Privacy Policy

Effective Date: August 5, 2026

Swiftscore LLC ("Swiftscore," "we," "us," or "our") operates Eval by Swiftscore (the "Service"), an AI-powered platform that helps education leaders streamline teacher observation, evaluation, and coaching in the United States.

This Privacy Policy explains how we collect, use, disclose, and protect Personal Information when you use the Service. We are committed to transparency, data minimization, and industry-standard security.

• Eval is designed for adults (18+) in educator and leadership workflows. We do not create student accounts. Customer-authorized student references may be processed only for an approved school purpose.
• We use Google Vertex AI or the Google Gemini API for generative features and ElevenLabs for transcription; processor access is limited to approved data categories and purposes.
• We do not sell Personal Information and we do not share it for cross-context behavioral advertising.
• We support U.S. education privacy laws including FERPA and relevant U.S. state privacy laws, and GDPR where applicable to EU or EEA data subjects who choose to use the Service.
• Customer Content is stored primarily in Supabase-hosted infrastructure in AWS us-east-1. We configure U.S. processing regions where the selected service supports regional controls; contract-specific residency commitments control where applicable.
• We will execute FERPA-aligned data processing terms and provide a written COPPA commitment upon request.
• You control your User Content. You can access, correct, export, and delete Personal Information, subject to legal exceptions.

Scope: This Policy covers Personal Information processed by Swiftscore through the Service. It does not cover third-party sites or services we do not control.

Roles

• When an organization such as a school or district uses the Service, the organization is typically the data controller or FERPA education agency, and Swiftscore acts as a data processor, service provider, or contractor under applicable laws.
• For individual accounts used for pilots or trials, Swiftscore may act as a controller for limited account, support, and billing data.

GDPR Legal Bases where applicable:

• Contract (Art. 6(1)(b)) to provide the Service you requested.
• Legitimate interests (Art. 6(1)(f)) such as security, fraud prevention, and product improvement using de-identified or aggregated data.
• Consent (Art. 6(1)(a)) where required for marketing and certain cookies.
• Legal obligation (Art. 6(1)(c)) for tax and records retention.

Personal Information or Personal Data: Information that identifies or can reasonably be linked to an identified or identifiable natural person.

User Content: Observation notes, evaluation reports, coaching materials, framework selections, audio and transcriptions you submit to or generate through the Service. You retain ownership of your User Content.

De-identified or Aggregated Data: Data that cannot reasonably be used to identify you. We maintain de-identification measures and will not re-identify such data.

AI and transcription providers: Google Vertex AI or the Google Gemini API for generative features, and ElevenLabs for speech-to-text.

Information you provide:

• Account and organization details such as name, email, professional role, school or organization, and password stored as a secure hash.
• OAuth via Google Sign-In if used, including limited profile info and tokens necessary for authentication. You can revoke access via your Google account settings.
• User Content such as observation notes, evaluations, rubrics and framework choices, coaching plans, uploaded audio, and transcriptions if you enable recording features.
• Support communications and feedback.

Information collected automatically:

• Technical and usage data such as IP address, approximate location, device and OS, browser, pages and features used, timestamps, referring URLs, and crash logs.
• Cookies and local storage for authentication, sessions, feature flags, and analytics preferences.

Sources:

• Directly from you and your organization, from your device or browser, and from integrated services you authorize such as Google OAuth.

What we do not intend to collect:

• The Service is not designed to collect student records as primary data. If your User Content incidentally references students, you represent that you have lawful authority such as FERPA compliance to do so. We do not market to or create student accounts.

Primary uses:

• Provide, secure, and maintain the Service; authenticate users and administer accounts.
• Generate AI-assisted evaluations, transcriptions, coaching suggestions, and reports.
• Process payments and subscriptions and send transactional notices such as receipts and feature updates.
• Respond to support requests and service communications.

Improvement and research:

We may use de-identified or aggregated information that is not obtained from Google Workspace APIs to improve model quality, develop features, analyze usage patterns, and publish high-level product insights. Google Workspace API user data, including aggregated, anonymized, or derived data, is excluded from these uses. We do not re-identify de-identified data.

Compliance and protection:

To comply with law, enforce terms, detect and prevent fraud or abuse, protect rights and safety, and maintain the integrity of the Service.

Automated decisions:

Important decisions are not made solely by automated processing. Users can review and edit AI-generated content.

We use Google Vertex AI or the Google Gemini API for generative features such as evaluation generation and coaching support, and ElevenLabs for speech-to-text.

• We transmit only the minimum necessary prompts and inputs to perform the requested operation.
• Public model training is disabled for your content. Where available, we enable zero data retention for generative requests.
• We invoke U.S. regional endpoints and restrict AI processing to U.S. Google Cloud regions supported by the models.
• You remain responsible for reviewing and editing AI outputs before use.

Swiftscore's use of information received from Google Workspace APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Swiftscore does not use, transfer, or sell raw, aggregated, anonymized, or derived Google Workspace API user data to create, train, or improve generalized, foundational, or non-personalized artificial intelligence or machine-learning models. We use Google Workspace API user data only to provide the user-requested, user-facing features of the Service.

• Essential cookies for authentication, session, and security.
• Functional cookies for preferences, feature flags, and language.
• We do not run third-party product analytics or browser session recording in the application.

You may control cookies in your browser. Blocking essential cookies can impact functionality. We currently do not respond to Do Not Track signals.

Service providers and subprocessors:

We share Personal Information with vendors only for configured service functions. Education-record egress requires an active organization authorization and an approved processor scope in our service controls.

Infrastructure and AI:

Google Cloud Platform for hosting and Vertex AI, or the Google Gemini API when configured for that deployment; ElevenLabs provides batch and realtime speech-to-text.

Database and authentication:

Supabase-hosted Postgres and object storage in AWS us-east-1. The application uses server-enforced tenant and role authorization; dedicated compliance tables additionally deny direct end-user access through Row Level Security.

Transactional communications:

Resend for approved transactional email delivery. Education-record exports are not attached to email inline; they enter a tracked privacy-request workflow for secure fulfillment.

Your organization:

We share in accordance with your organization settings with authorized administrators and collaborators.

Legal and government requests:

We may disclose information if required by law, subpoena, or valid government request. Where legally permitted, we will provide advance notice and seek to narrow requests.

Business transfers:

In a merger, acquisition, or asset sale, Personal Information may be transferred with a commitment that the successor honors this Policy or provides materially comparable protections.

No sale or targeted advertising sharing:

We do not sell Personal Information and we do not share it for cross-context behavioral advertising.

We apply industry-standard technical and organizational measures including:

• Encryption in transit using TLS 1.2 or higher and provider-managed encryption at rest.
• Server-enforced tenant, role, and resource authorization with least-privilege permissions.
• Immutable compliance ledgers for governed processor disclosures and privacy-request status changes.
• Regular security testing, patching, and vulnerability assessments.

Breach notification:

If a security incident affects Personal Information, we will notify affected parties without undue delay and within applicable legal timeframes such as 72 hours under GDPR where applicable, including the nature, scope, and mitigation steps.

User responsibilities:

You are responsible for maintaining the security of your devices and credentials.

We retain Personal Information only as long as necessary for the purposes described or as required by law. Typical retention periods:

• Active account data: while the account remains active.
• Evaluation reports and User Content: five years from creation unless legal hold applies or your organization configures otherwise.
• Authentication logs: one year.
• Financial and transactional records: seven years.
• Soft-deleted records: permanently removed after ninety days.
• Backups and archives: deleted on rolling cycles consistent with the above timelines.

Deletion requests:

Upon verified deletion requests or account closure, data is marked for deletion and removed after applicable retention and backup windows subject to legal holds.

Core rights for all users:

Access, correct, delete, and export Personal Information and object to or restrict certain processing, subject to legal exceptions and organizational controls.

U.S. state privacy rights:

Depending on your state, you may have rights to know or access, correct, delete, and data portability. You may have rights to opt out of sale or targeted advertising. We do neither. You may have rights to limit use or disclosure of sensitive data which we use only as needed to provide the Service. You may appeal a rights decision and we will include appeal instructions in our response.

California disclosures under CCPA and CPRA:

In the past twelve months, we collected identifiers, professional information, internet activity, coarse geolocation, audio if enabled, and sensitive data such as auth tokens and role permissions. We did not sell any of these categories and we did not share them for cross-context behavioral advertising. We do not have actual knowledge that we sell or share data of consumers under sixteen. We do not discriminate for exercising privacy rights.

GDPR where applicable:

You may have rights to access, rectify, erase, restrict or object to processing and data portability, and to lodge a complaint with a supervisory authority. Where we rely on consent, you may withdraw it at any time.

How to exercise rights:

Use in-app controls where available or email matt@swiftscore.org with your request, the email tied to your account, and any organization affiliation. We acknowledge requests within two business days, triage within five business days, and target fulfillment within thirty calendar days, subject to identity and authority verification and legally permitted extensions.

The Service is intended for adults eighteen and older. We do not knowingly collect Personal Information from children under thirteen or under sixteen where that is the age of digital consent. If you believe a child provided Personal Information, contact us and we will promptly delete it.

If you as an educator include student references in User Content, you represent you have lawful authority under FERPA and appropriate consents or authorizations.

Primary location and regional controls:

Primary database and object storage are in Supabase-hosted infrastructure in AWS us-east-1. We select U.S. regional endpoints where supported and record approved processor regions in our processor registry. Customer contracts and data processing addenda control any stricter residency commitment.

The Service may link to third-party sites and services. Their privacy practices are governed by their own policies. Review those policies before interacting with them.

