Student Data & FERPA

How VolTrack handles student education records. Effective date: October 29, 2026.

Our role under FERPA

VolTrack acts as a “school official” with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)), where the school's FERPA notice provides for it, processing student education records solely on the school's behalf and under its direction. We do not own the data, do not sell it, and do not use it for advertising. Schools remain the data controller and decide who may access records. VolTrack is operated by VolTrack, LLC, a New York limited liability company.

Where FERPA does not apply to a school (many private and parochial schools are not subject to it), we still act as the school's service provider under our agreement and applicable state student-privacy laws, and apply the same practices.

What we collect

• Identity: name (including any middle name), email, graduation year or grade, role.
• Service records: logged hours, descriptions, the supervisor email a student names, staff and verifier decisions and comments, opportunity sign-ups and attendance, milestones, and optional proof photos (stored without location or device details) or, where the school allows, short videos (photos only at K–8 schools).
• Parents: an email a student or school enters (used only after an administrator approves it), and a name and password if the parent sets up access.
• Account and security information: hashed password, two-factor settings, email preferences, timestamps, and security-log events.

We do not request SSNs, government IDs, payment data, dates of birth, home addresses or phone numbers from students, and we do not use biometrics.

Who can see a student's records

• The student — their own records.
• School staff (admins and verifying teachers) at the student's organization, as school officials.
• Approved verifiers — school staff on the approved-verifier list receive the entries that name them, with approve/reject links. Students can see the names and emails on that list. Entries naming anyone else go to the school's administrators.
• Other students (leaderboard) — only if the school turns it on; they see first name, last initial, grade and approved hours.
• Anyone with a share link — at high schools, colleges and nonprofits that allow it (never K–8), a student may share a link to their approved record; it expires after 90 days and can be turned off at any time.
• Parents/guardians — only when the school enables the Parent Portal and a link is created. Parents can view hours and progress; they cannot edit records. Access is scoped to their own student and revocable at any time by the student or the school. At colleges, only the (adult) student may grant parent access.

Access records & disclosures

Sensitive actions are recorded in a per-school audit log — actions by the school's own users (logins, exports, role changes, parent invitations, activations and revocations) and parent access to records. Platform (VolTrack staff) actions are logged centrally. This supports FERPA's expectation that schools can account for disclosures of education records.

Student/parent rights

Through the school, individuals can request to access or correct records, and request erasure. Admins can export a student's full data — profile, memberships, service hours, opportunity sign-ups, parent links, consent records, message counts and audit-log entries — and permanently delete an account and its records from the people list.

Security

• Encryption in transit (HTTPS) and at rest; passwords hashed with bcrypt.
• Strict tenant isolation and role-based access between organizations.
• Uploaded proof files served via short-lived signed URLs, not public links.
• Two-factor authentication available to all users and required for school administrators.
• Staff sessions expire after inactivity.
• Login, export and access events are logged with IP address.
• We will notify the affected school within 72 hours of confirming a security breach involving its data, and no later than any period required by law (including the 7-day requirement of New York Education Law §2-d where it applies).

Sub-processors

We use a small, vetted set of vendors to operate the service, each under contract. The named list is on our Subprocessors page. For high-school, college and nonprofit organizations, opportunity maps and address lookup use Google Maps Platform: your browser's IP address and browser information go directly to Google, which acts as an independent controller. Google Maps is never loaded for K-8 organizations.

• Hosting & database — application hosting and the PostgreSQL database (incl. encrypted file storage for proof uploads).
• Transactional email — account verification, approvals, and reminder emails.
• Payments — subscription billing (card data is handled by the processor; VolTrack never stores it).
• Error monitoring — configured to redact emails, tokens, request bodies and search parameters; names appearing in error text may still reach our monitoring vendor, which is bound by contract.
• AI services — when an administrator uses the optional import assistant, only the file's column headings and placeholder values are sent (no real cell values, unless a heading itself contains personal information), and the AI makes no decisions about individuals. We may also use AI services under commercial no-training terms to maintain, support, debug and secure the Service. Anthropic deletes API inputs and outputs within 30 days (longer only where the law requires or its safety systems flag content). Student information is never used to train AI.

The current sub-processor list is also incorporated in the Data Processing Agreement; schools with a signed agreement are notified of changes as that agreement provides. Request the DPA at [email protected].

Data retention

Apart from the holds above, longer periods apply only where required by law. Schools may direct earlier deletion of individual records at any time.

Contact

Questions or to request a DPA: [email protected] · 917-291-1527 · VolTrack, LLC, 7634 176th Street, Fresh Meadows, NY 11366.