Privacy Policy

Effective date: June 9, 2025

1. Introduction

The S.R.F. School Administrative Portal (“the Portal”) is operated by S.R.F. School staff on behalf of S.R.F. School (“we,” “us,” or “our”). This Privacy Policy explains what personal information we collect, how we use it, and your rights with respect to that information. By registering a student or accessing the Portal, you acknowledge that you have read and understood this policy.

2. Information We Collect

Registration data

When a family registers students through the Portal, we collect:

  • Guardian names, email addresses, and phone numbers

  • Children's names and dates of birth

  • Home address

  • Emergency contact information

  • Photo consent preferences

  • Volunteer interest

  • Digital signature for enrollment authorization

Account data

If you create a Portal account (admin, teacher, or parent), we collect:

  • Email address

  • Name and profile information provided via Google OAuth, if you choose that sign-in method

  • Hashed credentials managed by AWS Cognito — we never store your password in plain text

Usage and technical data

We do not use analytics trackers or advertising cookies. The only technical data we collect is what is strictly necessary for authentication and session management (see Section 4 — Cookies).

3. How We Use Your Information

We use the information described above solely for school administration purposes:

  • Managing student enrollment, attendance, and class scheduling

  • Facilitating secure access for teachers and administrators

  • Contacting families regarding school-related matters

  • Verifying guardian identity and consent during registration

We do not use your data for marketing, profiling, or any purpose unrelated to the operation of S.R.F. School.

4. Cookies and Session Storage

The Portal uses a single first-party session cookie:

  • Name: srf_session

  • Purpose: Maintains your authenticated session after login. Stores encrypted session tokens (access token, refresh token, and expiry timestamp).

  • Duration: The cookie expires when your session expires or when you log out. It is not a persistent tracking cookie.

  • Scope: This cookie is set on the portal domain only and is never accessible to third-party scripts.

We do not use tracking cookies, advertising cookies, or any third-party analytics cookies. No fingerprinting or cross-site tracking is performed.

5. Data Sharing and Disclosure

We do not sell, rent, or trade personal data. We do not share personal information with third parties for commercial or marketing purposes. Your data may be accessible to the following parties only in the course of operating the Portal:

  • Amazon Web Services (AWS) — provides the infrastructure for data storage (DynamoDB), authentication (Cognito), and application hosting. AWS processes data on our behalf under their own data processing agreements.

  • S.R.F. School staff — administrators and teachers who have been granted access to the Portal in connection with their duties.

We may disclose information if required by law, court order, or to protect the rights and safety of students and staff.

6. Data Retention

Student and family records are retained for as long as the student is enrolled or the family record is otherwise active. Account credentials managed by AWS Cognito are retained until the account is deleted. You may request deletion of your data at any time by contacting your school administrator (see Section 8).

7. Data Security

We take reasonable technical and organizational measures to protect your data, including encrypted storage, access controls, and industry-standard authentication practices. However, no system is completely secure. If you believe your account has been compromised, please contact your school administrator immediately.

8. Your Rights

You have the right to:

  • Access the personal information we hold about you or your children

  • Request correction of inaccurate or outdated information

  • Request deletion of your personal data, subject to any legal retention requirements

To exercise any of these rights, please contact your S.R.F. School administrator directly. We will respond to requests within a reasonable timeframe.

9. Children's Privacy

The Portal is designed to be administered by adults (parents, guardians, teachers, and administrators). Children do not directly interact with the Portal or create accounts. All student data is provided and managed by a parent or guardian during registration.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, the effective date at the top of this page will be revised. Continued use of the Portal after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.

11. Contact

If you have questions or concerns about this Privacy Policy, please contact your S.R.F. School administrator.