nOS AI Assistant (nosassistant.org, the “Service”) is a read-only assistant, operated by nOS LLC, that answers plain-English questions about a school’s master schedule. This Privacy Policy explains how we collect, use, disclose, and protect information in connection with the Service. The Service processes student and staff data on behalf of the school; the school remains in control of its data at all times.
1. Information we collect
1.1 School schedule data
Schools connect a read-only SIS link or upload schedule files. This data may include student and teacher names and identifiers, grade levels, course requests and enrollments, sections, rooms, and periods. The Service needs only scheduling data — please do not submit health, financial, disciplinary, or grade records; they are not required for any feature.
1.2 Account data
When you create an account we collect your name, email address, and school affiliation. Passwords are bcrypt-hashed and never stored in plaintext. Access is single-organization and invite-controlled.
1.3 Conversations and uploads
Your questions, the assistant’s answers, and files you upload are stored in your account so the assistant can keep context. They are isolated to your school and are never used to train AI models.
1.4 Usage data
We collect standard logs (browser type, IP address, error logs) for security and support. We may record first-party product-milestone events (for example, “first import completed”) tied to the school account — these events never contain student data. We do not use third-party advertising trackers or behavioral profiling.
2. How we use information
We use collected information to provide and improve the Service, answer the questions you ask, authenticate and support users, monitor security, process billing, communicate with you about the Service, and comply with legal obligations. We never sell, rent, or trade student data, and never use it to train general-purpose AI models.
2.1 AI processing
When you ask a question, relevant schedule context (which may include student and teacher names) is sent to our AI provider, Anthropic PBC, through its API solely to generate your answer. Under our agreement with Anthropic, this data is not used to train its models and is subject to limited retention. When the assistant uses web search for general research, the outgoing query is programmatically scanned before it leaves our systems and is blocked if it contains any roster name, ID, or other personal identifier.
3. Disclosure of information
3.1 Service providers (subprocessors)
We rely on vetted, US-based service providers to operate the Service: Vercel (application hosting and file storage), Neon (PostgreSQL database), Anthropic (AI model API), Stripe (billing — payment details only, never student data), and Google Workspace (transactional email). Each is contractually bound to protect data consistent with our obligations.
3.2 Legal requirements
We may disclose information if required by applicable law, court order, or governmental authority, and will notify the affected school to the extent permitted by law.
3.3 Business transfers
In the event of a merger, acquisition, or sale of assets, school and student data will remain subject to the protections in this Privacy Policy, and we will provide advance notice to the extent practicable.
3.4 No sale of student data
We do not sell, rent, or trade student data under any circumstances.
4. Data retention and deletion
Only the current schedule version and a limited number of recent versions (ten by default) are retained; older versions and their uploaded files are automatically pruned. Deleting your account locks out all members and cancels billing immediately; after a short grace window (fourteen days by default, during which you can ask us to restore it), every record and uploaded file belonging to the account is permanently purged.
Schools also have per-student tools: account owners and admins can export a complete dossier of everything the Service holds about a single student, and can erase a student — either anonymizing them (keeping roster statistics intact) or deleting them entirely, including scrubbing their details from imported rows and uploaded-document text. Because original uploaded files are kept verbatim, fully removing a student from an old import also means deleting that schedule version or re-importing a redacted file.
5. Security
Data in transit is encrypted with TLS; data at rest is stored encrypted on our database provider. SIS credentials are encrypted at rest with AES-256-GCM and masked after entry — they never leave the server. Sessions use signed cookies, and each school’s data is strictly isolated from every other tenant. No method of transmission or storage is 100% secure; in the event of a confirmed breach we will promptly notify affected schools, consistent with applicable law and the nOS Data Processing Agreement.
6. Student privacy and FERPA
The Service processes student data on behalf of schools, acting as a “school official” under FERPA and solely at the school’s direction. Schools are responsible for complying with FERPA requirements applicable to their student data; nOS does not independently control its use.
7. Children’s privacy
The Service is designed for use by school staff on behalf of students. Schools, not nOS, are responsible for obtaining any required parental consents under COPPA or other applicable law. nOS does not knowingly solicit information directly from students or minors.
8. Your rights and choices
Requests for access, correction, or deletion of student data should be directed to the school that submitted it; owners and admins can fulfill most requests directly with the export and erase tools described above, and we will assist with anything else. Questions about your own account data can be sent to bennettmiller@nosplanner.com.
9. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated to schools with at least thirty (30) days’ advance notice. Continued use of the Service after the effective date constitutes acceptance.
10. Contact
For privacy-related inquiries, contact nOS Legal & Privacy at bennettmiller@nosplanner.com. Related company documents: Security & trust · Data Processing Agreement (PDF) · Subprocessor List (PDF).
Last updated July 16, 2026.