Privacy Policy

Last updated: [Month Day, Year]

EduShieldID ("EduShieldID," "we," "us," or "our") provides an identity verification and financial-aid eligibility platform used by educational institutions ("Institutions") to verify students ("Students," "you"). This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to the EduShieldID website, student portal, school administration portal, and related services (together, the "Service").

Because EduShieldID processes education records on behalf of Institutions, in most cases the Institution is the party responsible for the student data under FERPA, and EduShieldID acts as a "school official" with a legitimate educational interest, bound by the same use and re-disclosure restrictions as the Institution. If you are a student with questions about how your specific school uses your data, you should also contact your Institution directly.

1. Information We Collect

We collect the following categories of information:

Identity and contact information: name, date of birth, email address, phone number, and student/institution ID numbers.
Verification data: government-issued ID images, selfie/liveness capture images and video frames, and the results returned by our identity-verification provider, Persona.
Documents: enrollment letters, financial-aid forms, and other supporting documents you or your Institution upload, along with data extracted from them via optical character recognition (OCR).
Roster and eligibility data: enrollment status, program, term, and financial-aid eligibility data provided by your Institution for matching against your verification request.
Fraud-signal data: device and browser characteristics, IP address, and behavioral signals used by our fraud-scoring engine to flag potentially fraudulent verification attempts.
Usage data: log data, pages viewed, and actions taken within the portal, collected automatically and via cookies (see our Cookie Policy).
Billing information: for Institution administrators, invoicing and payment-method details, processed by our payment processor.

2. How We Use Information

To verify student identity and confirm enrollment or financial-aid eligibility on behalf of an Institution.
To run OCR analysis, roster matching, and fraud-risk scoring as part of the verification pipeline.
To let school administrators review and approve or deny verification requests.
To send notifications about the status of a verification or appeal.
To maintain audit logs required for compliance, dispute resolution, and security investigations.
To bill Institutions for use of the Service.
To monitor, secure, and improve the Service, including detecting abuse and fraudulent activity across the platform.

We do not sell student personal information, and we do not use it for behavioral advertising.

3. How Information Is Shared

With your Institution: verification results, submitted documents, and eligibility outcomes are shared with the Institution that initiated the verification request.
Service providers: we share data with vendors who perform services on our behalf, including identity verification (Persona), cloud hosting and storage, and payment processing. These providers are contractually restricted to using data only to provide services to us.
Legal and safety: we may disclose information where required by law, subpoena, or court order, or to protect the rights, property, or safety of EduShieldID, our users, or others.
Business transfers: if EduShieldID is involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction, subject to the same protections described here.

4. Data Retention

We retain verification records, submitted documents, and audit logs for as long as needed to fulfill the purposes described in this policy, satisfy the retention requirements agreed with the relevant Institution, and meet our own legal, accounting, and security obligations. Retention periods for specific record types are set out in our data-retention schedule, available to Institution administrators on request. Students can review applicable retention windows in the Privacy Settings page of the student portal.

5. Security

We apply technical and organizational safeguards appropriate to the sensitivity of the data we handle, including encryption of sensitive fields at rest, encrypted transmission (TLS), role-based access controls, rate-limiting, two-factor authentication for administrative accounts, and audit logging of access to verification records. No system is completely secure, and we cannot guarantee absolute security.

6. Your Rights and Choices

Depending on your location and your Institution's policies, you may have the right to access, correct, or request deletion of your information, or to object to certain processing. Because much of this data is held on behalf of an Institution under FERPA, requests to access or amend education records should generally be directed to your Institution, which may route the request to us. You can manage cookie preferences at any time as described in our Cookie Policy, and manage certain retention and notification preferences from your account's Privacy Settings.

7. International Data Transfers

EduShieldID is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your home jurisdiction.

8. Children's Privacy

The Service is intended for use by or on behalf of students in connection with an Institution's enrollment or financial-aid processes. Where a Student is a minor, we rely on the Institution's authority under FERPA and applicable state law to process the minor's information, rather than obtaining separate consent directly from the minor.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify Institution administrators and update the "Last updated" date above. Continued use of the Service after an update constitutes acceptance of the revised policy.

10. Contact Us

Questions about this Privacy Policy can be directed to privacy@[yourdomain].com.