Privacy Policy

This page is maintained by the Habitus team to describe, in plain language, what data we collect on behalf of school districts and how we handle it. This is not a substitute for the signed Data Processing Addendum.

Our role

Habitus is a school operating system used by K–12 districts. For student and family data, the district is the data controller and Habitus is a service provider / school official under FERPA. We process data only on the district's documented instructions.

What we collect

• Student records — name, grade, section, enrollment status, behavior entries, attendance, referrals, parent communication logs, and similar district-uploaded data.
• Guardian contacts — name, relationship, email, phone, used for district-initiated communications.
• Staff accounts — name, email, role, school assignment.
• Operational telemetry — sign-in events, audit log of sensitive actions, error reports. Used to keep the service running and to investigate incidents.

What we do not do

• We do not sell or rent student or family data.
• We do not use student data to train third-party AI models.
• We do not show advertising in the platform.

How data is secured

• Encrypted in transit (TLS) and at rest at the database layer.
• Row-level security isolates each district's data.
• Sensitive actions are recorded in a per-district audit log.
• Push and SMS alerts for safety events can be opted into and out of per user.

Subprocessors

Habitus uses a small set of infrastructure subprocessors to host the database, send email, send SMS, and process payments. The current list is provided to district administrators on request and updated at least 30 days before changes.

Data retention and deletion

Districts can export and delete their data from Admin → Backups & Data Export at any time. On contract termination, district data is returned or deleted per the DPA, within 30 days unless the district requests otherwise.

Parent and student requests

Parents and eligible students should contact their school district directly to exercise FERPA or state privacy rights. Habitus will support the district in responding.

Contact

Privacy questions: open a request from the in-app Contact support page, or have your district administrator email us.

Last updated: 2026-06-30.