Built for schools
that take student data seriously.
Plain-language pledges, a published list of every sub-processor, and a Data Processing Agreement you can read before you contact us. No dark patterns, no “contact sales,” no fine print that says we own your students' photos.
We don't sell student data
Not to data brokers, not to advertisers, not to AI companies for training. Not for any reason.
We don't profile or target
No behavioral advertising, no “personalized” recommendations driven from student records, no tracking pixels in the app.
AI doesn't learn from your data
Background removal and face detection run in your browser. The one cloud AI feature, scan-a-card-to-template, sends the card photo to Anthropic only when an operator starts a scan. Anthropic doesn't train on API data, but its standard tier can keep inputs for up to 30 days for abuse review; we have no zero-retention contract. Your photos are not training data.
Compliance posture
We list what we're aligned with today, what's in progress, and what's out of scope. No hand-waving.
FERPA
When a school engages BadgeBadger, we act as a “school official” with a legitimate educational interest under 34 CFR §99.31(a)(1). Education records are used only for the contracted service: designing, capturing, printing, and managing student ID cards. We don't disclose them to anyone outside the sub-processors below.
COPPA
For students under 13, we rely on the FTC's school-authorization exception (FTC, July 2014 guidance). The school authorizes data collection on parents' behalf, strictly for the educational service. We collect only the minimum data needed to print the badge.
State student-privacy laws
California SOPIPA, New York Education Law §2-d, Illinois SOPPA, Connecticut PA 16-189, and 20+ similar state statutes. The pledges above (no sale, no targeting, no profiling) cover the substantive requirements; the DPA covers the contractual ones.
SOC 2 Type II
Not yet started. We'll begin Type II evidence collection (Vanta or Drata) concurrent with our first paid school-district contract. At our current scale, a $30k+/yr audit is hard to justify before there's revenue to fund it. Districts that need an interim attestation: ask, and we'll discuss what we can offer in the meantime (security questionnaire, code-access audit, deployment topology).
GDPR / UK GDPR
We're a US company and your data is stored in the US. Our DPA covers GDPR Article 28 and includes the EU Standard Contractual Clauses and the UK transfer addendum; email us to sign it. We don't offer hosting in the EU.
HIPAA
BadgeBadger isn't designed to store Protected Health Information (PHI). If your use case involves health records on the badge (allergy or medication information, for example), talk to us first so we can scope a Business Associate Agreement before you upload anything.
Sub-processors
The complete list of vendors we send your data to. We notify you 30 days before adding a new sub-processor; existing customers can object and terminate without penalty if a new vendor doesn't meet your bar.
| Sub-processor | Purpose | Hosting | Compliance |
|---|---|---|---|
| Supabase | Authentication, primary Postgres database, photo + asset storage. | United States (AWS us-east-2) | SOC 2 Type II, HIPAA-ready BAA available |
| Railway | Web app hosting: the Next.js server, API routes, and PDF rendering. | United States | SOC 2 Type II, SOC 3, GDPR DPA |
| Cloudflare | DNS, and forwarding the email you send to our help@ and hello@ addresses. | Global network | SOC 2 Type II, ISO 27001, GDPR DPA |
| Resend | Email: invitations, password resets, sign-in links, account alerts, and messages sent through our contact form. | United States | SOC 2 Type II, GDPR DPA |
| Polar | Subscription billing and payment processing. | United States (Stripe-backed) | PCI-DSS compliant via Stripe |
| Anthropic (AI features) | Vision-LLM calls for scan-a-card-to-template. Only invoked when an operator explicitly clicks an AI feature; never on every photo upload. | United States | SOC 2 Type II. Anthropic does not use API traffic to train models. Default API tier retains inputs for up to 30 days for trust-and-safety review; we don’t have a Zero Data Retention agreement (it’s an Enterprise contract). Districts that require ZDR before adoption: ask, and we’ll either disable the AI features for your tenant or scope an Anthropic ZDR agreement into the contract. |
| Amazon Web Services (S3) | Roster sync only. Holds the roster files your student information or HR system uploads until BadgeBadger applies them. Files are deleted once processed, and after 14 days at the latest. | United States (us-east-2) | SOC 2 Type II, ISO 27001, GDPR DPA |
| GitHub | Hosts the Print Agent installers and update files. Public release files only; no customer data is sent. | United States | SOC 2 Type II, ISO 27001 |
Your browser also downloads fonts and open-source tools directly from Google Fonts, jsDelivr, Google Cloud Storage and IMG.LY when you use the template editor and the photo tools. Those requests carry your IP address, like any web request, but no badge data or photos.
Operational guarantees
The boring-but-important stuff that protects you when things go sideways.
Encryption everywhere
TLS 1.2+ in transit, AES-256 at rest. Photos and PDFs stored in Supabase Storage with bucket-level RLS scoped to your organization.
