records
Approval records and digital signatures

Parent / Guardian Information

Full name
Email address
Relationship to the student
Electronic signature and consent metadata (timestamp, IP address when available)

Administrator & Organization Information

Name
Email address
Role and affiliated school or organization

2. How We Use Information

We use collected information only for legitimate educational purposes, including:

Tracking and verifying SSL hours
Managing student records
Facilitating approvals and digital signatures
Generating certificates and reports
Meeting school, district, and state requirements

Grad Pass does not use student data for advertising, marketing, or non-educational purposes.

3. FERPA Compliance

Grad Pass complies with the Family Educational Rights and Privacy Act (FERPA).

Student records are not publicly accessible
Access is restricted based on role:
- Students may access only their own records
- School administrators may access records for students in their school
- Organization administrators may access records only for students they supervise
Grad Pass acts as a school official with a legitimate educational interest under FERPA
Schools retain ownership and control of student education records

We maintain an audit trail documenting record access, approvals, and digital signatures.

4. COPPA Compliance (Children Under 13)

Grad Pass complies with the Children’s Online Privacy Protection Act (COPPA).

Parental Consent Requirement

Students under the age of 13 may not create an account independently
Parental or guardian consent is required before any student account is activated

Consent Flow

Student enters date of birth during signup
If under 13, signup is blocked
Parent or guardian email is collected
Parent receives a secure consent link
Parent reviews data collection and usage details
Parent provides electronic consent and signature
Student account is unlocked

Parents have the right to:

Review their child’s information
Request corrections
Request deletion of data
Revoke consent

5. PPRA Statement

Grad Pass does not collect sensitive personal information as defined by the Protection of Pupil Rights Amendment (PPRA).

Specifically, we do not collect data related to:

Political beliefs
Religious beliefs
Mental or psychological health
Family income
Personal opinions or survey responses

6. Maryland Student Privacy Act Compliance

For schools and districts in Maryland, Grad Pass complies with the Maryland Student Privacy Act.

We affirm that:

Student data is never sold
Targeted advertising is not used
Data is used solely for educational purposes
Reasonable administrative, technical, and physical safeguards are in place
Student data is deleted upon verified request

7. Data Access, Download, and Deletion

In compliance with FERPA, COPPA, and state privacy laws, Grad Pass provides data access controls.

Data Download

Students or parents may request a downloadable copy of student data, including:

Student profile information
Logged SSL hours
Approval records and signatures
Certificates

Data may be provided in PDF or CSV format.

Data Deletion

Students or parents may request account deletion
Requests are reviewed by administrators
Data may be retained for a limited period (e.g., up to 30 days) to meet school or legal obligations before permanent deletion

8. Data Retention

Student data is retained only as long as necessary to:

Fulfill educational requirements
Comply with school or legal obligations

Once no longer required, data is securely deleted or anonymized.

9. Data Sharing

Grad Pass does not share student information with third parties except:

With explicit school authorization
As required by law
With service providers acting on our behalf under strict confidentiality agreements

No data is shared for advertising or commercial purposes.

10. Security Measures

We implement reasonable safeguards to protect information, including:

Role-based access control
Secure authentication
Encrypted data transmission where applicable
Access monitoring and audit logging

11. Changes to This Policy

We may update this Privacy Policy periodically. Schools and users will be notified of material changes.

12. Contact Information

For privacy questions, data requests, or parental inquiries, please contact:

Grad Pass Privacy Team
Email: support@gradpass.org

By using Grad Pass, you acknowledge and agree to this Privacy Policy.

Page updated

Google Sites

Report abuse