Privacy Policy
Last updated: June 8, 2026
Or Hadash is a school operations platform built for Jewish day schools and private schools. We act as a service provider / school official processing data on behalf of the schools that use our platform. This policy explains what we collect, why, how we protect it, and the rights of schools, parents, and students.
Who controls the data
The school is the data controller for student, parent, and staff records. Or Hadash processes that data only under the school's direction, to provide and secure the service. We do not sell personal information and never use student data to train AI models or for advertising.
What we collect
- Account and contact details for staff, parents, and students (name, role, email, school).
- School-operations records the school chooses to manage in the platform — schedules, attendance, grades, messages, documents, approvals, and billing/donation records.
- Content submitted to the Or assistant for the purpose of completing an authorized task.
- Technical and security logs (audit trails, IP, device/browser) needed to operate and protect the service.
How we use it
Solely to deliver the platform: authenticate users, enforce role-based permissions, generate role-aware briefs and documents, run approval and print workflows, and keep audit logs. AI-generated grades, comments, announcements, and external writebacks default to drafts requiring human approval unless a school explicitly enables approval-based posting.
COPPA — children under 13
For students under 13, Or Hadash relies on the school to provide consent on behalf of parents as permitted under the Children's Online Privacy Protection Act (COPPA), consistent with the FTC's school-consent guidance. We collect only the data needed for the educational purpose authorized by the school, do not condition participation on disclosing more than is reasonably necessary, and do not use children's data for marketing or AI training. Student accounts are restricted in code from using the assistant to complete assignments, generate test answers, or otherwise bypass learning. Parents may, through the school, review their child's information and request its deletion.
FERPA — education records
Or Hadash handles personally identifiable information from education records as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA). The school retains direct control of the records, we use them only for the authorized service, and we do not re-disclose them except as the school directs or the law requires. Parent and eligible-student rights to inspect, amend, and control disclosure of records are exercised through the school.
How we protect it
- Per-school tenant isolation and role-based access control on every sensitive action.
- Encryption in transit; integration tokens encrypted at rest.
- Audit logging of important user and AI actions, including before/after values for sensitive edits.
- Data minimization — we collect only what the educational purpose requires.
Data sharing
We share data only with sub-processors that help us run the service (e.g., hosting, database, email, and AI infrastructure) under contractual confidentiality and security obligations, or when required by law. We do not sell personal information.
Retention, export, and deletion
Schools control retention. On request or at the end of a school's engagement, we provide data export and deletion. Parents and eligible students may request access to, correction of, or deletion of their information through their school.
Contact
Questions about this policy or a data request? Reach us through the contact page and we'll route it to the right team.