Student Data & FERPA
How VolTrack handles student education records. Last updated: July 2026.
Our role under FERPA
VolTrack acts as a “school official” with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)), processing student education records solely on the school's behalf and under its direction. We do not own the data, do not sell it, and do not use it for advertising. Schools remain the data controller and decide who may access records.
What we collect
- Identity: name (incl. optional middle name), email, graduation year, role.
- Service records: logged hours, descriptions, verifier decisions, and any proof files the student uploads.
- Account/security metadata: hashed password, timestamps, audit events.
We do not request SSNs, government IDs, or payment data from students.
Who can see a student's records
- The student — their own records.
- School staff (admins and verifying teachers) at the student's organization, as school officials.
- Parents/guardians — only when the school enables the Parent Portal and a link is created. Parent access is read-only (hours & progress only), scoped to their own student, and revocable at any time by the student or the school. At colleges, only the (adult) student may grant parent access.
Access records & disclosures
Sensitive actions are recorded in a per-school audit log — parent invitations, activations, parent views, revocations, role changes, and platform-level access. This supports FERPA's expectation that schools can account for disclosures of education records.
De-identified case studies
We never share identifiable student data externally. Separately, a school's administrator may grant explicit, revocable consent to share a de-identified, rounded aggregate of the organization — a participation percentage and an approximate hours total — in case studies shown to other schools. This contains no individual records, names, or exact figures; aggregates for small cohorts are suppressed entirely; and consent can be withdrawn at any time from the school's Participation page. It is off by default.
Student/parent rights
Through the school, individuals can request to access or correct records, and request erasure. Admins can export a student's full data and permanently delete an account and its records from the people list.
Security
- Encryption in transit (HTTPS); passwords hashed with bcrypt.
- Strict tenant isolation and role-based access between organizations.
- Uploaded proof files served via short-lived signed URLs, not public links.
Sub-processors
We use a small, vetted set of vendors to operate the service, each under contract:
- Hosting & database — application hosting and the PostgreSQL database (incl. encrypted file storage for proof uploads).
- Transactional email — account verification, approvals, and reminder emails.
- Payments — subscription billing (card data is handled by the processor; VolTrack never stores it).
- SMS — text notifications, only if the school enables Communications and the recipient opts in. Texting a student additionally requires a verified parent/guardian's recorded consent, and any recipient can reply STOP to opt out.
- Error monitoring — diagnostics configured to exclude student personal information.
- AI data-import assistant — when an administrator uses the optional data-migration importer, only the uploaded file's column headers and a small sample of rows are sent to our AI provider to suggest how columns map to VolTrack fields. The full roster is never sent; the AI is not used to make decisions about individuals, and the provider does not train on this data.
The specific named vendors are listed in, and kept current through, the Data Processing Agreement; we notify schools of material changes. Request the DPA and current list at privacy@voltrack.app.
Data retention
Records are retained for the duration of the school's account. On account deletion or at the school's written request, the associated educational records and proof files are permanently deleted within 30 days, except where a longer period is required by law. Schools may direct earlier deletion of individual records at any time.
Contact
Questions or to request a DPA: privacy@voltrack.app.