Stored in the US
The database and files live in AWS us-east-2 (Supabase), roster files waiting to sync sit in Amazon S3 in us-east-2, and the app runs on Railway in the United States. We don't offer hosting in the EU.
Deletion on request
Email help@badgebadger.app to request an export or deletion. Deleting a person in the app removes their record and photos right away. When the service ends, our DPA commits us to deleting all personal data within 30 days. Automated retention windows are on the roadmap; for now, deletion is done by your admins or on request.
72-hour breach notification
If we detect a security incident affecting your data, we notify you within 72 hours of confirming the impact. The detection and escalation procedure is documented in our internal incident-response runbook; a copy is available under NDA.
Support access
Only BadgeBadger's founder has access to production systems. To fix a problem or answer a support request, we can sign in to your organization; anything changed that way is labeled BadgeBadger support in your audit log, and we keep our own log of every support session. We look at your data only to support you, to keep the service running, or when the law requires it.
Audit log
Your team's sign-ins, template changes, changes to people, and every print land in your organization's audit log, which admins can filter by action, record type, and date at Settings → Audit log. There's no CSV export yet. Photo-read auditing is on the roadmap: today we audit writes, not signed-URL reads on every photo view.
Honest about where we are.
We're a small team building toward the K-12 segment. The pledges and operational guarantees on this page are the ones we keep today. The big-ticket vendor checklist items (a SOC 2 audit, a $2M+ cyber policy, a third-party pen test) haven't started yet. We plan to scope them with our first paying district. Below is what we can offer in a contract conversation today.
- Draft DPA covering FERPA + COPPA + state law (counsel-reviewed before first signature)
- SDPC NDPA v2 accepted as a starting point; redlines reviewed within 5 business days
- Documented incident-response & deletion runbooks (available under NDA)
- SOC 2 Type II audit (not started) and cyber liability insurance (not in place yet), both scoped with you
What we can send today
DPA draft
FERPA + COPPA + state-law aligned. We'll counsel-review and counter-sign once a real contract is in motion.
Security questionnaire
CAIQ Lite + a written narrative of our controls.
Sub-processor list
Same one above, formatted as a CSV, with 30 days' notice before any change.
Runbook summaries
Incident response, data deletion and access review, under NDA on request.
Data Processing Agreement
We have a draft DPA aligned with FERPA, COPPA, and the substantive provisions of US state student-privacy laws. It's not a finalized template yet: counsel review is scoped to land before our first signed school contract. We accept the SDPC's National Data Privacy Agreement (v2) as a starting point and will turn around redlines within five business days. Email help@badgebadger.app to start the conversation.
Common questions
Do you sell or share student data with anyone?
No. We don't sell student data, ever. We share data only with the sub-processors listed above, only for the specific purpose listed (hosting, billing, email delivery, AI features that you explicitly invoke), and only the minimum needed for that purpose. We have no advertising business, no data-broker relationships, and no plans to add either.
Where is student data stored?
In the United States. Supabase stores the database and files in AWS us-east-2, roster files waiting to sync sit in Amazon S3 in us-east-2, and the app itself runs on Railway in the US. We don't offer hosting outside the US.
What happens to a student's data when they leave the school?
Today: an admin can delete the student record from the employee detail page or via bulk action; the photo + cropped/thumbnail variants are removed at the same time. Automatic retention-window purges (30 / 60 / 90 days) are on the roadmap. Until they ship, deletion is done by your admins or on request. When the service ends, the DPA commits us to deleting all personal data within 30 days.
Do AI features train on our students' photos?
No. Anthropic does not use API traffic to train models; that's a contractual commitment under their API terms. Scan card, the only AI feature that sends anything to a third party, runs only when an operator starts a scan; background removal and face detection run in the browser. Important caveat about retention: Anthropic's default API tier retains inputs for up to 30 days for trust-and-safety review (abuse detection). We don't ship to the Zero Data Retention tier yet because it's an Enterprise contract that's not feasible at our current scale. Districts that require ZDR before adoption: ask, and we'll either disable AI features for your tenant or scope an Anthropic ZDR agreement into the contract.
Are you GDPR-compliant?
We're a US company and we store data in the US. For European customers, our DPA covers GDPR Article 28 and includes the EU Standard Contractual Clauses and the UK addendum. We don't offer hosting in the EU.
What's your incident-response playbook?
If we confirm an incident that affects your data, we notify you within 72 hours, send a written post-incident report within 30 days, and keep you updated on the fixes until they're done. The DPA documents our exact obligations, and the full runbook is available under NDA.
Talk to a real person
Privacy questions, DPA redlines, security questionnaires, breach drills and audit requests all go to one inbox, and a person reads every message.