Privacy Policy

01 Overview & Scope

This Privacy Policy describes how TXCCMRI, LLC ("CCMRI," "we," "us," or "our") collects, uses, protects, and shares information through the CCMRI™ platform ("Platform") — a K-12 analytics service that helps Texas school districts track and improve College, Career, and Military Readiness (CCMR) outcomes.

This policy applies to:

• The CCMRI web application at txccmri.com and all associated Firebase-hosted domains
• All data processed on behalf of school districts via CSV upload, SIS integration, or manual entry
• Communications sent by the Platform (email, SMS, in-app notifications)
• The public marketing website at txccmri.com

02 Operator Identity

03 Data We Collect

3.1 Student Education Records (School-Directed)

The primary mode of data entry is through school-directed CSV uploads or SIS integrations performed by authorized district administrators. This data is imported under the school's existing FERPA authority and includes:

• Student identifiers (district-assigned student IDs, PEIMS IDs)
• Grade level, campus, and enrollment status
• Assessment scores (SAT, ACT, TSIA2, MAP, STAAR, ASVAB)
• CTE program enrollment, IBC certifications, and pathway completion
• Demographic indicators required for TEA accountability reporting
• Special education and economically disadvantaged status flags

3.2 District Administrator & Staff Data

When educators create accounts or are provisioned by their district, we collect:

• Name and email address
• Role assignment (District Admin, Campus Admin, Teacher)
• Campus or school affiliation

3.3 Marketing Website Visitors

When you visit txccmri.com (this marketing website), we collect:

• Waitlist submissions: Name, email, district name (voluntarily provided)
• Privacy-first analytics: This marketing website uses Plausible Analytics to count page views. Plausible is cookieless, stores no personal data, does not fingerprint your browser, and does not track you across other sites. We use no advertising or marketing trackers — no Google Analytics, no Facebook Pixel, no cross-site tracking.
• Essential cookies only: Session management cookies required for platform functionality

3.4 Data We Do NOT Collect

• Social Security numbers
• Financial information (credit cards, bank accounts) from students or parents
• Biometric data
• Precise geolocation data
• Student photographs or videos
• Social media profiles or browsing history

04 How We Use Data

All student data is used exclusively for the educational purposes authorized by the contracting school district:

05 Data Sharing & Third Parties

We share data only with the service providers necessary to operate the Platform, each bound by contractual data protection obligations. Vendors marked “no student data” never receive student records:

We do not share student data with: Advertisers, data brokers, social media companies, or any entity not listed above.

06 FERPA Compliance

Our FERPA compliance program includes:

• District-scoped access control: All database queries are constrained by cryptographically signed district identifiers — cross-district data leakage is blocked at the database engine level
• Immutable audit logging: Every data access event is recorded in an append-only audit trail that cannot be modified or deleted
• FERPA Bouncer: An autonomous security agent monitors for bulk data scraping. If any account attempts to access more than 50 student records in 60 seconds, the account is automatically disabled and an administrator alert is generated
• AI data minimization: Direct structured student references are SHA-256 pseudonymized, supported direct-identifier patterns are scrubbed on audited model paths, and users are told not to enter direct student identifiers in free-form prompts. Pseudonymization is not anonymity.
• Data Processing Agreements: Each school district signs a DPA specifying data handling obligations, retention periods, and deletion procedures

07 COPPA Compliance

Additional protections for students under 13:

• No self-registration: Students cannot create their own accounts. All accounts are provisioned by school administrators or via school-distributed magic links
• Email age gate: Students in grades K-8 (potentially under 13) never receive direct email from CCMRI. All communications for younger students are routed exclusively to parent or guardian email addresses
• AI chat age gate: A programmatic filter detects self-identified minors under 13 in chat interactions and blocks AI processing, returning a COPPA privacy disclosure instead
• No social features: Students cannot communicate with each other or post public content
• No advertising cookies: The platform does not serve ads and does not profile students for non-educational purposes
• No persistent cross-site tracking: Only essential session cookies are used; no third-party trackers

For the complete COPPA compliance statement, see our COPPA Compliance Document.

08 Data Security

CCMRI implements enterprise-grade security controls to protect all data:

For the complete security policy, see our Security Policy.

09 Data Retention & Deletion

• District product records: Retained for the active contract and returned or deleted on termination under the executed Data Processing Agreement
• Audit logs: The current append-only trail has no TTL and may include limited tenant, actor, IP, or resource identifiers. Its post-termination deletion or de-identification must be expressly defined in the executed Data Processing Agreement
• Demo/trial data: Automatically deleted after the demo session expires (default: 30 days) via an automated data retention enforcer
• Backups: Google-managed daily backups with 30-day retention, plus Point-in-Time Recovery (PITR) with a 7-day window. Backup freshness is verified by an automated nightly control, and restore capability has been exercised and recorded
• Marketing waitlist submissions: Retained until you request removal

Districts may request ad-hoc deletion of any student data at any time by contacting privacy@txccmri.com or using the Platform's built-in Data Governance tools.

10 Cookies & Tracking Technologies

11 Your Rights

For Parents & Guardians

Under FERPA, parents of students whose data is processed by CCMRI have the right to:

• Access: Review your child's education records by contacting the school district
• Correction: Request amendment of inaccurate records through the school district
• Deletion: Request deletion of your child's data by contacting the school district, which will coordinate with CCMRI
• Opt-out: Refuse further data collection by opting out through the school district

All parental requests should be directed to the school district, which acts as the data controller. CCMRI will comply with all verified parental requests within 30 days.

For District Administrators

• Data export: Request a complete export of your district's data at any time
• Data deletion: Request deletion of all district data upon contract termination
• Audit access: View the immutable audit trail for all data access within your district

For Website Visitors

• Waitlist removal: Request removal from the waitlist by emailing privacy@txccmri.com
• Information request: Request a copy of any personal information we hold about you

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

• We will update the "Last Updated" date at the top of this page
• For material changes affecting student data, we will notify affected school districts via email at least 30 days before the changes take effect
• Continued use of the Platform after notification constitutes acceptance of the updated policy

13 Contact Us

For questions about this Privacy Policy, data practices, or to exercise your rights: