Privacy Policy

Effective October 28, 2026

A10 Solutions LLC, under the name A10 Education ("A10", "we", "us"), provides a web application that schools use to keep attendance, class attendance, points, test marks, report cards, incident reports and parent communication (the "Service"). This policy explains what information the Service handles, why, who it is shared with, how long it is kept, and the choices schools, staff, parents and students have. It is part of our Terms of Service; words defined there have the same meaning here.

1. Who is in charge of the information
2. Information we handle
3. How we use information
4. Google user data
5. Class-photo marking
6. Reading marking sheets with AI
7. Who we share information with
8. What we never do
9. Cookies, storage and analytics
10. Security
11. Keeping and deleting information
12. Your choices and rights
13. Children and students
14. Where information is stored
15. Changes
16. Contact

1. Who is in charge of the information

School Data (information about students, parents, guardians and staff that a school enters or creates in the Service) is controlled by the school. The school decides what is collected, why, who can see it, and how long it is kept. A10 processes School Data only on the school's behalf, under its instructions and our Terms. For schools in the United States, A10 acts as a "school official" with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA), and relies on the school's consent on behalf of parents under the Children's Online Privacy Protection Act (COPPA). If you are a parent, student or staff member and have a question or request about School Data, please contact your school first; we will help the school respond.

For our own website, our contact form, and the accounts of school administrators who sign up and pay, A10 decides how the information is used, as this policy describes.

2. Information we handle

Entered by the school (School Data)

• Students: names (including Hebrew names and parents' Hebrew names if the school uses them), grade, class and group, date of birth, home address and phone, email addresses, profile pictures, schedules and classes, and any notes the school records (such as allergies or medical notes it chooses to add).
• Parents and guardians: names, relation to the student, email addresses, phone numbers, and an emergency contact.
• Records: attendance, arrival times, minutes late, class attendance, lunch detention, points, test marks, report-card grades and comments, incident reports, money held or fines the school records, and the history of who changed what and when.
• Staff: names, titles, roles, email addresses, phone numbers, profile pictures, classes, subjects and permissions.
• The school's settings: divisions, grades, subjects, calendar, school times, rooms and seating, branding and logo, and message settings.

From people who use the Service

• Account information: name, email address, role and school; and, when you sign in with Google, your Google name, email address and profile picture. Parents and students invited by their school sign in with a link sent to their email address or with Google.
• Sign-up and billing: the school's name, the administrator's name and email, the plan chosen, payment status, and when the Terms were accepted. Card and bank details are entered directly with our payment processor, Stripe; A10 receives only limited details from Stripe (such as the plan, the payment status, and the card brand and last four digits) and never sees or stores full card or bank account numbers.
• Settings on your device: preferences such as the last tab you opened or whether marking feedback (a buzz and 🎉) is on, kept in your browser.
• Feedback and support: ideas, problem reports and questions you send us (for example with the Send feedback button, which staff, parents and students can use), with your name, email, role, school and the page you were on, so we can reply and fix problems.
• Referrals: when a school signs up through another school's referral link, we keep which school invited which, and whether the new school's first payment was yearly. The inviting school sees the new school's name only once it signs up for a yearly plan; the new school sees the name of the school that invited it. A visitor who opens a referral link sees the inviting school's name.
• Technical information: logs our hosting providers keep to run and secure the Service, such as IP address, browser and device type, pages requested, times and errors.

From visitors to our website

• The contact form: what a visitor types into the "Interested?" form on our home page (name, role, email, phone, school and their answers). It is saved as they type once they enter an email or phone, even if they don't press Send. We use it only to reply about A10, including one follow-up email; ask us and we will delete it.
• Usage statistics: see section 9.

3. How we use information

• To provide the Service to the school: showing, calculating, printing and exporting attendance, points, marks, report cards and reports.
• To send the emails and messages the school or a User sends or turns on, such as parent emails, automatic notices, invitations and sign-in links.
• To create and manage accounts, take payments, and send service, billing and security notices.
• To keep the Service secure: controlling who can see what, keeping a history of changes, and detecting and stopping misuse.
• To give support. With the school's request or permission, or where needed to fix a problem or keep the Service secure, a small number of A10 staff may view a school's account as it appears to one of its Users; this view is read-only.
• To understand how the Service is used and improve it, using de-identified or combined information where we can.
• To meet legal obligations, enforce our Terms, and protect the rights, safety and property of students, Users, A10 and others.

4. Google user data

Users may sign in with Google. With the User's permission, the Service also uses the Gmail API so that parent emails written in the Service are sent from the User's own Gmail account. The Service requests:

• Basic profile and email address (openid, email, profile): to sign the User in and match them to their school account.
• Send email on your behalf (https://www.googleapis.com/auth/gmail.send): to send the parent emails and reports the User writes and chooses to send in the Service. Nothing is sent without the User pressing Send.
• Your Gmail "send as" addresses (https://www.googleapis.com/auth/gmail.settings.basic): only to read the list of addresses the User may send from, so they can choose the "From" address. We do not change any Gmail settings.

The Service does not read, store, scan or delete the User's emails, contacts or other Gmail content. The Gmail access token stays in the User's browser for the session (about an hour) and is not stored on our servers. Users can remove A10's access at any time at myaccount.google.com/permissions.

A10 Education's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the features described above. It is not used for advertising, not sold, not used to train artificial intelligence or machine learning models, and not read by people, except with the User's permission, to investigate a security issue, or to comply with the law.

