School official exception
TPA Ventures processes education records under the FERPA school official exception, 34 CFR § 99.31(a)(1)(i)(B). We perform a service the School would otherwise perform with its own staff, we are under the School's direct control regarding use and maintenance of the records, and we use the records only for the purposes authorized by the School.
We do not redisclose personally identifiable information from education records except as permitted by 34 CFR § 99.33 and the School's written direction.
Legitimate educational interest and access scoping
Within TPA Ventures, staff see only the students in their caseload or building, matching the School's own definition of legitimate educational interest. Every view and edit is logged.
COPPA
Students do not create accounts or interact with TPA Ventures. To the extent any information about children under 13 is collected, it is collected by and for the School for an educational purpose, consistent with the Federal Trade Commission's guidance on school authorization under the COPPA Rule, 16 CFR Part 312. We use it only for the School's educational purpose and for no commercial purpose.
Student Privacy Pledge commitments
The Future of Privacy Forum retired the Student Privacy Pledge program in April 2025. TPA Ventures continues to hold itself to the Pledge's core commitments, and writes them into our customer agreements: no sale of student data, no behavioral advertising, no profiles for non-educational purposes, transparent practices, and strong security.
State student privacy laws
We comply with state student data privacy laws that apply to the Schools we serve, including California's Student Online Personal Information Protection Act (Cal. Bus. & Prof. Code § 22584) and Cal. Educ. Code § 49073.1, New York Education Law § 2-d and its regulations at 8 NYCRR Part 121, the Illinois Student Online Personal Protection Act (105 ILCS 85), and Texas Education Code Chapter 32, Subchapter D.
Where a state requires a parents' bill of rights, supplemental information or a specific data security plan, we provide it with the School's agreement.
No AI model training on student data
Student data is never used to train, fine-tune or evaluate artificial intelligence models, whether ours or our providers'. Our model providers process requests under contracts that prohibit training on customer content and run in U.S. regions.
Breach notification
If we discover unauthorized access to student data, we notify the affected School without unreasonable delay and within the time required by the School's agreement and applicable law, including within 7 calendar days of discovery for New York educational agencies under 8 NYCRR § 121.10 and no later than 30 calendar days after determining a breach occurred for Illinois schools under SOPPA. We cooperate with the School's investigation and parent notification.
Contact
Privacy questions: privacy@tpaventures.si. Security incidents: security@tpaventures.si.