Privacy Policy

This policy explains how ND Academy Parent Club (the "Club") handles personal information in the ND Academy Parent Club portal — the website, the installable app, and the emails, text messages and notifications it sends.

It covers parents and guardians, School staff, coaches and volunteers who use the Portal, and the information about students that families and the School enter into it.

The Club decides how information in the Portal is used. Records the School holds in its own systems are governed by the School's policies, not this one.

Information you give us, or that the School provides when it sets up your family:

• Account and profile — name, email address, phone number, password (stored only as a hash), profile photo, preferred language, skills and interests you choose to list.
• Family — your children's names, grade, class and teacher, enrolment status, household membership, and the other guardians linked to your household.
• Health and safety — allergy and medical notes you provide for your child, and the people you authorise to collect them. This is sensitive information and we treat it accordingly.
• Membership and payments — membership tier and status, dues, orders, donations and volunteer hours. Card details go directly to Stripe; we hold only the outcome of a payment and the last identifiers Stripe returns.
• Communications — messages and discussion posts you write, direct messages between members, chat with the Club, contact-form submissions, and your notification preferences and consent records.
• Participation — sign-ups, volunteer shifts, event RSVPs, activity and team enrolment, attendance, poll and survey responses, certifications and waivers.
• Content — photographs and files you upload, and listings you post to the Community Board.

Information collected automatically:

• Technical — IP address, browser and device type, and pages requested, recorded in server and security logs.
• Cookies and local storage — a session cookie that keeps you signed in, a cookie remembering your language, and app data stored on your device so the installed app works offline. We do not use advertising or cross-site tracking cookies.
• Push subscriptions — if you enable push notifications, the identifier your browser issues for that device.
• Delivery events — whether an email was delivered, opened or bounced, and whether a text was delivered, so administrators can tell when a message did not arrive.

Accounts are for adults. We do not knowingly let children register, and the Portal is not directed to children.

Information about students reaches the Portal from their parents or guardians, or from the School as part of running Club programmes. It is used only to run those programmes — rosters, enrolment, attendance, dismissal and pickup, teams and activities, and safety.

Student information is visible only to the adults who need it: the child's guardians, the staff and coaches responsible for them, and Club administrators. Medical notes are further restricted, and are shared with a coach only when the family or the School has allowed it.

We do not use student information for advertising, and we never sell it. If you believe a child's information is in the Portal without a guardian's knowledge, write to ndaparentclub@ndacademy.org and we will remove it.

• To run your account, verify who you are, and keep the Portal secure.
• To administer membership, dues, orders and donations.
• To run programmes — events, volunteering, sign-ups, enrichment, athletics, classrooms and dismissal.
• To communicate with you: service and safety messages, and the announcements you have opted into.
• To keep families and students safe, including pickup and dismissal, allergy awareness and incident records.
• To translate content into your chosen language, and to offer AI-assisted help and drafting.
• To understand participation in aggregate, so the Club can plan. Reporting is aggregate, not individual profiling.
• To meet the Club's legal, accounting and record-keeping obligations, and to resolve disputes.

We do not sell personal information, we do not share it with data brokers, and we do not use it for behavioural advertising.

The Portal is a members' space, and some information is visible to other members by design:

• The member directory shows your name, and the contact details you have chosen to share, to other approved members.
• Discussions, Community Board listings and gallery contributions show your name to the audience the post is addressed to.
• Volunteer and sign-up lists show who has claimed a slot.
• Recognition and volunteer-hour features may show your name and hours to the community.
• Poll and survey responses are shown as the Club configured them — some are anonymous, and where a response is anonymous the Portal does not reveal who gave it.

You control who may send you a direct message from your profile settings, and you may ask an administrator to keep your details out of the directory.

Outside the community, we share personal information only with:

• The School — where a programme is run jointly, or where student safety requires it.
• Service providers who process data on our instructions, listed under Service providers below.
• Professional advisers, auditors and insurers, where necessary.
• Law enforcement or others, where the law requires it, or where we believe in good faith that disclosure is necessary to prevent harm to a child or to any person.
• A successor organisation, if the Club reorganises or merges — subject to this policy.

Mobile phone numbers and SMS consent are never sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. We share your mobile number only with Twilio, our messaging service provider, for the sole purpose of delivering the messages you have asked to receive. Message frequency varies; most members receive a few messages a month. Message and data rates may apply from your carrier. Reply STOP to unsubscribe or HELP for help.

The Portal is built on services that process data on the Club's behalf:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and delivery.
• Stripe — payments. Stripe receives card details directly and is the controller of that data under its own policies.
• Resend — transactional and announcement email, and delivery events.
• Twilio — SMS and WhatsApp messages, and delivery events.
• Anthropic — the AI assistant, translation and drafting features. Content sent to it is not used to train its models.
• Google — only if you choose to sign in with a Google account, in which case Google confirms your identity and shares your name, email address and profile picture.

Each is bound by contract to use the data only to provide its service to us. Some of them process data in the United States; where information is transferred internationally, we rely on the safeguards those providers offer.

• Account and profile information — while your account is active, and for a reasonable period afterwards so membership history stays intact.
• Student records — while the student is enrolled and connected to the Club, then archived or removed in line with the School's practice.
• Payment and donation records — for as long as accounting, tax and audit rules require, typically seven years.
• Messages, discussions and posted content — until deleted by you or by an administrator; copies may persist in backups for a limited period.
• Consent records for SMS, WhatsApp and email — for as long as we may need to show that consent was given, and after it is withdrawn.
• Security and delivery logs — for a short period, typically no more than 12 months.
• Declined and expired invitations — purged automatically on a schedule.

• Traffic is encrypted in transit, and data is encrypted at rest by our hosting providers.
• Access is enforced in the database itself with row-level security, so a member's request can only reach the records their role and organisation allow.
• Passwords are stored as salted hashes and are never visible to administrators. Temporary passwords issued to new families expire and must be changed at first sign-in.
• Administrative actions on sensitive areas are logged.
• Phone numbers are verified before any text message is sent to them.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

• See and correct — most of your information is editable in your profile; ask us for anything that is not.
• Opt out — unsubscribe from announcement emails, turn push off per device, and reply STOP to end text messages at any time.
• Limit visibility — set who may direct-message you, and ask an administrator to keep you out of the directory.
• Withdraw photographs — ask us to remove any photograph of your family, and we will.
• Delete — ask us to close your account and delete your information. We will do so except where we must keep records (for example payment history), and will tell you what we kept and why.
• Copy — ask for a copy of the information we hold about you and your children.
• Complain — write to us first; you may also complain to your local data protection or consumer authority.

Write to ndaparentclub@ndacademy.org to exercise any of these. We will respond within 30 days, and may need to verify your identity first.

You will never be treated differently for exercising a privacy right. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of on that front.

We use only what the Portal needs to work: a cookie that keeps you signed in, a cookie that remembers your language, and browser storage that lets the installed app work offline and receive notifications.

There are no advertising cookies and no third-party analytics trackers. Blocking essential cookies will stop you being able to sign in.

We may update this policy. The version and effective date at the top of the page tell you which one applies, and we will give notice in the Portal or by email before a material change takes effect.

Privacy questions, requests and complaints: ndaparentclub@ndacademy.org, or use the contact form on the ND Academy Parent Club website. Please say what you are asking for and which account it concerns.