FERPA Statement

Last updated: June 7, 2026

Our role under FERPA

The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. When a school or district uses IEP Co-Pilot, we operate as a "school official" with a "legitimate educational interest" under 34 CFR § 99.31(a)(1), performing a service the school would otherwise perform itself.

Direct control

The school or district remains the data controller. We:

• Use education records only to provide the service.
• Do not redisclose education records except as the school directs or as law requires.
• Do not sell education records or use them for advertising.
• Do not use education records to train third-party foundation models.

Teacher guidance

We recommend teachers use initials, case numbers, or pseudonyms instead of full student names when drafting in IEP Co-Pilot. The tool is designed to function with minimized PII.

Data subject requests

Parents and eligible students should direct FERPA-related requests to their school district, which is the controller of the record. We support districts in fulfilling access, correction, and deletion requests.

Data Privacy Agreements (DPAs)

Districts that require a signed DPA — including state-specific addenda — can request one from districts@brightstepsbehavior.com. We support common state DPAs and the SDPC Standard Student Data Privacy Agreement.

Subprocessors

A current list of subprocessors (cloud hosting, database, AI providers, payment processor, email delivery) is available on request. We notify districts of material changes before they take effect.

Contact

Questions about this statement: privacy@brightstepsbehavior.com.