Privacy Policy

Effective October 1, 2026. Last updated September 28, 2026.

1. Who We Are

SchoolLife ("SchoolLife," "we," "us" or "our") is a K-12 district operations platform operated by Pinnacle Solutions Group LLC, doing business as SchoolLife, a New Jersey limited liability company located at 2600 Tilton Road #1020, Egg Harbor Township, New Jersey 08234. This Privacy Policy explains how we handle personal information in connection with our platform and websites (the "Service").

When a school or district uses SchoolLife, the school or district controls student and staff education records. SchoolLife acts as the school's service provider and "school official" under FERPA, processing that data only on the school's behalf and under its direction, as set out in our Data Privacy Agreement with that district.

2. Scope

This Privacy Policy covers (a) staff and administrator users of the Service; (b) students and parents or guardians who use the Service where their school or district has enabled that access; (c) student data we process on behalf of a school; and (d) visitors to our public website. It does not change the terms of any signed Data Privacy Agreement ("DPA") with a school or district. Where a DPA and this Privacy Policy differ, the DPA governs that district's data.

3. Information We Collect

From staff and administrator users

Account and identity data provided by the district or its identity provider, such as name, work email, role, school and employee identifier.
Authentication data through single sign-on, such as Google or Microsoft. We receive a verified identity token, not your password.
Usage, device and log data needed to operate and secure the Service, such as actions taken, timestamps, IP address and browser type.

From students, only where the school or district enables student access

Student access is optional. It is turned on only by the school or district, and students see only the information the district makes available to them.
Students sign in through the district's single sign-on, such as Google or Microsoft. We receive a verified identity token and the account details the district provides, such as name, school, grade and student identifier.
Usage and log data needed to operate and secure the Service, such as pages viewed, actions taken and timestamps.

From parents and guardians, only where the school or district enables parent access

Name, email address and relationship to the student, provided by or verified through the district.
Parents and guardians see information only about their own child, as the district configures.

Student data processed on a school's behalf

Only the student data a school directs us to process for the contracted educational purpose. This may include roster and enrollment data, attendance, and program or compliance information reflected from the district's systems of record.
Where student access is not enabled, we do not collect data directly from students. Records remain authoritative in the district's own systems, such as its student information system. SchoolLife reflects and organizes them.
In operational and analytical views, student personal information is de-identified wherever feasible.

4. How We Use Information

We use information only to provide, maintain, secure, support and improve the Service for the contracted educational purpose. This includes authenticating users, routing work and notifications to the appropriate role, displaying compliance deadlines and operational information, providing support, and meeting legal and security obligations. We keep an audit log of access to records, which supports the district's FERPA record of disclosures.

5. What We Never Do

We do not, and our contracts prohibit us from:

selling student data;
using student data for targeted advertising, or building advertising or non-educational profiles of students;
using student data for any purpose other than the educational purpose authorized by the school; or
keeping student data longer than needed to provide the Service or than the school directs.

6. FERPA, COPPA and State Student Privacy Laws

FERPA. We handle student education records as a "school official" with a legitimate educational interest under 34 C.F.R. § 99.31(a)(1). The district retains direct control over the use and maintenance of those records, and we use them only for the service described in our agreement.

COPPA. Where the Service is used with students under 13, including through student accounts the school enables, the school provides consent on behalf of parents for the collection of student personal information for the school-authorized educational purpose only, consistent with the Children's Online Privacy Protection Rule and FTC guidance. We maintain a written data retention policy and a written information security program, and we obtain separate authorization before any third-party disclosure not covered by the DPA.

State law. We comply with the student data privacy laws of the states in which our district customers operate, including New Jersey's pupil records requirements and Delaware's Student Data Privacy Protection Act, 14 Del. C. Ch. 81A. We sign the Student Data Privacy Consortium's National Data Privacy Agreement ("NDPA") and each state's exhibit as required.

7. Sharing and Sub-processors

We do not share personal information except (a) with sub-processors that help us operate the Service under contractual privacy and security obligations at least as protective as ours; (b) as directed by the school; or (c) as required by law. Our current list of sub-processors is available on request at privacy@myschoollife.org. We require every sub-processor to meet our privacy commitments.

8. Data Retention and Deletion

We keep student data only as long as needed to provide the Service or as the school directs. At the school's request, or when the agreement ends, we will return and/or securely delete the district's student data within the time required by the applicable DPA and state law (within sixty (60) days under the NDPA), except where the law requires us to retain it.

9. How We Protect Information

Encryption in transit (TLS) and at rest.
Role-based access controls. Every record view is limited to the user's role and recorded in an audit log.
Single sign-on with verified identity. Access decisions are enforced on our servers against a verified token.
A documented incident response process with defined breach notification timelines for affected districts.

10. Your Rights and Choices

Parents and eligible students exercise rights of access, correction and deletion of education records through their school or district, which controls those records. We assist the district in fulfilling those requests. Staff users may contact us or their administrator regarding their account information. We honor rights under state consumer privacy laws to the extent they apply to data that is not exempt as education records.

11. Breach Notification

If we become aware of a security incident affecting personal information we process for a school, we will notify the affected district without undue delay and within the time required by the applicable agreement and law (within seventy-two (72) hours of confirming a data breach under the NDPA), and we will cooperate in the district's response.

12. Changes to This Policy

We may update this Privacy Policy. We will post the new effective date and, for material changes affecting student data, notify affected districts as our agreements require.

13. Contact Us

Questions about this Privacy Policy or our data practices may be directed to privacy@myschoollife.org or to Pinnacle Solutions Group LLC, d/b/a SchoolLife, 2600 Tilton Road #1020, Egg Harbor Township, New Jersey 08234.