CateLMS Privacy Policy

Effective Date

July 22, 2026

Last Updated

July 22, 2026

Supersedes

HS2C.Org Privacy Policy dated November 10, 2025

Introduction

CateLMS (“CateLMS,” “we,” “us,” or “our”) is a product of the HS2C Foundation. We are committed to protecting the privacy and security of our users’ information, particularly that of students.

This Privacy Policy explains how we collect, use, disclose, and protect personal information across the CateLMS platform, including the web application, the CateLMS mobile applications for iOS and Android, the parent and family portal, the student portal, and any browser extensions we publish (collectively, the “Service”).

CateLMS is designed for schools, districts, educators, counselors, students, and their families. We adhere to applicable student privacy laws, including the Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act (COPPA), the Protection of Pupil Rights Amendment (PPRA), and applicable state student privacy laws.

Our position in one sentence: we are a service provider to schools. We do not sell personal information, we do not serve advertising, we do not track users across other services, and we do not permit any vendor to use student information to train artificial intelligence models.

Relationship to HS2C.Org

CateLMS is the successor platform to the HS2C.Org Portal. Where a school or district previously agreed to the HS2C Privacy Policy, this policy replaces it for all services delivered through CateLMS. Existing data protection commitments made in a signed district agreement remain in force; where this policy and a signed agreement differ, the signed agreement controls.

Information We Collect

We collect only what is necessary to deliver the Service.

Account Information

Name, email address, and authentication credentials. For staff accounts we also collect role (teacher, counselor, administrator), organizational affiliation, and assigned permissions. Passwords are never stored in readable form; they are hashed using the CateLMS encrypted password hashing framework.

Student Data (FERPA-Protected)

Provided by the educational institution, by educators acting under school authority, by parents or guardians, or by students themselves under school authorization. This may include:

  • Identity and enrollment information, including name, grade level, student identifier, and school
  • Academic progress, coursework, credits, grades, and graduation requirement tracking
  • Counseling interactions, session documentation, and counselor notes
  • Goals, plans, and student-authored profile content
  • College and career readiness information, including college and scholarship pipelines, testing records, and financial aid application status
  • Attendance and behavior information where the district enables those modules
  • Multi-tiered support (MTSS), accommodation, and specialized plan information where enabled

We collect the minimum information necessary to provide the Service, and only the categories the district enables.

Family Information

Where a district enables the family portal or college-readiness features, we may collect guardian contact information and, where a student or family voluntarily enters it, financial aid application status. Family and financial fields are treated as sensitive and are encrypted at rest.

User-Generated Content

Notes, messages, goals, plans, documents, and other content submitted through the Service, together with related metadata such as author and timestamp.

Usage and Audit Data

Feature usage, activity logs, and an audit trail of actions taken on student records. The audit trail exists for a privacy reason: it lets a school determine who accessed or modified a student’s record and when.

Technical and Device Data

IP address, browser type, operating system, device characteristics, and diagnostic information. For mobile applications we additionally process a device identifier generated by the app and, where a user enables notifications, a push notification token issued by Apple or Google.

Information We Do Not Collect

  • We do not collect precise geolocation.
  • We do not collect biometric data. Biometric sign-in (Face ID, Touch ID, or fingerprint) is performed entirely by the user’s device; the biometric never leaves the device and is never transmitted to or stored by CateLMS.
  • We do not use advertising identifiers.
  • We do not track users across other apps or websites.

How We Use Information

We use information to:

  • Provide, operate, maintain, and improve the Service
  • Authenticate users and enforce role-based and organization-scoped access
  • Deliver the educational functions the school has enabled
  • Communicate about accounts, service updates, and support requests
  • Send notifications a user has enabled, including mobile push notifications
  • Maintain security, detect and prevent unauthorized access, fraud, or misuse
  • Produce aggregate, de-identified analytics for program evaluation and reporting
  • Comply with legal obligations and respond to lawful requests

We do not use student data for advertising, marketing, or profiling, and we do not use it to train artificial intelligence models.

