This Privacy Policy explains how House of Dreams LLC ("we") collects, uses, and protects information in HallGuard Pro (the "Service"). The Service is provided to schools and districts ("Schools"); it is not marketed directly to students or parents. Student information is processed on behalf of the School under our Student Data Privacy Agreement, which controls if it conflicts with this Policy.
| Category | Examples | Source |
|---|---|---|
| Student Data | Student name, school ID, grade, homeroom; pass times, destinations, durations; nurse-visit timestamps; handoff status; restricted-pairing flags; 504/IEP pass-bypass flag (no diagnosis details); staff notes on passes | School rosters and staff entries |
| Staff account data | Name, school email, role, hashed password/PIN, sign-in logs | School and staff |
| Billing data | Billing contact, PO numbers, invoices (card data handled by our payment processor; we do not store full card numbers) | School |
| Technical data | IP address, browser type, device, error logs | Automatically |
Students do not create accounts or log in. We do not collect student precise geolocation, biometrics, photos, or health diagnoses. Staff should not enter sensitive medical details in notes.
Only to provide, secure, support, and improve the Service for the School; to bill; and to comply with law. We do not sell personal information, use Student Data for targeted advertising, build student profiles for non-educational purposes, or use identifiable Student Data to train AI models for other customers.
We share information only with (a) authorized users at the same School according to their role, (b) subprocessors bound by written confidentiality and security terms (see DPA Exhibit A), (c) as required by law or valid legal process, with notice to the School where permitted, and (d) a successor in a merger or acquisition that agrees to be bound by our commitments, with notice to Schools.
Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent), role-based access, per-school data isolation, least-privilege staff access, logging, and backups. See DPA Article V.
Pass and report data are kept for the subscription term or a shorter period the School sets (default: [current school year plus one prior year]). On termination, Student Data is returned and/or deleted within 60 days per the DPA. Backups age out within [35] days.
Parents and eligible students may review, correct, or request deletion of student records by contacting their School, which controls the data. We help the School respond. If we receive a request directly, we refer it to the School.
Where students are under 13, the School provides consent on behalf of parents for use solely for the school's educational purposes, as permitted by the FTC COPPA Rule. Parents can ask the School to review or delete their child's data.
We use only essential cookies for sign-in and security; no advertising or cross-site tracking cookies.
Residents of certain states may have additional rights; see DPA Exhibit G. California: we comply with SOPIPA (Bus. & Prof. Code §22584) and Ed. Code §49073.1.
We will post changes with a new effective date and notify Schools at least [30] days before material changes; we will not make material changes to how Student Data is used without School consent.
Privacy questions: [Privacy contact email], House of Dreams LLC, [House of Dreams LLC address].