Integrations you enable such as Google OAuth share only the minimum necessary information.

FERPA:

Where an executed customer agreement authorizes us to process education records, the agreement identifies the applicable FERPA role and permitted educational purpose, and the education agency remains the custodian of records.

Data Processing Addendum:

A DPA reflecting processor or service-provider obligations including security, subprocessing, audit cooperation, and deletion or return is available upon request.

State education privacy laws:

We execute required addenda such as New York Education Law 2-d and Parents' Bill of Rights attachments consistent with our processing model and security measures.

We scrutinize all requests to ensure legal validity and scope. If legally permitted, we will provide prior notice to the organization or user so they can seek protection.

We seek to narrow requests and disclose only the minimum necessary.

AI and data use for improvement:

You may opt out of our use of de-identified derivatives of your content for internal model or feature improvement by emailing us. When enabled by Google, we also set zero data retention for Vertex AI generative requests.

Communications:

You can opt out of non-essential emails. Transactional emails are required for service delivery.

Cookies:

Manage via browser settings and in-app preferences.

You agree to keep your account and organization information accurate and current, to maintain the confidentiality of credentials, and to ensure you have the right to input any Personal Information into the Service including incidental student references.

We may update this Policy from time to time. We will post the updated Policy with a new Effective Date, provide notice of material changes such as email or in-app notice, and obtain consent where required by law.

Your continued use after changes become effective constitutes acceptance.

Privacy Officer
Swiftscore LLC (Eval by Swiftscore)
12 Dogwood Rd
Bedford, NY 10506

Email: matt@swiftscore.org

We acknowledge privacy inquiries within two business days and target verified request fulfillment within thirty calendar days.

Cloud and hosting:

Google Cloud Platform for compute, storage, and security, using U.S. regional endpoints where the configured service supports regional controls.

Database and authentication:

Supabase for Postgres and object storage in AWS us-east-1 in Northern Virginia. Swiftscore uses its own signed-JWT authentication and server-side authorization layer.

AI:

Google Vertex AI or the Google Gemini API for prompt processing and generation. ElevenLabs provides speech-to-text.

Transactional email:

Resend for transactional email delivery.

We may update subprocessors as our Service evolves. Material changes will be notified consistent with this Policy.

Transport security:

TLS 1.2 or higher.

Encryption at rest:

AES-256 with provider-managed keys.

Authentication:

Short-lived JWTs with refresh tokens and HTTP-only secure cookies with SameSite attributes.

Access controls:

Principle of least privilege, role-based access, audit logging.

Application security:

Input validation, rate limiting, and dependency patching.

Database:

Server-side tenant and resource authorization is the primary data boundary. Dedicated compliance stores also use Row Level Security to block direct end-user access.

Reviews:

Periodic security audits and vulnerability assessments.

California CPRA:

We act as a service provider or contractor. No sale or cross-context advertising sharing. Consumer rights are honored per the rights section.

Colorado, Connecticut, Virginia, Oregon, Texas, and Utah:

We process only for specified purposes. We honor access, correction, deletion, portability, and applicable opt-out rights. We provide an appeals process.

Student privacy statutes such as SOPIPA and New York Education Law 2-d:

We do not use education information for targeted advertising or create profiles unrelated to educational purposes. We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of data.

We are not a HIPAA Covered Entity and generally do not act as a Business Associate. Do not submit protected health information to the Service.

If a Business Associate arrangement is required for a specific use case, contact us before using the Service.

Data minimization:

We collect only what we need to provide the Service.

Privacy by design:

Privacy and security are integrated into development lifecycles and reviews.

Record of processing:

Maintained internally and available to enterprise customers upon reasonable request under a nondisclosure agreement.

Audit cooperation:

For enterprise customers under a DPA, we provide reasonable audit cooperation regarding our security controls and subprocessors.

Reference:

COPPA Compliance Statement is available upon request.

Residency:

Primary User Content storage is in Supabase-hosted infrastructure in AWS us-east-1. U.S. processing regions are selected where supported, and stricter residency commitments are governed by the applicable customer agreement.

COPPA:

• We do not create student accounts or knowingly collect Personal Information from children under thirteen.
• When an executed customer agreement authorizes student-related processing, Swiftscore may act as a school official or service provider under the education agency's direction. The applicable agreement and authorization record define the permitted purpose and processors.
• We do not sell, share for targeted advertising, or use student-related information to train public AI models.
• Upon contract execution, we provide a written COPPA compliance confirmation and incorporate these commitments into the DPA and required state addenda.

Deletion, access, and security:

• Verified deletion requests enter a tracked workflow and remain open until applicable records, processor copies, and backup windows are accounted for; confirmation is issued only after completion evidence is recorded.
• We maintain server-enforced tenant and resource authorization, encryption in transit and at rest, and immutable compliance records for governed student-related processing.

Point of contact:

matt@swiftscore.org

Last reviewed and updated: August 4, 2026