Privacy Policy

Effective date: October 29, 2026.

Who we are

VolTrack is operated by VolTrack, LLC, a New York limited liability company (“VolTrack”, “we”). We provide software for schools to track student service hours and related activities. This policy covers our public website (the pages you can see without signing in) and the signed-in VolTrack application (the “Service”). Our Student Data page (including our retention schedule) and Subprocessors page are part of this policy. Contact: [email protected] · 917-291-1527 · VolTrack, LLC, 7634 176th Street, Fresh Meadows, NY 11366.

Schools' agreements. A school may sign an agreement with us about student data. Where that agreement differs from this policy for the school's data, the agreement controls for that school and we follow it. Agreements with one school do not change how we handle another school's data.

Information we collect

• Account information: name (including any middle name), email address, role and organization; for students, graduation year or grade; a hashed password; optional two-factor settings; and email preferences.
• Service records (for students, education records): service entries (activity, date, hours and description) and the email address of the supervisor a student names; optional proof photos, which we store without location or device details, or, where the school allows, short videos (photos only at K–8 schools); opportunity sign-ups and attendance; staff decisions, comments and hours credited; hours requirements; milestones reached; records of emails sent; feedback or questions sent through the Service; and records a school imports, including past service hours.
• Parents and supervisors: email addresses a student or school enters for a supervisor or parent (a parent's address is not used until a school administrator approves it); a parent's name and password if the parent sets up access; and supervisors' decisions.
• Security information: a sign-in cookie; IP address and browser type, recorded in our security log and our hosting provider's request logs; when an account was last active; a log of sign-ins, approvals, exports, role and access changes, deletions and similar events; and error reports.
• Staff activity: in the Service we keep first-party records of school staff actions (for example, an administrator importing a roster) to operate and improve the Service. We keep no such activity records about students or parents.
• Marketing attribution: if you arrive from a link carrying UTM campaign parameters, we store the source, medium and campaign when an administrator creates an organization, submits a demo request, or joins the waitlist. Student and member accounts carry no marketing tags.
• Demo requests and waitlist: the name, email, school, role and message you send us.
• Messages: emails, texts or voicemails you send us, which may concern a student.
• Cookies: see “Cookies” below.

We do not ask students for a date of birth, home address, phone number, government ID or payment information, and we do not use facial recognition or other biometric identification.

How we use information

We use information to provide, maintain, support and secure the Service for schools; to send account, school and support messages; to bill Customers; to communicate with school staff about their account and the Service; to comply with law, protect against fraud and security threats, and establish or defend legal claims. We improve the Service using staff activity, website analytics and what people tell us; we use student information only to provide, maintain, support and secure the Service and to fix errors. We do not sell personal information. We do not use student information for advertising or marketing, to build profiles of students (other than the service record the school uses), in case studies, or to train or develop AI models.

Cookies

In the Service: one essential sign-in cookie that expires within 12 hours; it also keeps a visitor's form security token and, if you arrived from a campaign link, the campaign parameters above until you sign up or send a form. The Service loads no third-party analytics or advertising tools. On our public website: only after you click Accept, Google Analytics (to see how our pages are used) and Meta Pixel (to measure our advertising; Meta may also use this information for its own advertising) load on our marketing pages. Declining keeps them off, a Global Privacy Control signal counts as declining, and they never load while you are signed in. Your choice is stored in a cookie_consent cookie for 12 months; to change it, use the Cookie settings link at the bottom of our marketing pages.

Who receives information

Inside the Service. Each student sees their own records and, when choosing a supervisor, the names and email addresses on the school's approved-verifier list. School staff the school authorizes see students' records. Staff on the approved-verifier list receive the details of entries that name them, with links to approve or reject; entries naming anyone else go to the school's administrators. A parent the school approves sees their child's progress summary and may receive progress reminders. If the school turns on the leaderboard, other students at the school see a student's first name, last initial, grade and approved hours. At high schools, colleges and nonprofits that allow it (never K–8 schools), a student can create a link to their approved record that anyone with the link can open; it expires after 90 days and the student can turn it off at any time.

Service providers. We share information with service providers that run VolTrack for us, under written agreements, for network security and delivery, hosting, database and file storage, email, error monitoring, our own email, AI services, and payments. Our Subprocessors page lists each provider, what it receives, where it processes data and how long it keeps it, and notes the few cases where a provider may also use data for its own purposes.

Others. Our legal advisers and incident-response providers, under confidentiality, when needed; a successor to our business, which must honor this policy for the data it receives; and anyone the law requires. Google Maps loads in the Service for high-school, college and nonprofit organizations only, never for K–8 organizations; your browser sends Google your IP address and browser information, and Google handles it under its own terms.

