Privacy Policy - Pink Cow

Introduction

Pink Cow ("we," "our," or "us") is committed to protecting the privacy of students, teachers, parents, and school administrators who use our special education management platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

FERPA Compliance

Pink Cow complies with the Family Educational Rights and Privacy Act (FERPA), which protects the privacy of student education records. We are committed to:

Acting as a "school official" under FERPA when handling education records
Using student data solely for providing our educational services
Implementing strict access controls and audit trails
Never selling or marketing student data
Allowing schools to maintain full control over their data
Providing data export capabilities for compliance

Information We Collect

Teacher and Staff Information

Name and email address
School affiliation and role
Account credentials (encrypted)
Usage data and preferences

Student Information

Name and grade level
IEP goals and objectives (as entered by teachers)
Progress monitoring data
Observational notes and assessments

Technical Information

IP addresses and device information
Browser type and version
Time zone and location (general)
Usage patterns and feature interactions

How We Use Information

We use collected information strictly for educational purposes:

Providing special education management tools
Tracking student progress on IEP goals
Generating reports for teachers and administrators
Facilitating communication between team members
Improving our platform's functionality
Ensuring platform security and preventing abuse
Complying with legal obligations

Data Security

We implement industry-standard security measures to protect your data:

TLS 1.3 encryption for all data in transit
AES-256 encryption for data at rest
Regular security audits and penetration testing
Role-based access controls (RBAC)
Automated backup and disaster recovery
Employee background checks and training
Incident response procedures

Data Sharing and Disclosure

We do not sell, rent, or trade personal information. We may share data only:

With your explicit consent
To comply with legal obligations or court orders
To protect our rights, privacy, safety, or property
With the service providers listed below, who are contractually bound to process it only on our documented instructions, and are prohibited from selling it, sharing it, or combining it with data from other sources
In connection with a merger or acquisition (with notice to users)

Service Providers

We use the companies below to operate Pink Cow. Not all of them handle student education records — the table says which do. All process data in the United States. For a plain-language walkthrough written for parents and districts, see How student information is handled.

Provider	What it does for us	Student records?
Supabase	Stores the database and handles sign-in	Yes
Vercel	Runs and serves the Pink Cow application	Yes, in transit
Anthropic	Optional AI reading of pasted IEP goal text. Student and guardian names and student IDs are removed before sending and restored afterwards. Not used to train their models.	Goal text only, names removed
Postmark	Sends email, including parental consent requests, which contain the student's first name	First name only
Stripe	Processes subscription payments from teachers	No
Twilio	Sends text messages to teachers who opt in	No
Sentry	Reports application errors so we can fix them. We attach only a teacher's account ID — never a name, email, school, or district.	Not intentionally
PostHog	Measures which features teachers use	No
Better Stack	Checks whether the site is online	No

“Not intentionally” means we do not send student information to that provider on purpose, but an error report can occasionally include whatever data was being handled when the error happened. We would rather say this plainly than claim a guarantee we cannot make.

We do not sell student information, use it for advertising, or build profiles for any purpose other than providing Pink Cow. If we add or change a provider that handles student records, we will update this page and give notice as described under “Changes to This Policy.”

About our AI provider

Prompts and outputs sent to Anthropic are never used to train their models. This is a binding commitment in their commercial terms, not a configurable setting.
A Data Processing Agreement is in force, establishing Pink Cow as controller and Anthropic as processor. It requires breach notification within 48 hours and return or deletion of data within 30 days of termination.
Inputs and outputs are deleted within 30 days. One exception: content flagged by Anthropic's automated trust and safety systems may be retained for up to two years. This applies to all of their customers and cannot be contracted away, so we state it rather than omit it.
Anthropic gives advance notice before a new subprocessor gains access to personal data, and we have 15 days to object in writing on data privacy or security grounds. Their current subprocessor list and security documentation are published at anthropic.com/subprocessors and trust.anthropic.com.

Your Rights and Choices

You have the right to:

Access and review your personal information
Correct inaccurate or incomplete data
Request deletion of your data (subject to legal requirements)
Export your data in a portable format
Opt-out of non-essential communications
Revoke consent for data processing

Data Retention

We retain personal information for as long as necessary to provide our services and comply with legal obligations. Student records are retained according to state and federal requirements. When data is no longer needed, it is securely deleted or anonymized.

International Data Transfers

Pink Cow operates in the United States and processes data in accordance with U.S. law. If you access our service from outside the U.S., please be aware that your data may be transferred to and processed in the United States.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. For significant changes affecting student data, we will provide additional notice to schools and parents as required by law.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Pink Cow LLC

Privacy Officer

Email: privacy@pinkcow.app

Support: support@pinkcow.app

Phone: 1-800-PINK-COW