5. Class-photo marking (optional)

A school may turn on marking attendance from a class photo. It is off unless a school administrator turns it on. When it is on, the person marking takes a photo of the room on their own device, and the faces in it are compared with the students' profile pictures to suggest who is present; the person confirms before anything is recorded. The comparison runs entirely on that device. The class photo is not saved and is not sent to A10 or anyone else. To make the comparison quick, a numeric summary of the face in each student's profile picture (a "face descriptor") is stored with that picture; it is used only for this feature, is deleted with the picture, and is never shared, sold or used for anything else. The school is responsible for confirming that it may use this feature where it is located and for any notice to or consent from parents that the law requires.

6. Reading marking sheets with AI (optional)

When a teacher chooses to scan a paper marking sheet, the photo (which may show students' names and the points written on it) is sent to Google's Gemini API only to read the numbers on it. A10 does not save the photo, and the teacher checks every number on a review screen before anything is saved. Google processes the photo as a service provider to A10 under its terms for the Gemini API.

7. Who we share information with

We share information only as follows:

• Within the school, according to the roles and permissions the school sets, including with parents and students the school invites to its portal (each sees only what the school allows, and only for their own family).
• Service providers that run parts of the Service for us, only as needed for that purpose and under agreements that require them to protect it: Google Cloud and Firebase (hosting, database, sign-in and storage); Google Maps Platform (only the text typed into an address box, to suggest addresses); Google Gemini API (marking-sheet photos, section 6); Google Analytics (section 9); Stripe (payments); our email delivery provider (to deliver emails); and Meta (WhatsApp), only for schools that connect their own WhatsApp Business number, to deliver the messages they send. When a school connects its number through A10's connection with Meta, Meta gives A10 an access key for that number; A10 keeps it on its servers only (never in the app) and uses it only to send that school's messages and manage A10's message template. Parents' phone numbers and the text of each message go to Meta to deliver it.
• Services the school connects, such as a Google Sheet the school chooses to sync with, or a User's own Gmail account for parent emails.
• For legal reasons: when we believe in good faith that the law, a subpoena, court order or government request requires it (where the law allows, we will tell the school first so it can respond), or to protect the safety of students or others, investigate fraud or security issues, or enforce our Terms.
• If A10 changes hands: to a company that controls, is controlled by or is under common control with A10, or to a successor in a merger, sale or reorganization, which must keep protecting the information as this policy describes.
• With permission: with anyone else when the school (or, for your own account information, you) directs us to.

8. What we never do

• We do not sell personal information or School Data, or share it for cross-context behavioral advertising.
• We do not use student information for advertising, and there is no advertising in the Service.
• We do not build profiles of students for any purpose other than the school's own use.
• We do not use School Data or Google user data to train artificial intelligence models.

9. Cookies, storage and analytics

The Service uses your browser's storage to keep you signed in and to remember your settings; without it the Service cannot work. We use Google Analytics to see how the website and the Service are used (for example, which pages are opened and which features are used), so we can improve them. It uses cookies and receives your browser's IP address and device details from Google. For signed-in Users we send an account ID with their role, title, school and division; we never send names, email addresses, phone numbers, or any student information or school records. You can block it with your browser's settings or Google's opt-out add-on (tools.google.com/dlpage/gaoptout). We do not use cookies for advertising. Because there is no common standard for "Do Not Track" signals, our website does not respond to them.

10. Security

Information is stored with Google Cloud and Firebase. It is encrypted in transit and at rest; access is limited by sign-in and by database rules that keep each school's information separate and give each User only what their role allows; and changes are recorded. No system is perfectly secure, so we cannot promise that information will never be accessed without permission. If we confirm that School Data in our control was accessed or disclosed without permission, we will tell the affected school without undue delay and as the law requires (including New York's SHIELD Act where it applies), so the school can notify families as the law requires of it.

11. Keeping and deleting information

• We keep School Data for as long as the school uses the Service. School administrators can change or delete student, parent and staff records at any time.
• When a school stops using the Service, or asks us to, we delete its School Data within 90 days, after giving it 30 days to ask for a copy, except where the law requires us to keep something longer. Copies in our providers' backups are overwritten on their regular cycle.
• We keep billing records as long as tax and accounting laws require, and contact-form and support messages until they are no longer needed or you ask us to delete them.
• We may keep de-identified, combined information that cannot identify any school or person.

12. Your choices and rights

• Parents and eligible students have rights under FERPA and state laws to see student records, ask for corrections and, in some cases, have them deleted. Because the school controls those records, please ask the school; we will help it respond.
• Users can see and update their own account in My account, and can ask us about their account information at the address below.
• Messages: parents can ask the school to stop emails or WhatsApp messages; the school can turn notices off for each parent. You can remove A10's Gmail access at any time at myaccount.google.com/permissions.
• State privacy rights: depending on where you live, you may have rights to know, access, correct, delete or get a copy of your personal information, and to opt out of its sale or sharing (we do not sell or share it). To use them, email us; we will verify your request and answer within the time the law requires, and will not treat you differently for using them. An authorized agent may ask for you with proof of authority. If we deny a request, you may appeal by replying to our answer.

13. Children and students

The Service is for schools. Students, including children under 13, use it or have information in it only through their school, which is responsible for any notice to and consent from parents that the law requires, and for deciding whether a student may have a sign-in. We use student information only to provide the Service to that school. We do not knowingly collect information directly from a child outside a school's use of the Service; if we learn that we have, we will delete it. A parent who believes their child's information was given to us without the school's authorization can contact us.

14. Where information is stored

A10 is based in the United States. Information is stored and processed in the United States and in other countries where our providers run their services, under their protections. By using the Service from outside the United States, the school agrees to this transfer and is responsible for any notice or consent its own laws require.

15. Changes

We may update this policy. The current version is always on this page, with the date it took effect at the top. We will not use School Data in a materially different way than this policy describes without the school's permission.

16. Contact

Questions, requests and complaints: admin@a10.education