Privacy policy

Who this covers

Schools and districts that use BellFlo ("the school"), their staff and administrators, the students whose dismissal it records, and, only with the Family notifications add-on, the parents and guardians the school lists.

Students do not use BellFlo or create accounts in it. Under FERPA we act as a "school official" with a legitimate educational interest, under the school's direct control.

What we keep

Students, from the school's records or entered by its staff:

• first and last name, grade and homeroom teacher; the student ID from the school's records, if the school uses one; optionally, how to pronounce the name;
• the car tag number and code, and, for bus riders, the usual bus number and dated changes to the way home;
• dismissal records: when the child left, by which car batch or bus, and which staff member and device recorded it; and "do not release" holds, which are deleted after their day.

Staff screens, boards and printed car tags show a child's first name and the first letters of the last name ("Emma R."). The full last name is stored encrypted and shown only to the school's administrators.

We never keep student photos, home addresses, dates of birth, phone numbers, bus stops or routes on a map.

Staff and administrators: name, work email, role, the devices the school enrolled, and the district sign-in account they use. PINs and passwords are stored only as one-way hashes; authenticator-app keys are encrypted. For security, administrators' sign-ins and failed sign-in attempts (time, network address) and staff lockouts are recorded and kept for 90 days.

Parents and guardians, only if the school has the Family notifications add-on and lists them: name, email (optional), preferred language (English or Spanish), the guardian ID from the school's records, the messages sent, and, if they use the family app, a notification token for their phone. Families can't sign themselves up; the school decides who is listed. We don't keep their phone numbers or addresses.

Support and operations: support requests and their attachments; an activity log of actions (who, which device, when); error reports from the app and the website (the page or screen and the device or browser type); and, when our support team signs in to help a school, the time and network address of that session.

Connections to the district's systems

When a school connects its student information system (OneRoster or Clever), BellFlo keeps only the fields listed above (with the add-on and the school's choice, parents' names and emails). Everything else in the fetched records is discarded after each sync.

When a school uses district sign-in (Google, Microsoft, ClassLink, RapidIdentity, Okta or another OpenID Connect or SAML sign-in), we receive the person's name, email and account ID from the district's sign-in, to match them to their BellFlo account.

What stays on the device

Car tags and bus tags are read by the device's camera on the device itself, and names are spoken by the device's own voice. No camera images and no audio are sent to us.

How we use it

• to run dismissal for the school and show its staff the boards, lists and records;
• to send the messages the school has turned on (family notifications, sign-in codes, alerts to staff);
• to keep the service secure and working, and to answer the school's support requests.

We do not sell any of this information, use it for advertising, build profiles of students, or use it for any purpose the school hasn't asked for.

Who else handles it

Only the service providers we need to run BellFlo, each limited to their part:

• our hosting and backup providers, which run the servers and store encrypted backups;
• Zoho ZeptoMail, which delivers emails;
• Expo, which passes app notifications to Apple and Google for delivery to phones;
• the district's own sign-in and student information system, when the school connects them.

We share information otherwise only if the law requires it, and we tell the school first unless the law forbids that.

How long we keep it

• Each school chooses how long dismissal history is kept: 90 days, 6 months, 1 year (the default) or 2 years. Older dismissal days, pickups, messages and activity-log entries are deleted automatically.
• The student list is kept until the school removes a child. A school administrator can delete a child's records permanently at any time.
• "Do not release" holds are deleted after their day; expired sign-ins and codes are deleted.
• At the end of a school's use, all of its information is deleted within 30 days.
• Deleted information may remain in encrypted backups until those backups expire.

Security

• Connections are encrypted (HTTPS). Students' last names, parents' names and email addresses, connection secrets and authenticator keys are encrypted when stored, with keys kept apart from the database; passwords and PINs are stored only as one-way hashes.
• Administrators sign in with the district's sign-in, or with a password and an authenticator-app code.
• Staff PINs work only on devices the school has enrolled; easy PINs are refused, a device locks after 10 wrong PINs, and a lost device can be removed at once.
• Each school sees only its own information. Our support team signs in to a school's account only with the school's permission, for a limited time, and every such session is logged.

If we learn of a breach affecting a school's information, we will tell the school promptly and help it meet its own obligations.

Requests from families and staff

The school controls its records. Parents and eligible students who want to see, correct or delete information should contact their school, which can do this in BellFlo or ask us to help. If you contact us directly, we will pass your request to the school.

Changes and contact

When this policy changes we update the date above, and we tell schools before any change that affects how their information is used.

Questions: [email protected]. See also our terms of service.