Privacy Policy, Terms & Data Processing Agreement

1.1 What we collect

The Spark House SEL Measurement Platform collects anonymous survey responses only. Each response includes:

• Answers to 20 social-emotional learning questions (numeric values 1–4)
• An anonymous participant identifier (e.g., “BASE01-P003”) generated by the system
• Optional self-reported grade level and age
• Timestamp of submission

1.2 What we do NOT collect

We do not collect, store, or process:

• Student names, email addresses, or phone numbers
• Student ID numbers, Social Security numbers, or other government identifiers
• IP addresses or device fingerprints linked to survey responses
• Photographs, biometric data, or location data
• Any information that could be used to identify a specific individual

1.3 How we use the data

Anonymous survey data is used exclusively for:

• Measuring social-emotional learning outcomes at the program site level
• Generating aggregate domain-level reports for program coordinators
• Supporting DYCD COMPASS program evaluation requirements
• Continuous improvement of Spark House youth development programs

Data is never used for marketing, advertising, profiling, or any commercial purpose unrelated to program evaluation.

1.4 FERPA Compliance

Because this platform collects no personally identifiable information (PII) and no education records as defined under the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99), individual survey responses are not considered “education records” under FERPA.

The platform is architected to ensure FERPA compliance by design:

• No student authentication required — surveys are accessed via anonymous access codes
• Participant identifiers are system-generated and cannot be linked to student records
• No data sharing with schools or districts that would constitute a student education record
• Aggregate reporting only — no individual-level data is exposed in reports

1.5 Cookies and tracking

The survey pages do not use cookies, analytics trackers, or advertising pixels. No third-party tracking scripts are loaded on survey pages.

2.1 Retention schedule

2.2 Deletion procedures

At the end of each retention period, data is permanently deleted from all primary databases and backups within 30 calendar days. Deletion is verified and logged. Program coordinators may request early deletion of site-level data by contacting najee@mysparkhouse.org.

3.1 Who has access

3.2 Security measures

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
• Database access requires authenticated service-role credentials
• Dashboard access requires authenticated coordinator login
• No survey response data is cached in the browser or on CDN edge nodes
• Infrastructure hosted on Vercel (SOC 2 Type II compliant) and Supabase (SOC 2 Type II compliant)

4.1 Scope of processing

Data processors are authorized to process anonymized SEL survey responses solely for the purposes of program evaluation, statistical analysis, and report generation as directed by Spark House. Processing includes aggregation, scoring, trend analysis, and preparation of site-level and program-level evaluation reports.

4.2 Processor obligations

• Process data only on documented instructions from Spark House
• Ensure all personnel with access are bound by confidentiality obligations
• Implement appropriate technical and organizational security measures
• Not engage sub-processors without prior written authorization from Spark House
• Assist Spark House in responding to data subject rights requests, if applicable
• Delete or return all data upon termination of the processing relationship
• Make available all information necessary to demonstrate compliance with this DPA

4.3 Controller obligations

• Ensure lawful basis for data collection (anonymized, no PII)
• Provide clear privacy notices to survey participants
• Conduct periodic reviews of processor compliance
• Notify processors of any changes to data processing requirements

4.4 Data breach notification

In the event of a data breach involving survey data, the processor shall notify Spark House without undue delay and no later than 48 hours after becoming aware of the breach. Notification shall include the nature of the breach, categories of data affected, estimated number of records, and measures taken to mitigate impact.

4.5 Authorized processors

5.1 Acceptance

By completing and submitting a survey through this platform, participants acknowledge that they have read this privacy notice and consent to the collection and use of their anonymous responses as described above.

5.2 Age and consent

This survey is designed for youth participants in COMPASS after-school programs (typically ages 11–19). Because no personally identifiable information is collected, parental consent under COPPA (Children’s Online Privacy Protection Act) is not required. Program sites are responsible for obtaining any additional consent required by their own institutional policies.

5.3 Voluntary participation

Participation in this survey is entirely voluntary. Participants may stop at any time before submitting their responses. Once submitted, individual responses cannot be identified or withdrawn because they are anonymous.

5.4 Intellectual property

The COMPASS SEL Youth Survey instrument, platform design, and scoring methodology are the intellectual property of Spark House. The survey framework is aligned with the CASEL (Collaborative for Academic, Social, and Emotional Learning) five-domain model, which is a publicly available educational framework.