Privacy Policy
This Privacy Policy explains how iGrades, operated by iTrusTech Inc., collects, uses, and protects information when a School and its Users (School Administrators, Teachers, Guardians, and Students) use the platform. It should be read together with our Terms of Service.
1. Our Role: Service Provider to the School
For student information (grades, attendance, assignments, and similar records), the School is the data controller and iGrades acts as its service provider ("school official" under FERPA, performing an institutional service the School would otherwise perform itself, under the School's direct control). This means the School decides what student data goes into iGrades and who at the School can see it; we process that data on the School's behalf and don't independently decide how it's used.
2. Information We Collect
Account information. Name, email address, phone number, and role for School Administrators, Teachers, Guardians, and Students who are given portal access; a password (stored as a salted hash, never in plain text) for accounts with login access.
Student and school records. Grades, assignments and submissions, attendance, class rosters, schedules, messages sent through iGrades, announcements, calendar events, and photos or videos a School chooses to upload (e.g., class photos), all entered by the School or its Users.
Technical and security information. IP address and approximate geographic location (city/region-level, derived from an offline lookup — see "Login Location" below) at the time of sign-in, used for account-security features like rate limiting and the login activity map available to School and Platform Administrators; basic device/browser information sent by your browser; and audit-log entries recording actions taken in the app (e.g., "Grade updated," "Student added") together with the timestamp and acting account.
3. Login Location ("Live Login Map")
To help School and Platform Administrators spot suspicious sign-in activity, iGrades shows a live map of recent successful logins, approximated from the IP address used to sign in. This lookup is performed entirely offline, using a local geolocation database on our own server — we do not send login IP addresses to any third-party geolocation service. Only city/region-level location is derived (not a precise address), it's kept for a short rolling window (3 days) rather than indefinitely, and School Admins only ever see logins from their own School; Platform Admins can see logins across every School.
4. How We Use Information
- To provide, maintain, and secure the Service (e.g., authenticate sign-ins, enforce rate limits, detect suspicious activity).
- To let School Administrators and Teachers manage grades, attendance, assignments, and communication with Guardians and Students, exactly as the School directs.
- To send account-related and School-directed notifications (grade updates, announcements, password resets, plan/billing notices) by email, push notification, or in-app message.
- To respond to support requests and communicate with School Administrators about their account.
- To improve iGrades' reliability and features, using aggregated or de-identified information where practical.
We do not sell School Data or student personal information, and we do not use it for advertising or to train third-party AI models.
5. Who We Share Information With
We share information only as necessary to operate the Service:
- Within the School: data is visible to the School's own Administrators, Teachers, Guardians, and Students according to the roles and permissions the School configures (e.g., a Guardian sees their own child's records, not the whole school's).
- Service providers: infrastructure and delivery providers we use to operate iGrades (e.g., email delivery for notifications, push notification delivery), bound to use the information only to provide that service to us.
- A School's own directory (optional): if a School chooses to connect its own LDAP/Active Directory server for Teacher sign-in, iGrades communicates directly with that School's own directory server to verify sign-in — no directory password is ever stored by iGrades.
- Legal requirements: if required to comply with applicable law, regulation, legal process, or a lawful governmental request.
- Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy continuing to govern any transferred personal information.
We do not share School Data with third-party geolocation, analytics, or advertising services.
6. Children's Privacy
iGrades is designed to be used within a School setting, where the School — not iGrades — is responsible for obtaining any parental or guardian consent required by law (including COPPA, for Schools serving children under 13) before a Student receives an Account or has information entered into iGrades. Parents and guardians with questions about their child's information in iGrades should contact their School's administration first, since the School controls that record; the School can in turn contact us for anything they can't resolve directly.
7. Data Retention
We retain School Data for as long as the School's account is active, and for a reasonable period after termination in case the School wants to reactivate or request an export, after which it is deleted. Some records are intentionally kept only briefly because they're short-lived operational logs rather than part of a School's permanent records — for example, login-location data described in Section 3 is kept for 3 days, and failed sign-in attempts used for account lockout protection age out automatically.
8. Data Security
We use industry-standard safeguards appropriate to the sensitivity of the information, including: passwords stored as salted hashes (never in plain text); encryption of sensitive configuration secrets (such as a School's directory service-account credentials) at rest; rate limiting and account lockout on repeated failed sign-ins; cross-site request forgery (CSRF) protection on all forms; and access controls that keep each School's data isolated from every other School's. No system is perfectly secure, and we can't guarantee absolute security, but we work to protect information appropriately and will notify affected Schools as required by law in the event of a breach affecting their data.
9. Your Choices and Rights
Because the School controls student, guardian, and staff records in iGrades, requests to access, correct, or delete that information should generally go to the School first — the School can make most corrections directly (e.g., editing a roster entry), and can request a data export or account/School deletion from us on your behalf. If you contact us directly with such a request, we will typically refer you to your School, consistent with our role as the School's service provider described in Section 1.
10. Cookies and Similar Technologies
iGrades uses a session cookie to keep you signed in and a small amount of local storage for interface preferences; we don't use third-party advertising trackers. Some pages (such as the live login map) load map tiles from OpenStreetMap and a mapping library from a third-party content delivery network (CDN) so the map can render — those requests only carry the technical information needed to fetch a map image, not your account data.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make a material change, we'll update the "Effective" date above and, where our systems support it, ask Users to re-confirm their agreement the next time they sign in.
12. Contact
Questions about this Privacy Policy, or a School's data, can be sent to [Insert Contact Email, e.g. privacy@itrustech.net].
← Back