Privacy Policy
1. Who we are & scope
Atlara is a college and career readiness platform for schools and districts, built and operated by CodeHS, Inc. This policy describes how we collect, use, and protect personal information across the Atlara websites and platform (together, the "Service"). It applies to students, school and district staff, family members, and visitors to our marketing site.
Where a school or district has signed a Data Privacy Agreement ("DPA") or service agreement with us, that agreement governs student data and takes precedence over this policy if they conflict.
2. Information we collect
Provided by schools and districts
- Roster information: student name, school email address, grade level, school and district, counselor assignment, and a student identifier from the district's systems.
- Academic context: where a district enables it — GPA, course history and plans, and test scores — used to power planning tools and counselor views.
- Staff information: name, work email, role, and school assignment for counselors and administrators.
Provided by students
- Planning activity: interest inventory responses, saved careers and colleges, goals and check-ins, readiness plan progress, course selections, application and scholarship tracking, experiences and portfolio entries, and resume content.
- Messages: communications with counselors and school staff inside the platform.
Provided by family members
- Name, email address, relationship to the student, and activity in the family portal (for example, approving a school-requested permission).
Collected automatically
- Usage and log data: pages viewed, actions taken, timestamps, browser type, and IP address — used for security, troubleshooting, and the progress views the product shows to students and staff.
From our marketing site
- If you request a demo, we collect the contact details you submit (name, work email, role, district, message) to respond to you.
3. How we use information
We use personal information only to:
- Provide and operate the Service — the exploration, planning, and application tools students and staff use;
- Show progress to the people who are supposed to see it: the student, their assigned counselors and school staff, their district, and linked family members;
- Keep the Service secure, prevent abuse, and troubleshoot problems;
- Improve the Service using de-identified or aggregated information that cannot reasonably be used to identify a student;
- Communicate with schools and users about the Service itself (never third-party marketing to students); and
- Meet our legal obligations.
We do not use student personal information to train artificial-intelligence models.
4. Student data & FERPA
When a school or district uses Atlara, some information we receive is part of a student's education record under the Family Educational Rights and Privacy Act (FERPA). In those cases we operate as a "school official" with a legitimate educational interest: we use education records only to provide the Service on the school's behalf, under the school's direction and control, and we do not redisclose them except as the school directs or the law requires.
- Student records remain the property and responsibility of the school and district.
- Schools can access, correct, export, and delete their students' information at any time.
- Parents and eligible students exercise their FERPA rights through the school, and we support the school in fulfilling those requests promptly.
5. Children under 13 (COPPA)
Atlara currently serves students in grades 9–12, who are 13 years of age or older, and we do not knowingly collect personal information from children under 13. If Atlara expands to younger grades in the future, we will collect personal information from a child under 13 only where the student's school or district has agreed to provide the consent required by the Children's Online Privacy Protection Act (COPPA) on parents' behalf for school-authorized educational use, consistent with FTC guidance — and we will update this policy before doing so. If you believe a child under 13 has provided us personal information, contact us and we will delete it.
6. What we never do
- We never sell or rent personal information — students', staff's, or families' — to anyone, for any purpose.
- We never show advertising on the Service, and we never use student data for targeted advertising anywhere.
- We never build profiles of students for any purpose other than the educational purposes the school authorized.
- We never let third parties use student data for their own advertising, marketing, or profiling.
- We never require students to provide more information than the Service needs.
7. Sharing & subprocessors
We share personal information only with:
- The school community it belongs to: the student's school and district staff, and family members the student or school has linked;
- Service providers (subprocessors) that help us run the Service, bound by contracts that limit their use of data to providing services to us; and
- Legal recipients when required by law — and where lawful, we notify the affected school first.
Current subprocessors:
| Provider | Purpose | Location |
|---|---|---|
| Fly.io | Application hosting and managed database | United States |
| GitHub | Source code hosting and deployment automation | United States |
We will update this list before adding a subprocessor that processes student personal information, and districts with a DPA are notified per its terms. In a merger or acquisition, any successor is bound by the commitments in this policy for previously collected data.
8. Retention & deletion
- We keep personal information only as long as needed to provide the Service to the school.
- Schools and districts can delete individual student records at any time, and can request full deletion of their data by contacting us.
- When a school's relationship with Atlara ends, we provide the district an export of its data on request and then delete student personal information from production systems within 90 days (or the period set in the district's DPA), with backups aging out on a fixed schedule thereafter.
- We may retain de-identified, aggregated information that cannot reasonably identify any student.
9. Security
We protect personal information with encryption in transit and at rest, access controls, least-privilege practices, logging, and tested backups. Atlara is operated by CodeHS, whose security program includes SOC 2 Type II certification and a published incident response plan. If an incident affects student personal information, we notify affected schools without unreasonable delay and support their notification obligations. Details: Security.
10. Your rights & choices
- Students: you can see and update your own profile and work inside Atlara. For corrections or deletion of school-managed records, ask your school — we'll support the request.
- Parents and guardians: you may review, request correction of, or request deletion of your child's information through the school, or contact us and we will route the request. Family portal access can be revoked by the school at any time.
- School staff: account information can be updated in the platform; contact us for anything else.
- Everyone: we do not discriminate against anyone for exercising a privacy right.
11. Family accounts
Family members join by invitation — from the student or the school — and see only the student(s) linked to them: readiness plan, goals, events, deadlines, approvals, and messages with school staff. Family members never see other students' information. Schools control family access and can unlink a family account at any time.
12. Cookies & tracking
The platform uses cookies that are necessary to operate the Service: keeping you signed in and protecting forms against forgery. We do not use third-party advertising cookies or cross-site trackers, and we do not respond to "Do Not Track" signals differently because we do not track users across other sites in the first place. If we adopt analytics tooling for the marketing site, it will be cookieless or disclosed here first.
13. Where data lives
Atlara is hosted in the United States. If you use the Service from outside the U.S., you understand that information is processed in the U.S. under this policy and applicable agreements.
14. State privacy laws
We design our practices to satisfy state student-privacy laws, including California's Student Online Personal Information Protection Act (SOPIPA) and Education Code §49073.1, Illinois' Student Online Personal Protection Act (SOPPA), New York Education Law §2-d (including signing 2-d riders and maintaining a data security and privacy plan for New York districts), and similar laws in other states. Where a state law grants students or parents rights beyond this policy, we honor the stronger protection.
15. Changes to this policy
If we make material changes, we will update the date at the top, post the change here, and notify school and district contacts before the change takes effect for student data. We will never materially weaken protections for previously collected student data without the school's consent.
16. Contact us
CodeHS, Inc. — Atlara team
Email: support@codehs.com (put "Privacy" in the subject for fastest routing)
Start here for an overview: Privacy Center