Legal · Schools and districts

Student Data Privacy

How Naven handles student data for schools and districts: FERPA, California’s SOPIPA and Education Code 49073.1, COPPA for students under 13, Canada’s FIPPA, and other state laws.

Last updated 25 September 2026

FERPA: School official, under a signed agreement
Advertising to students: None
Sale of student data: Never
Data location: United States
Deletion: On request, and at the end of an agreement

1 · When this applies

This page describes how Naven handles student data: information about a student that a school, school district or other educational agency provides to Naven, or that Naven collects from a student through accounts the school sets up, under a signed agreement with that school. For students who sign up on their own, outside any agreement, the Privacy Policy and, under 13, the Children’s Privacy Notice apply.

2 · FERPA (United States)

Under the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99), a school may share education records with a provider it designates a “school official” with a legitimate educational interest (34 C.F.R. § 99.31(a)(1)(i)(B)). Under a signed agreement, Naven accepts that designation and its conditions:

Naven performs a service the school would otherwise use its own staff for, and is under the school’s direct control for the use and maintenance of education records.
Naven uses student data only for the purposes in the agreement, and does not re-disclose it except to the sub-processors named in it, or as the law requires.
The school owns and controls its student data. Parent and eligible-student requests to inspect, correct or delete records go through the school; Naven helps the school answer them within the time FERPA allows.
At the end of the agreement, or when the school asks, Naven deletes or returns the student data.

3 · California: SOPIPA and Education Code 49073.1

For K-12 schools and students, Naven follows the Student Online Personal Information Protection Act (Business and Professions Code § 22584) and, in its agreements, Education Code § 49073.1:

No targeted advertising to students, and no advertising at all — Naven shows none.
No profiling of a student for anything other than running the service for the school.
No sale or rental of student information, ever.
Pupil records belong to the school; a student may get a copy of content they created.
Deletion when the school asks, and at the end of the agreement.
Notice of unauthorized disclosure to the school, which the agreement sets out.
No use of pupil records to engage in targeted advertising, and parents may review records through the school.

Naven’s agreement can be the Naven data processing agreement, or the California Student Data Privacy Agreement a district already uses.

4 · Students under 13 (COPPA)

A school may consent to Naven collecting information from its students under 13, in place of each parent, for accounts the school creates for its own students and uses only for the school’s educational purposes. Naven then uses that information for nothing else, and the school can review it and have it deleted. Outside that, a parent’s signed consent is required — see the Children’s Privacy Notice.

5 · Canada: FIPPA and MFIPPA

Public schools and boards in Canada are bound by provincial law such as British Columbia’s Freedom of Information and Protection of Privacy Act and Ontario’s Municipal Freedom of Information and Protection of Privacy Act. Those laws apply to the school, not to Naven, and a school usually completes a privacy impact assessment before adopting a service. Naven supports that by:

stating plainly that data is stored in the United States (see sub-processors), so the school can assess it;
answering a privacy impact assessment questionnaire, and signing an agreement that limits Naven’s use of the data to the school’s purposes;
helping the school answer access and correction requests, and deleting data on request.

A province or school that requires student data to stay in Canada cannot use Naven today.

6 · Other state laws

Many states have student privacy laws with similar rules — among them New York Education Law § 2-d, the Illinois Student Online Personal Protection Act, and Colorado’s Student Data Transparency and Security Act. Naven signs the agreement or addendum a district’s state requires, including a Parents’ Bill of Rights where the law asks for one.

7 · What Naven does with student data, and what it never does

Naven does	Naven never does
Use it to provide messaging, calls and channels to the school’s students and staff	Sell or rent it
Screen messages before they are sent, automatically	Show advertising, targeted or otherwise
Process it through the named sub-processors only	Build profiles for anything but running the service
Delete it on request and at the end of the agreement	Use it to train AI models
Tell the school about an unauthorized disclosure	Share it with data brokers

Naven describes its safeguards in its agreements; it does not promise that data cannot be accessed without permission. It is not end-to-end encrypted, because it screens messages. See the Terms.

8 · Contact

For an agreement, a privacy impact assessment, or a request about a student’s data: shervin@shapoury.com, or the form on Naven for organizations.