Artificial Intelligence

Some features use AI to assist educators — for example, drafting communications or suggesting instructional materials. Our commitments:

Student data is never used to train AI models. Our AI vendors are contractually prohibited from using any information we send for model training or for their own purposes.

Sensitive content is content-blind by design. Counselor note bodies are stored under an internal reference and routed by that reference rather than by content. When an AI feature operates on a note, the note body is not transmitted to the AI provider. This is enforced in the software, not merely by policy.

Financial and family data is never sent to AI systems. Financial aid status, family financial information, and related fields are excluded from all AI processing.

AI does not generate factual student data. Grades, progress calculations, and the data sections of reports are computed from records, never generated by a model. A hallucinated grade would be a trust-breaking failure, so AI is architecturally excluded from those paths.

AI activity is logged. Districts can review an AI compliance log showing what categories of AI processing occurred, subject to district-configured retention.

Human review. AI output is a draft for an educator to review, edit, and approve. It is not an automated decision about a student.

Security

Encryption

In transit. All connections use TLS. The mobile applications communicate only with our canonical domain and reject unencrypted connections.

At rest. Sensitive fields are encrypted at the application layer using AES-256-GCM, an authenticated encryption mode that detects tampering as well as preventing disclosure. Encryption keys are derived using HKDF-SHA256 from a master key held in server configuration, not in the database — so a database copy alone does not yield readable data.

Encryption fails closed: if encryption cannot be performed, the operation is refused rather than writing readable data. We deliberately chose an error over a silent downgrade.

Application-layer encryption covers counselor notes, interaction logs, messages, student profiles, goals, support and intervention records, MTSS designations, plans and monitoring records, accommodations, specialized plans, conference reports, attendance and grade records, risk history, and known-device records. We run an automated audit that verifies encrypted fields are actually encrypted and reports any record that is not.

Third-party credentials — including single sign-on secrets, push notification keys, and integration credentials — are separately encrypted at rest and are never written to logs.

Key and Credential Rotation

  • Session signing keys can be rotated by an administrator at any time. Rotation immediately invalidates every outstanding session across all users and devices, requiring re-authentication.
  • Encryption keys are held in server configuration and are rotated in coordination with the district on a defined schedule or in response to a security event. Because keys are derived through HKDF from a master key, rotation does not require re-encrypting field by field in place.
  • Mobile session tokens rotate automatically on every use. Each refresh issues a new token and retires the old one, so a token is single-use.
  • Push notification tokens are re-registered by the app and revoked automatically on sign-out, device revocation, or repeated delivery failure.
  • Third-party integration credentials are rotated when a district requests it, when staff with access change, or on any suspected exposure.
  • Calendar feed tokens can be rotated by the user at any time.

Session and Device Security

  • Multi-factor authentication for staff accounts, with new-device verification.
  • Passwordless sign-in via passkeys, using the device’s own authenticator.
  • Replay detection. Mobile sessions are tracked in families. If a previously-used token is presented — which indicates a copy has been taken — the entire session family is revoked immediately, signing out the legitimate device as well. We accept that inconvenience because the alternative is leaving an attacker with a live session.
  • Device binding. Session tokens are bound to the device that obtained them and cannot be used elsewhere.
  • Server-enforced device lock. A locked device is refused at the server, not merely hidden behind a screen overlay. Clearing browser storage or replaying a stored token does not bypass it.
  • Remote revocation. A user or administrator can revoke a lost device, which simultaneously ends its sessions and its ability to receive notifications.
  • Login attempt throttling, IP allow-listing at the organization level, and sign-in anomaly detection.

Access Controls

Access is scoped by organization and role. A user sees only the students within their assigned organization and its descendants. This boundary is enforced in a single place in the code rather than repeated per feature, which is how we keep it reliable.

Actions on student records are written to an audit trail identifying the actor, the record, and the time. Where a counselor assists a student by editing that student’s own profile, the edit is attributed to the counselor.

