Privacy Notice
Draft. This text is being reviewed by an attorney and may change before SunriseHours launches. Questions: robert@sunrisehours.com.
Effective date: [date] · Last updated: [date]
1. Who we are and our role
[SunriseHours LLC] ("we", "us") provides SunriseHours to high-school work-based learning programs. Students use it to log hours at their internships, supervisors verify those hours, and school staff keep track of progress.
Schools hire us. The school owns the data. By "school" we mean the school district or career center that runs the program. We act for the school as its service provider and as a "school official" under the Family Educational Rights and Privacy Act (FERPA). We use information only as the school's contract allows. Under Ohio law, education records we hold for a school are solely the school's property (ORC 3319.326(A)).
This policy covers the SunriseHours app and our public website. If your school's student data privacy agreement with us says something different from this policy, that agreement controls.
2. Our main promises
- We never sell student information, or anyone's information.
- We never use it for advertising, and we never market to students or parents.
- We never build profiles of students, except what the service needs to work, such as hours totals.
- We keep all data in the United States.
- We delete data when the school asks, and within 90 days after the school's contract ends.
- We tell the school fast if something goes wrong.
- We do not track location, and never use your camera, microphone or keystrokes.
3. What we collect, by role
"Required" means the service needs it. "Optional" means the school or the user decides whether to add it.
Students
| Information | Required or optional | Why |
|---|---|---|
| First and last name; school email address | Required | Your account, sign-in, and messages from your school |
| Phone number | Optional | Only if the school or you add it. Shown to supervisors only if the school allows it |
| Profile photo | Optional | So staff and supervisors recognize you. We remove hidden location data when it is uploaded |
| School or building, work-based learning program | Required | Puts you in the right program and school |
| Grade and graduation year | Optional | Grouping and reports. We use graduation year instead of date of birth |
| Local student ID and Ohio state student ID (SSID) | Optional | Matching your school's roster, and the school's state reporting |
| Placement details: employer, supervisor, job title, start and end dates, expected work days, hours goal, Ohio work-based learning type, paid or unpaid, career field, date the training agreement was signed | Required (some items optional) | The core of the program record |
| Hours: date, minutes worked, start and end times (if the program uses them), an optional note, and every version of any correction | Required | Logging and checking hours |
| Verification: whether a supervisor verified the hours or marked them incorrect, who did it, when, and why | Required when the program uses verification | Checking hours |
| Daily notes, reflections and staff comments on them, requests to excuse a day and their reasons, messages | Optional (the school decides which features are on) | The program's work and communication |
| Employer evaluations about you | Optional (school setting) | The supervisor's view of your work |
| Account and security information: password (stored only as a scrambled hash, or none if you sign in only with your school account), sign-in times, two-step codes, session records with IP address and browser or device type, trusted-device records, display settings, email choices | Required | Keeping your account safe and working |
| Audit records: who changed what, and when | Required | A trustworthy record, and security |
School staff (administrators)
| Information | Required or optional | Why |
|---|---|---|
| Name, work email, role, school | Required | Account and permissions |
| Phone, photo, a short "what I do" description | Optional | So students and colleagues know who to contact |
| Messages, comments, decisions and changes they make | As used | Running the program; the audit record |
| Account and security information (as for students) | Required | Account safety |
Employer supervisors
| Information | Required or optional | Why |
|---|---|---|
| Name, title, work email | Required for an account | Account and contact |
| Phone | Optional | Contact |
| Employer name, address, industry | Required (address and industry optional) | Placement records |
| Which placements they supervise; verifications, "incorrect" marks and reasons; evaluations they write; messages | As used | Verifying and evaluating the student's work |
| Account and security information | Required | Account safety |
Parents and guardians (only if the school turns parent accounts on)
| Information | Required or optional | Why |
|---|---|---|
| Name, email, which student or students they are linked to | Required | Read-only access to their own student |
| An ID from the school's roster | Optional (only if the school imports guardians from its student information system) | Matching the roster |
| Account and security information | Required | Account safety |
Parents and guardians see but do not add student content.