Artificial intelligence

When a school administrator uses our optional import assistant, Anthropic's Claude suggests which column in an uploaded file is which. It receives the file's column headings and made-up placeholder values, not real cell values (unless a heading itself contains personal information), and the administrator confirms every column. We may also use AI services, under commercial terms that prohibit the provider from training on the data or using it for its own purposes, to help us maintain, support, debug and secure the Service; they receive only the data a task needs. Our Anthropic API account is on Anthropic's standard commercial terms: Anthropic deletes API inputs and outputs within 30 days, except as the law requires or where its automated safety systems flag content, which it may keep longer. We never use student information to train AI models, and students do not use AI in the Service.

We do not sell

We do not sell personal information. Advertising pixels load only on our public marketing pages and only with your consent (see “Cookies”). The Service, and the emails we send students, contain no advertising or advertising trackers.

Emails to students and parents

On a school's behalf we email students about their own account, entries and sign-ups (for example, a reminder the day before an opportunity they signed up for). Schools can also send students announcements of new opportunities and, if the school turns it on, a weekly reminder when a student is behind the school's hours requirement; each of these optional emails has a one-click link to stop it, and a school's signed agreement may make them opt-in. A school-approved parent may receive a child's progress reminders. We do not send text messages. We send school administrators account, billing and product emails, and you can unsubscribe from the non-essential ones.

Your choices & rights

You can access, correct, export or delete your account information. You can delete your own account in Settings unless a school keeps records tied to it; then, and for any student record, the request goes through the school, which directs us. Contact us at [email protected] at any time.

Your California and other state privacy rights

• What we collect: identifiers (name, email, IP address); education information (service hours, graduation year or grade, school); internet activity on our marketing pages; and, for school administrators, commercial information (plan and billing history).
• Sources: you, your school, other users (for example, a student naming a supervisor), and your browser or device.
• Purposes: providing, securing and supporting the service, billing, and (with consent) measuring our marketing.
• Recipients: service providers only, listed on our Subprocessors page.
• Sale and sharing: we do not sell personal information. “Sharing” for cross-context advertising is limited to the marketing-page pixels you consent to.
• Your rights: to know, delete and correct your information, to opt out of sharing, and not to be discriminated against for using these rights.
• How to ask: email [email protected]; for student records, contact your school, which directs us. We respond within 45 days. An authorized agent may submit a request for you with your signed permission; we may verify your identity first.
• Global Privacy Control: we honor Global Privacy Control signals as an opt-out of sharing on our marketing pages.
• Shine the Light (Cal. Civ. Code §1798.83): we do not share personal information with third parties for their direct marketing.
• Nevada: we do not sell covered information.

Children's privacy

VolTrack is provided to schools for their students. The operator that collects students' information through the Service is VolTrack, LLC, 7634 176th Street, Fresh Meadows, NY 11366, 917-291-1527, [email protected]. VolTrack collects personal information from students under 13 only with their school's authorization, given for the school's use and benefit and for no other commercial purpose, after we give the school notice of our practices (this policy and our Student Data page, or the notice in a signed agreement). VolTrack is responsible for its own compliance with the Children's Online Privacy Protection Act. K–8 students cannot sign themselves up: their school adds them, through a roster import or a school-issued invite link. We collect the information listed under “Information we collect,” use it only as described under “How we use information,” and disclose it only as described under “Who receives information.” We do not require a child to disclose more information than is reasonably necessary to take part. A parent or guardian may ask the school, or us at [email protected] or 917-291-1527, to review their child's information, have it deleted, or stop its further collection or use; we act once the school confirms, or we otherwise verify, that the requester is the child's parent or guardian. Our retention schedule is on our Student Data page.

Security

We use encryption in transit and at rest, hashed passwords, two-factor authentication (available to everyone and required for school administrators), role-based access with each school's data kept separate, private file storage opened only through short-lived links, session time limits, security logging and error monitoring. Only VolTrack personnel and contractors who need access to provide, support or secure the Service can reach school data. We will notify the affected school within 72 hours of confirming a security breach involving its data, and no later than any period required by law (including the 7-day requirement of New York Education Law §2-d where it applies).

Retention

We keep information only as long as our retention schedule allows. In short, a school's records are kept while the school uses VolTrack and are deleted: when the school deletes a student, or all its data, in the Service; within 30 days after the school's written request; when a paid subscription ends, after a deletion date at least 60 days later that we email to administrators with an export link; and, for an organization on the free plan, 60 days after we email its administrators following 12 months with no administrator sign-in (signing in cancels it). Deletion waits while data is under a legal hold or an operator hold for an unresolved billing or contract matter, or where the law requires us to keep it. A school's signed agreement may set its own timetable.

Changes & contact

We'll post updates here with a new effective date. Before a material change to how we handle student information takes effect, we will tell schools' administrators, and a school's signed agreement may require its approval first. Questions: [email protected] · 917-291-1527 · VolTrack, LLC, 7634 176th Street, Fresh Meadows, NY 11366.