Privacy Policy

In plain EnglishWe handle student data for schools, under their control. We never sell it or use it to train AI.

nOS AI Assistant (nosassistant.org, the “Service”) is a read-only assistant, operated by nOS LLC (“nOS,” “we,” or “us”), that answers plain-English questions about a school’s master schedule. This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the choices schools and people have. When we process student and staff data, we do it on behalf of the school, which stays in control of it. The Data Processing Agreement a school signs sets out those commitments as contract terms.

1. Information we collect

In plain EnglishSchedule data your school provides, basic account details, your conversations, and ordinary technical logs.

1.1 School schedule data

Schools connect a read-only SIS link or upload schedule files. This data may include student and teacher names and identifiers, grade levels, course requests and enrollments, sections, rooms and periods. The Service needs only scheduling data; please do not submit health, financial, disciplinary or grade records. They are not required for any feature.

1.2 School profile

During setup, an owner or admin may describe the school: its type, location and time zone, school-year dates, approximate enrollment, divisions and grade levels, period names, rotation, terms, class-size limits, scheduling rules and the words the school uses. This describes the school, not individual students.

1.3 Account data

When you create an account we collect your name, email address and school affiliation. Passwords are stored only as bcrypt hashes. Access is single-organization and invite-controlled.

1.4 Agreement records

When someone accepts the Terms or signs the Data Processing Agreement, we record the name, title and school name they typed, their confirmation that they may sign, the time, their IP address and browser user agent, and the document version with a SHA-256 fingerprint of its exact text, so the school can later prove what was agreed.

1.5 Conversations and uploads

Your questions, the assistant’s answers and files you upload are stored in your school’s account so the assistant can keep context. They are isolated to your school and are never used to train AI models.

1.6 Usage data

We collect standard logs (browser type, IP address, error logs) for security and support. We may record first-party product-milestone events (for example, “first import completed”) tied to the school account; these events never contain student data. We also count page views and button clicks with Vercel Web Analytics. It sets no cookies, records page addresses without any tokens in them, and never sees student data. We do not use third-party advertising trackers or behavioral profiling.

2. How we use information

In plain EnglishOnly to run, secure and support the Service for your school.

We use information to provide the Service, answer the questions you ask, authenticate and support users, keep the Service secure, process billing, send service emails (such as password resets and receipts) and meet legal obligations. We never sell, rent or trade student data, never use it for advertising, and never use it to train general-purpose AI models.

2.1 AI processing

When you ask a question, the relevant schedule context (which may include student and teacher names) and the school profile are sent to our AI provider, Anthropic PBC, through its API solely to generate your answer. Under our agreement with Anthropic, this data is not used to train its models and is subject to limited retention. When the assistant uses web search for general research, the outgoing query is scanned before it leaves our systems and is blocked if it contains any roster name, ID or other personal identifier.

3. Who we share information with

In plain EnglishA short list of service providers that help run nOS, and no one else unless the law requires it.

3.1 Service providers (subprocessors)

We rely on vetted, US-based service providers to operate the Service: Vercel (application hosting and file storage), Neon (PostgreSQL database), Anthropic (AI model API), Stripe (billing: payment details only, never student data), and Google Workspace (transactional email), with Resend as a backup email provider. Where semantic memory search is turned on, Voyage AI converts conversation text into search embeddings. Where error reporting is turned on, Sentry receives error reports with personal data removed. Each is contractually bound to protect data consistent with our obligations. The current list is kept in the Data Processing Agreement.

3.2 Legal requirements

We may disclose information if required by law, court order or a governmental authority, and will notify the affected school first unless the law forbids it.

3.3 Business transfers

If nOS is involved in a merger, acquisition or sale of assets, school and student data will remain subject to the protections in this Privacy Policy and the Data Processing Agreement, and we will give schools advance notice where practicable.

3.4 No sale of student data

We do not sell, rent or trade student data under any circumstances.

4. Data retention and deletion

In plain EnglishWe keep data only as long as it is useful, delete it on a fixed schedule, and purge everything when an account closes.

Only the current schedule version and a limited number of recent versions (ten by default) are retained; older versions and their uploaded files are automatically pruned. Deleting your account locks out all members and cancels billing immediately; after a short grace window (fourteen days by default, during which you can ask us to restore it), every record and uploaded file belonging to the account is permanently purged.

Operational records are kept only as long as they are useful and are removed by a daily cleanup job: sign-in rate-limit counters after two days, spent impersonation tickets after seven days, expired or used invite and password-reset links after thirty days, SIS sync logs after about six months, the account activity log and assistant card events after about thirteen months, per-message usage records after twenty-five months, and the operator audit log after three years. Billing ledger entries and signed agreement records are kept for the life of the account. An account created by self-signup whose email address is never verified, and which no one else has joined, is deleted after seven days.

Schools also have per-student tools: account owners and admins can export a complete dossier of everything the Service holds about a single student, and can erase a student, either anonymizing them (keeping roster statistics intact) or deleting them entirely, including scrubbing their details from imported rows and uploaded-document text. Because original uploaded files are kept verbatim, fully removing a student from an old import also means deleting that schedule version or re-importing a redacted file.

5. Security

In plain EnglishEncryption, strict separation between schools, and limited access.

Data in transit is encrypted with TLS; data at rest is stored encrypted by our database and storage providers. SIS credentials are encrypted at rest with AES-256-GCM and masked after entry; they never leave the server. Sessions use signed cookies and expire after inactivity, two-factor sign-in is available, and each school’s data is strictly isolated from every other school’s. No method of transmission or storage is completely secure. If we confirm a breach affecting a school’s data, we will notify that school within seventy-two hours, as the Data Processing Agreement describes.

6. Student privacy and FERPA

In plain EnglishWe act as a “school official” under FERPA, only at the school’s direction.

The Service processes student data on behalf of schools, acting as a “school official” with a legitimate educational interest under FERPA and solely at the school’s direction. Schools remain responsible for the FERPA duties that apply to their records, including answering requests from parents and eligible students; we help them do so.

7. Children’s privacy

In plain EnglishnOS is used by school staff. We do not collect information directly from children.

The Service is designed for school staff, not students. Schools, not nOS, are responsible for any parental consent or notice required by COPPA or other law for data they provide. nOS does not knowingly collect information directly from children. If you believe a child has given us information directly, contact us and we will delete it.

8. Your rights and choices

In plain EnglishAsk your school about student records; ask us about your own account.

Requests to access, correct or delete student data should go to the school that provided it; owners and admins can handle most requests directly with the export and erase tools described above, and we will help with anything else. Depending on where you live, you may have rights over your own account data, such as access, correction and deletion. To use them, contact bennettmiller@nosplanner.com. We will not treat you differently for using them.

9. Changes to this policy

In plain EnglishWe will tell schools before material changes take effect.

We may update this Privacy Policy. Material changes will be communicated to schools at least thirty (30) days before they take effect, and the version date at the top will change. A change never reduces the protections a school’s signed Data Processing Agreement gives it.

10. Contact

In plain EnglishHow to reach us about privacy.

For privacy questions, contact nOS Legal & Privacy at bennettmiller@nosplanner.com. Related documents: Terms of Service · Data Processing Agreement · Security & trust.