Website visitors
Our public website has no student information. See Section 19.
4. What we do not collect
We do not collect:
- Social Security numbers;
- dates of birth;
- driver's license or state ID numbers;
- bank, credit card or other financial account numbers;
- demographics such as gender, race, ethnicity or home language;
- disability, IEP, 504, medical or health information;
- location.
Please do not type health or medical details into notes, messages or reasons for missed days. SunriseHours reminds users of this.
5. Where information comes from
- The school. Staff enter it, or upload it.
- The school's student information system, if the school connects it. This uses OneRoster files or OneRoster REST, which covers ClassLink Roster Server.
- Your school sign-in, if you use "Sign in with Google, Microsoft or ClassLink". We receive an account identifier, your name and your verified email address, only to confirm who is signing in.
- You. For example the hours, notes, reflections and messages you enter.
- Automatically, when you use SunriseHours: sign-in times, IP addresses, and the type of browser or device.
6. How we use information
We use information only to provide SunriseHours to the school:
- to create accounts and let people sign in;
- to log, verify and report hours, and show progress;
- to deliver messages, announcements and notifications;
- to create the reports and exports the school asks for;
- to give support. We see student records only under a support-access grant the school approves (Section 9);
- to keep the service secure: preventing misuse, limiting sign-in attempts, and investigating problems;
- to improve the service, using only de-identified, combined data (Section 7); and
- to meet legal duties.
Emails we send. We send invites, sign-in codes, password resets and notifications. If the program turns it on, we also email copies of messages. Those emails include the message text.
No tracking tools. SunriseHours has no analytics, advertising, tracking pixels or error-monitoring services.
7. What we never do
- We never sell, rent or trade information.
- We never show advertising, targeted or otherwise.
- We never market to students or parents, and we do not use information in SunriseHours to market to anyone.
- We never build profiles of students except what the service needs to work.
- We never use student information for any purpose other than providing SunriseHours to the school. For example, we do not use it to train artificial intelligence models.
- De-identified data. We may combine data so that no person or school can be identified. We use that only to maintain, support and improve SunriseHours. We never share it with anyone, and never try to re-identify anyone (ORC 3319.326(E)).
8. The laws we follow
- FERPA (20 U.S.C. 1232g; 34 CFR Part 99). We are a "school official" under the school's direct control (34 CFR 99.31(a)(1)(i)(B)). We do not pass student records to anyone else except as the school's agreement allows (34 CFR 99.33(a)).
- Ohio's student-data law, SB 29 (ORC 3319.325 to 3319.327). The school owns the records. We may not sell them or use them commercially. Our staff may access them only as their duties require. We give the school breach information, destroy or return records within 90 days after the contract ends, and do not monitor devices.
- Ohio student-records confidentiality (ORC 3319.321). This includes its rules on consent and on not passing records along.
- Ohio's personal information systems law (ORC Chapter 1347). We follow it as if we were a school district, as ORC 3319.326 requires.
- The Protection of Pupil Rights Amendment (PPRA). Schools write their own reflection and evaluation questions, and get parental consent where PPRA requires it. SunriseHours warns the writer when a question seems to touch a protected topic.
- The Children's Online Privacy Protection Act (COPPA) does not apply, because SunriseHours is not for children under 13 (Section 15).
- The school's student data privacy agreement (the Ohio version of the National Data Privacy Agreement, OH-NDPA).
9. Who can see what
- School administrators. Program administrators see the whole program. School administrators see only their own school.
- Students see their own records and the conversations they are part of.
- Employer supervisors see only students placed at their workplace, and only after the school records that placement's training agreement. (This is on by default for new programs.) They see the information the school allows for that placement, such as the student's name, the hours logged there and their status. Phone, email and photo are shown only if the school allows them.
- Parents and guardians, if the school turns this on, are read-only and see only their linked student. They see the hours calendar, totals and pace; placements and the supervisor's name; whether reflections and evaluations are done (not their contents); and announcements. They never see messages, notes or other students.
- Us.
