Privacy Policy

Effective date: January 1, 2025  ·  Last updated: August 2026

This Privacy Policy describes how CampusWorkflow ("we," "us," or "our") collects, uses, and protects information when you use the CampusWorkflow academic operations platform (the "Service"). This policy applies to institutional customers, their administrators, faculty, staff, and students who access the Service.

1. Who This Policy Applies To

CampusWorkflow serves two distinct categories of people:

• Institutional Customers and their Authorized Users (administrators, registrars, faculty, staff) — people who use the platform professionally on behalf of their institution.
• Students — end users whose academic records are managed through the platform by their institution.

For students, the institution is the data controller under FERPA. CampusWorkflow acts as a service provider (school official with legitimate educational interest) processing student data solely on the institution's behalf.

2. Information We Collect

From Institutions and Authorized Users

• Contact information (name, institutional email address, job title)
• Account credentials (email, hashed password, or SSO identity)
• Usage logs and activity within the platform (scheduling actions, report views, administrative changes)
• Billing and account information as required for subscription management

From Students (via Institutional Use)

• Name, institutional ID, and contact information
• Course enrollment, registration, and scheduling data
• Attendance records
• Academic progress and degree audit information
• Petition submissions and their disposition
• Pre-registration course selections
• Course evaluation responses (stored anonymously where configured)

Automatically Collected Information

• Log data: IP address, browser type, pages visited, actions performed, timestamps
• Session information for security and auditing purposes
• Cookies used for authentication session management (see Section 8)

3. How We Use Information

We use the information described above exclusively to:

• Provide, operate, and improve the Service
• Authenticate users and maintain secure sessions
• Generate FERPA-compliant access audit logs on behalf of the institution
• Send transactional notifications (scheduling alerts, petition status updates, SLA breach notifications)
• Respond to support requests
• Maintain platform security and detect abuse
• Comply with legal obligations

We do not use student data for advertising, analytics products sold to third parties, or any purpose outside the delivery of the Service to the contracting institution.

4. FERPA Compliance

CampusWorkflow is designed to support FERPA compliance for our institutional customers. Specifically:

• Every access to student educational records within the platform generates an immutable audit log entry, capturing the actor, timestamp, resource type, and action.
• Access to student records is enforced at the API level, not just the UI — users can only access records within their authorized scope.
• Institutions can request disclosure audit logs at any time.
• CampusWorkflow operates as a "school official with a legitimate educational interest" under 34 CFR § 99.31(a)(1), acting as a service provider under the institution's control.
• We do not disclose student educational records to third parties without the institution's authorization except as required by law.

5. Data Sharing and Disclosure

We do not sell, rent, or trade personal information. We may share information only in the following limited circumstances:

• With infrastructure providers: Hosting, database, and cloud infrastructure necessary to operate the Service (e.g., cloud hosting providers). These providers act as data processors under contract and may not use data for their own purposes.
• With email/notification services: Transactional messaging infrastructure for delivering system notifications.
• As required by law: When compelled by a valid legal process such as a court order or government request, we will notify the affected institution to the extent permitted.
• In a business transfer: In the event of a merger, acquisition, or sale of assets, we will notify institutions and ensure equivalent privacy protections apply to student data.

6. Data Retention

• Active accounts: Data is retained for the duration of the subscription.
• After termination: Institutions have 30 days to export their data. After that period, data is deleted from our production systems within 90 days.
• Audit logs: Retained for a minimum of 7 years to support FERPA compliance requirements, unless the institution requests earlier deletion in accordance with its own records retention policy.
• Partial/draft form submissions: Deleted after 7 days of inactivity.

7. Security

CampusWorkflow implements the following security controls:

• Encryption in transit (TLS 1.2+) and at rest
• Multi-tenant data isolation enforced at every database query layer
• Role-based access control, including institution-configurable custom roles scoped by department or faculty
• API key management with SHA-256 hashing and scope enforcement
• SAML 2.0 / SSO support for institutional identity providers
• Automated SLA breach detection and escalation notifications
• Regular security review of authentication and authorization paths

While we implement strong security measures, no system is completely immune to threats. We encourage institutions to follow best practices for credential management and access controls on their end.

8. Cookies

CampusWorkflow uses cookies for the following purposes:

• Authentication: Session cookies that keep users logged in. These are essential for the Service to function and cannot be disabled while using the platform.
• Preferences: Lightweight browser-local storage (not tracking cookies) for UI state such as cookie consent choice and table column preferences.

We do not use third-party advertising cookies, cross-site tracking cookies, or behavioral analytics cookies. The cookie consent banner on the marketing site (campusworkflow.com) covers analytics cookies on that page only. The application itself uses only essential session cookies.

9. Student Rights

Students whose data is processed through the Service should direct requests to exercise their rights (access, correction, deletion) to their institution — the data controller. CampusWorkflow will support institutions in fulfilling these requests in accordance with our data processing agreement.

Where applicable law grants individuals direct rights against service providers, please contact us at info@campusworkflow.com.

10. International Data Transfers

CampusWorkflow's infrastructure is operated within jurisdictions that provide adequate data protection. If your institution is located in the European Economic Area (EEA) or another region with data transfer restrictions, we will work with you to implement appropriate transfer mechanisms (such as Standard Contractual Clauses) as required by your institution's obligations.

11. Children's Privacy

The Service is designed for use by higher education institutions and their adult or near-adult student populations. We do not knowingly collect personal information from children under 13 independent of an institutional relationship. Use of the Service with minors (e.g., dual-enrollment high school students) remains the responsibility of the contracting institution under applicable law.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify institutional administrators of material changes at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

13. Contact Us

For privacy-related questions, data requests, or to report a concern:

• Email: info@campusworkflow.com
• Website: campusworkflow.com

We aim to respond to all inquiries within 5 business days.