Mobile Notifications

Push notification payloads deliberately contain no student names, grades, note content, or contact information. A notification carries only a generic prompt and an internal reference; the application retrieves the actual content over an authenticated connection after the device is unlocked. This is enforced in the software. It means a notification appearing on a locked screen cannot disclose student information.

Hosting and Operations

The Service is hosted in the United States on managed infrastructure with network isolation, monitored access, and regular backups. Backups are encrypted. Administrative access is limited to personnel who require it, and we maintain an incident response process.

No method of transmission or storage is completely secure. We will notify affected schools and districts without undue delay in the event of a breach involving student data, consistent with law and our contractual obligations.

Information Sharing and Disclosure

We do not sell or rent personal information. We do not share student data with advertisers. We do not permit any recipient to use student data for its own purposes.

We share information only as follows:

Within the school or district. With authorized staff having a legitimate educational interest, as determined by the district’s own access assignments.

With parents and guardians. Through the family portal, subject to district configuration and the student’s own per-section sharing controls where the district enables them.

With service providers. Hosting, infrastructure, security, communications delivery, and AI providers, each contractually bound to protect the information, use it only to deliver the contracted service, and not to use it for their own purposes including model training or advertising.

With integrated systems the district authorizes. Student information systems and identity providers such as Aspire, PowerSchool, Skyward, Infinite Campus, ClassLink, Clever, and Google Workspace. These integrations operate under district direction.

With Apple and Google, for mobile delivery only. Where a user enables notifications, a device token and the contentless notification are transmitted through Apple Push Notification service or Firebase Cloud Messaging. Because payloads carry no student information, these providers do not receive student data through this channel.

For legal compliance and safety. Where required by law, regulation, subpoena, or court order, or to protect the rights, property, or safety of CateLMS, our users, or others. Where legally permitted, we will notify the affected district before disclosing student data.

In a business transfer. In a merger, acquisition, or sale of assets, information may transfer as part of the transaction, subject to the successor being bound by commitments no less protective than these. Districts will be notified and may terminate and require deletion or return of student data.

Aggregate and de-identified information. We may publish or share aggregate, de-identified analytics that cannot reasonably identify an individual, including for sponsorship and program evaluation reporting. We do not attempt to re-identify de-identified information and do not permit recipients to do so. We never disclose personally identifiable student information to sponsors or corporate partners.

Data Retention and Deletion

We retain student data as directed by the school or district and as required by law.

The Service maintains an internal data dictionary documenting, for each category of record, its purpose, retention period, and which roles may read or write it. Districts may review this documentation. Representative periods:

Category

Retention

Student records

Seven years after graduation or withdrawal, then anonymized, unless the district directs otherwise

Counseling and support records

Per district direction and applicable state record retention law

Audit trail

Retained to support district review of record access

AI processing logs

Per district-configured retention period

Notification delivery logs

Short-term operational retention; contains no message content

Mobile session records

Expired and revoked sessions are removed after a limited investigation window

On termination or district instruction, we will delete or return student data in accordance with the applicable agreement and law. Operational and security records may be retained for a limited period or anonymized.

Deletion requests. Parents, guardians, and eligible students may request deletion by contacting privacy@catelms.com. Where the data is under a school’s control, we coordinate with the school or district to validate and fulfill the request consistent with FERPA and our contract. Because student records are typically the district’s education records, the district generally directs deletion.

Mobile applications. The apps contain no account registration; accounts are provisioned by the school. Account deletion is handled by the school administrator or by contacting us.

FERPA Compliance

Where we process student data for a school or district, CateLMS acts as a “school official” with a legitimate educational interest under FERPA, 34 CFR § 99.31(a)(1). Accordingly:

  • We are under the direct control of the school or district with respect to the use and maintenance of education records.
  • We use student data solely to provide the contracted services, and for no other purpose.
  • We do not re-disclose education records except as authorized by the district or required by law.
  • We maintain access controls and an audit trail so the district can meet its own FERPA obligations.
  • We support the district in responding to parent and eligible student requests to inspect, review, and seek correction of education records.
  • Student data remains the property of the school or district, not CateLMS.

We act as a processor, not a controller, with respect to student data, and process it only on the district’s documented instructions.

