Protecting Student Privacy
SkillTrek is designed from the ground up to comply with the Family Educational Rights and Privacy Act. Here is how we protect student education records.
Last updated: March 2026
Our Commitment to FERPA Compliance
SkillTrek is committed to protecting the privacy of student education records in full compliance with the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. We recognize that student data entrusted to our platform constitutes education records, and we treat that responsibility with the highest standard of care.
We operate under the school official exception (34 CFR § 99.31(a)(1)), meaning institutions may share education records with SkillTrek without prior parental consent when the institution has determined that SkillTrek has a legitimate educational interest and is under the direct control of the institution with respect to use and maintenance of records.
How We Handle Student Data
School Official Exception: SkillTrek functions as a school official with legitimate educational interest under FERPA. We only access and process student data for the educational purposes specified in our Data Processing Agreement (DPA) with each institution.
Data Processing Agreements: Every institution using SkillTrek signs a DPA that specifies the types of data processed, the purposes of processing, data retention periods, and breach notification obligations.
Data Minimization: We collect only the minimum data necessary to provide our educational services. Student records include: display names, email addresses, assignment submissions, performance scores, and AI interaction logs. We do not collect Social Security numbers, financial information, or health records.
Encryption at Rest: All student data stored in our databases is encrypted using AES-256 encryption. Database backups are similarly encrypted before being stored.
Encryption in Transit: All data transmitted between users and our servers is protected by TLS 1.3 encryption. API communications between internal services also use encrypted channels.
Role-Based Access Control (RBAC): Access to student data is strictly limited based on user roles. Teachers can only view data for students enrolled in their classrooms. Students can only view their own records. Administrators have scoped access based on institutional agreements.
Audit Logging: All access to student education records is logged with timestamps, user identifiers, and the nature of the access. These logs are retained for compliance review and are available to institutional administrators upon request.
Data Isolation: Each institution's data is logically isolated. Cross-institutional data access is not possible through normal application flows.
No Training on Student Data: AI models used by SkillTrek do not retain, store, or train on student submissions, conversations, or performance data. Student interactions with AI are processed in real-time and are not used to improve or fine-tune any machine learning models.
Subprocessor Disclosure: SkillTrek uses third-party AI providers (currently Anthropic and OpenAI) to power assessment and feedback features. These providers process student data only for the purpose of generating immediate responses and do not retain data beyond the API call duration, in compliance with their respective data processing terms.
Human Review: Institutional administrators and teachers may review AI-generated assessments. When requested, SkillTrek provides the ability for human override of AI-generated grades and feedback.
Right to Inspect: Students (or parents/guardians for students under 18) have the right to inspect and review their education records maintained by SkillTrek. Requests can be made through the student's institution or directly to SkillTrek.
Right to Request Amendment: If a student or parent/guardian believes education records are inaccurate or misleading, they may request an amendment. SkillTrek will process amendment requests in coordination with the student's institution within 45 days.
Right to Request Deletion: Students and parents/guardians may request the deletion of their records. Upon verification through the institution, SkillTrek will permanently delete the student's data within 30 days, subject to any legal retention requirements.
Data Retention & Deletion
Configurable Retention: Data retention periods are configurable per institution through the DPA. Default retention is for the duration of the institutional contract plus 90 days for transition.
Deletion on Contract Termination: Upon termination of service with an institution, all student education records associated with that institution are permanently deleted within 60 days. Institutions may request an export of their data before termination.
Audit Trail Retention: Audit logs documenting access to education records are retained for a minimum of 3 years after the relevant data is deleted, as required for compliance verification.
SkillTrek commits to notifying affected institutions within 72 hours of discovering any security breach that may have resulted in unauthorized access to student education records.
Our breach notification will include: the nature and scope of the breach, the types of data affected, the steps taken to contain and remediate the breach, and recommended actions for the institution.
We maintain a formal incident response plan that is tested annually and updated as necessary.
For questions about our FERPA compliance practices, to submit a data access or deletion request, or to report a privacy concern, please contact our Privacy Team:
Email: privacy@skilltrek.ai
We respond to all privacy-related inquiries within 5 business days.
This page describes SkillTrek's FERPA compliance practices. For institution-specific terms, please refer to your Data Processing Agreement.