- Our support account can see a program's settings, but not its student records.
- We see student records only through a support-access grant that one of the school's super-administrators approves. A grant lasts 7 days by default and never more than 90 days. It is never wider than we asked for. The school can end it at any time, and it ends by itself. Every student profile we open under a grant is logged for the school to see.
- Our owner, who runs the systems, may also reach data when that is needed to keep SunriseHours running and secure, for example to fix a database problem or investigate a security incident. This happens only as those duties require (ORC 3319.326(F)).
- Our service providers (Section 10), only to do their job for us.
- No one else, unless the school directs it, a parent or eligible student consents, or the law requires it (Section 18).
10. Service providers (subprocessors)
We use a small number of companies to run SunriseHours. Each one handles data only to provide its service to us. The current list is:
- Vercel Inc. — application hosting and compute — US (iad1, Washington, D.C.).
- [Neon, Inc. / Supabase, Inc.] — managed PostgreSQL database and backups — US East.
- [Postmark (ActiveCampaign, LLC) / Resend, Inc.] — transactional email (invites, sign-in codes, notifications) — US.
- Google LLC (Google Workspace) — the company's own business email, which may hold support correspondence — US.
- Identity providers chosen by the district — Google, Microsoft, ClassLink — used only when a district turns them on, only to confirm who is signing in; the district already has its own agreement with them. Not processors of our data store.
- Have I Been Pwned (Pwned Passwords range API) — receives only a 5-character hash prefix; no personal data. Listed for transparency.
We give schools 30 days' notice before adding a new service provider.
11. Where data is stored
All data is stored and processed in the United States. This includes the database, backups, the application and email.
12. How we protect information
Our security overview is at compliance/security-overview.md. In short:
- Two-step sign-in. An emailed code is required for school super-administrators and our support accounts. Schools can require it for others.
- School sign-in. Users can sign in with Google, Microsoft or ClassLink school accounts.
- Strong passwords. Passwords are at least 12 characters and stored only as scrambled hashes (argon2id). We refuse common passwords and passwords found in data leaks. To check for leaks, we send only the first 5 characters of a scrambled code (a SHA-1 hash) of a new password to the Have I Been Pwned service. Neither the password nor any account information leaves our servers.
- Encryption. Data is encrypted in transit (TLS) and encrypted at rest by our hosting and database providers.
- Limited access. Every request for data is limited to the user's program, school and placements.
- An audit log records changes and our support views. It is append-only: entries cannot be changed or deleted.
- Backups. Point-in-time backups let us recover from mistakes.
- A security review. In October 2026, three independent reviews of the code were completed. Every High and Medium finding was fixed except one deployment step that is done at production setup.
13. How long we keep information, and deletion
We keep information only as long as the school needs it for its program, or as the law requires. We do not keep it forever.
While the school uses SunriseHours. Records stay as the school's record. The school can export everything at any time, as a ZIP file of spreadsheets (CSV) plus a record PDF for each student. In everyday use, records are not erased. Corrections are kept as history, so the record stays trustworthy.
Archived students. When a student leaves the program, the school archives them. The school decides when archived records are deleted, under its own records schedule (ORC 149.41). If it never decides, they are deleted when the contract ends.
Deleting on the school's request. We delete specific information within 60 days of the school's written request.
When the contract ends.
- The program stays available read-only for [60] days so the school can export its data.
- All data is destroyed within 90 days of the contract ending (ORC 3319.326(C)), including backup copies.
- Exceptions: the school confirms in writing that renewal is reasonably expected, or the school asks for earlier deletion.
Backups. Backup copies age out within 30 days after data is deleted.
Proof. After deletion, we send the school a certificate of disposition that says what was deleted and when.