COPPA Compliance

CateLMS is provided to schools for educational purposes and is not directed to children for personal use.

  • Children under 13 cannot create accounts directly. All student accounts are provisioned or authorized by the school or district. The Service contains no self-registration path for students, including in the mobile applications.
  • Where a school authorizes student accounts for children under 13, the school provides consent on behalf of parents in its capacity as the students’ educational institution, consistent with FTC guidance on COPPA in schools. Schools remain responsible for notifying parents in accordance with their own policies, and we support them in doing so.
  • We collect only information reasonably necessary for the educational activity.
  • We do not condition participation on disclosing more information than is reasonably necessary.
  • We do not use children’s information for advertising, behavioral targeting, or profiling, and we do not disclose it to third parties for those purposes.
  • Parents may, through their school, review their child’s information, request its deletion, and refuse further collection.
  • If we learn that a child under 13 provided information directly to us without school authorization or verifiable parental consent, we will delete it promptly. Contact privacy@catelms.com.

PPRA and State Student Privacy Laws

Where a district uses survey, wellness, or screening features, the district is responsible for any parental notice and consent required by the Protection of Pupil Rights Amendment. We support districts in meeting these obligations and do not administer such instruments on our own initiative.

We comply with applicable state student privacy laws, including those restricting targeted advertising to students, the sale of student information, and the creation of non-educational student profiles. We engage in none of these practices.

Your Rights and Choices

Parents, Guardians, and Eligible Students

You may request to review, correct, or delete personal information. Contact privacy@catelms.com or your school. Because student records are generally the district’s education records, we verify authorization with the school or district before acting, consistent with FERPA.

Staff Users

You may access and update your account information within the Service, manage your notification preferences, review your active sessions and devices, and revoke any device.

California (CCPA / CPRA)

California residents have rights to know, access, correct, delete, and limit use of sensitive personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not engage in cross-context behavioral advertising. We will not discriminate against you for exercising these rights. Contact privacy@catelms.com. Personal information collected on behalf of a school is generally subject to FERPA rather than the CCPA.

EU, EEA, and UK (GDPR / UK GDPR)

You may request access, correction, deletion, restriction, portability, or object to processing. Contact privacy@catelms.com. Where data was provided by a school, that institution is the controller and we will coordinate with it. You may lodge a complaint with your supervisory authority.

Notifications

Notification preferences, including mobile push notifications, can be changed at any time in the Service or in your device settings. Turning off notifications does not affect your access.

Cookies and Similar Technologies

We use cookies and similar technologies to authenticate sessions and maintain security, remember preferences and accessibility settings, and measure and improve performance.

We do not use third-party advertising cookies or cross-site tracking. Disabling cookies may prevent parts of the Service from functioning.

The mobile applications do not use advertising identifiers and do not present tracking prompts, because they perform no tracking.

Single Sign-On and API Providers

Our use of information received from single sign-on and API providers, including Google, Apple, ClassLink, and Clever, adheres to those providers’ user data policies, including any Limited Use requirements. Information obtained through these integrations is used only to authenticate users and provide the Service.

Sign in with Apple is offered in our mobile applications. If you use Apple’s Hide My Email feature, we receive a relay address rather than your actual address and use it only for account communications.

International Data Transfers

CateLMS is based in the United States, and data is stored and processed in the United States. If you access the Service from outside the United States, you acknowledge that your information will be transferred to and processed in the United States in accordance with this policy.

Changes to This Policy

We may update this policy to reflect operational, legal, or regulatory changes. We will post updates with a revised Effective Date.

For material changes affecting student data, we will provide advance notice to affected schools and districts so they may review the change before it takes effect. Continued use after the effective date constitutes acceptance.

Contact Us

HS2C Foundation — CateLMS

Attn: Privacy Officer

8787 South Redwood Road, Suite 100

West Jordan, Utah 84088

support@catelms.com

Schools and districts with questions about our FERPA posture, security architecture, subprocessors, or data processing terms may contact the Privacy Officer for our data protection documentation.