Student data privacy

A school is trusting us with its families and its students. Here is what that means for their data: what we collect, what we never do, how long we keep it, and how it aligns with the laws that protect students.

What we collect

• Adult contact details for organizers and families: name, email, and phone.
• Students' names, entered by their family or the school, so the trip knows who is travelling. A school can choose to keep only a first name and last initial ("Jane S."), which our database then enforces for the names on its rosters, member list, payment records, chat, polls, date votes and safety check-ins.
• Coordination facts: who is going, who is a chaperone and whether staff have recorded their background-check clearance, who has returned a permission form, rooming, and payment status.
• Group assignments: which students and chaperones staff put in each group. A draft changes nothing; chaperones see their group only after staff publish the plan.
• Personal invitations: when staff invite a family to a trip by email, the invitation record keeps a one-way fingerprint of the link and of the invited address, when it expires (after 7 days), and whether it was used.
• Account setup: if a school chooses to create families' accounts itself, we keep that account record and a one-time setup code, stored only as a one-way fingerprint. Staff see the code once, when they issue it. Families choose their own password, which staff never see.
• Pickup lists: up to six people a guardian says may collect their student at the end of a trip, with each person's name, relationship and phone, and whether the guardian lets the student leave on their own. Staff can enter or change a list when a family asks.
• Day-of records: headcount taps (who was counted at each check, by which staff member or chaperone, and when), and marks staff make for a student who is not travelling that day, which apply to that day's counts only.
• Dismissal records: who released each student at the end of the trip, to whom, how and when. A release to someone not on the list also records the reason and the second staff member who confirmed it.
• What people type into the trip: messages, announcements, questions to the organizer, written poll answers, and schedule notes. Organizers' notes on a family's financial aid are stored too, until the retention step below.
• Electronic signatures: when a family signs a permission form in Jettova, we keep the typed name, the time, the IP address and the browser, so the signature can be checked later.
• Payment records: amounts, currency, and the payment processor's references. Card numbers are entered directly into the processor's secure fields and never reach Jettova.
• Uploaded permission forms: the document a family uploads, stored privately. We don't ask for medical or health records, but if a school's own permission form asks for health, allergy or emergency-contact details, the signed copy holds them. Our automatic form check is switched off; if we ever switch it on, our AI reads the uploaded form to check that it looks signed.

What we never do

• ✓We don't ask families for students' medical or health records. The optional emergency and medical layer is off, so no medical record is collected through it.
• ✓No advertising runs on any school page or trip. We never sell students' or families' data from a school trip, and never use it for advertising.
• ✓We do not use student data to build a profile of a student unrelated to their trip.
• ✓We do not share data with third parties except the sub-processors that run the service, each listed with what it receives and when it is used.

Who sees what

Every new school program has these seats. This table is generated from the same permissions reference staff see in the console, which we check against the code that enforces each rule. Our servers check every rule on every request.

• Students don't have accounts. Their families act for them.
• A coach who is also a parent is a family on their own child's trip: they see and pay for that trip like any family.
• A chaperone sees nothing about anyone until staff record their clearance. Then, on the day, they see the first names of the students in their own group and who in it is not travelling. Once staff publish groups, they also see their own group's pickup lists and can call their own group's guardians, and no one else's.
• Hiding a button is never the safeguard. Every one of these rules is checked again on our servers.
• The tour-operator page a school can share carries dates, headcounts, rooms and the itinerary, with no roster and no names from student records.
• Some older programs have a separate approver seat. An older principal seat that approves or denies trips. Sees what the Principal sees: every trip, families' names and contact details, aid notes, the money and the departure pack; not medical records, legal identities or signed forms. Can't run trips or change settings. New programs seat the Principal instead.
• Every program starts with a Jettova administrator in the program administrator seat, because we set programs up with you. That person can see everything the program administrator column shows, including signed forms. When you are ready, we seat your own administrator and step out of the seat; tell us when.

How families are protected

The vendors that run the service, what each receives and when, are on our school sub-processors list.

Built to align with the laws that protect students

Jettova for Schools is built to help a school meet its obligations under the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and applicable state student-privacy laws (for example SOPIPA). We support the school as the controller and act only on its instructions.

The full commitments, including security measures, breach notification, and retention, are set out in our Data Processing Addendum, which your counsel can review before you sign up. The current list of sub-processors is our school sub-processors list.

Your data, your control

Privacy questions and requests

This page describes how the product works and is not a substitute for the executed agreement and DPA between your school and Jettova, Inc., which govern.