Legal hold. If the law requires us to keep something (for example, because of a court order), we pause deletion of that information only, only as long as required, and tell the school unless the law forbids it.
| Information | Why we keep it | How long |
|---|---|---|
| Student records (hours, placements, notes, reflections, evaluations, excused days, messages) | The school's work-based learning record | Until the school deletes them, or destroyed within 90 days after the contract ends |
| Audit log | Proof of who changed what; security | As long as the records it describes; destroyed with the program |
| Account details | Signing in | While the account is needed; destroyed with the program |
| Two-step sign-in codes | Confirming it is you | Expire after 10 minutes |
| Sign-in sessions | Keeping you signed in | Students up to 60 days of inactivity; supervisors up to 30 days of inactivity; administrators 12 hours at most (2 hours idle); our support accounts 1 hour. Ended at sign-out or password reset |
| Trusted-device records | Skipping the code on your own device | 30 days |
| Password reset links | Resetting a password | Valid 30 minutes |
| Invitations | Joining a program | Valid 7 days |
| Backups | Recovering from mistakes or outages | 30 days at most |
| Delivery records at our email provider | Delivering email | The shortest period the provider allows |
| Support emails in our business mailbox | Answering questions | Deleted when no longer needed for the matter |
14. Your rights, through your school
Under FERPA, parents, and students who are 18 or older, have the right to:
- see the student's education records;
- ask for a correction of a record they believe is wrong; and
- decide whether most records are shared with others, with some exceptions in the law.
These rights move from the parent to the student when the student turns 18. Ohio law also lets parents inspect the school's contract with us (ORC 3319.326(G)).
How to ask. Contact your school. The school decides on the request, usually within 45 days as FERPA requires. We help the school within 30 days of its request, for example by preparing a complete record. If you contact us directly, we will refer you to your school, because the school controls the records.
Corrections. If the school agrees a record is wrong, it is corrected in SunriseHours. The old version is kept and marked, so there is a clear history.
Complaints. You can complain to the U.S. Department of Education's Student Privacy Policy Office if you believe your FERPA rights were not respected.
15. Children
SunriseHours is for high-school students, usually 14 to 18 years old. It is not directed to children under 13, and schools agree not to enroll anyone under 13. COPPA does not apply unless a program enrolls someone under 13. If we learn that a child under 13 has an account, we tell the school so it can close the account.
16. No location tracking or device monitoring
SunriseHours does not use GPS or location tracking. It does not turn on your camera or microphone, and it does not record keystrokes or web browsing (ORC 3319.327). When you upload a photo, we remove any location data hidden in it.
17. If there is a security problem
If we confirm a breach of student information:
- we notify the school, with a goal of within 24 hours of confirming it and no later than 72 hours after confirming it;
- we give the school what it needs to notify families and to meet Ohio law (ORC 1347.12 and 3319.326(B));
- we update the school at least every 72 hours; and
- we send a written report within 30 days.
The school tells families. Our plan is in compliance/incident-response-plan.md.
18. Law-enforcement and other legal requests
If a government agency or anyone else demands student information:
- we require valid legal process, such as a subpoena, court order or warrant;
- we tell the school before we respond, unless the law forbids it; and
- we share only what the legal process requires.
19. Website visitors
Our public website (sunrisehours.com) has no student information.
- Cookies and scripts. The website sets no cookies and runs no analytics, advertising or other third-party scripts. Its fonts are served from our own site.
- Server logs. Our hosting provider may record IP addresses and pages visited, for security, and keeps them only for a short time.
- If you contact us by email, we use your name, email address and message only to reply. We do not add you to a mailing list unless you ask.
The SunriseHours app uses four essential cookies:
- one keeps you signed in;
- one lasts 10 minutes while you sign in;
- one lasts 10 minutes while you sign in with your school's Google, Microsoft or ClassLink account; and
- one remembers a trusted device for 30 days, if you choose that.
20. Changes to this policy
We will post any change with a new date. For important changes, we tell schools at least 30 days ahead. We will never weaken the protection for information already collected unless the school agrees.
21. Contact us
- Privacy questions: privacy@sunrisehours.com
- Security problems: security@sunrisehours.com
- General help: support@sunrisehours.com
- Phone: [business phone]
- Mail: [SunriseHours LLC], Attn: Privacy, [business mailing address]
For requests about your records, please start with your school.