Privacy Policy | Attendly

At Attendly, Inc. ("Attendly", "us", "we" or "our"), maintaining the trust of our online users is of the utmost importance to us. We have developed this Privacy Policy (this "Policy") to explain how we collect, process, use and share information about our users.

Please read the policy carefully to understand our practices regarding our collection and use of your personal information and how it will be treated.

This Policy applies to Attendly's website located at www.attendly.com and other related Attendly domains and subdomains (collectively, the "Sites"), Attendly's online platform, including web and mobile applications (collectively, the "Services"), and any other interactions (e.g., customer support inquiries, etc.) you may have with us.

By visiting the Sites, accessing or using the Services, or interacting with any aspect of our business, you accept the terms of this Policy and expressly consent to our collection, use, and disclosure of data, including Personal Data, provided to or otherwise received by us for the purposes and in the manner described in this Policy and the applicable Customer Agreement (defined below).

If you do not agree to this Policy, do not use the Sites, use the Services, interact with us, or give us any information. Your continued use of the Sites and/or the Services means that you agree to this Policy.

1. Who Are "You"?

This Policy describes how we use your information. To understand which of our uses of information are actually applicable to you and your information see the following useful definitions.

You may be a:

Customer – an entity, or person representing an entity, that has an agreement in place with Attendly ("Customer Agreement") under which we provide you the Services.
End User – parents, teachers, admin staff, or other user type that is accessing the Services through one of our Customers.
Visitor – a person who is visiting our website or has expressed an interest in our products or services by filling in a contact form or sign-up sheet in relation to an event or webinar or has had conversations about our products with our sales team and provided them with information.

Your use of the Services may be subject to our Customer's policies, if any. If you have any questions about your specific settings and privacy practices, please contact the Customer with whom you have a direct relationship and whose account you use. Attendly is not responsible for the privacy or security practices of our Customers, which may differ from those set forth in this Policy.

2. Information We Collect and Receive

Sometimes you provide us with data and sometimes data about you is collected automatically. To the extent data is associated with an identified or identifiable natural person and is protected as personal data under applicable data protection laws, it is referred to in this Policy as "Personal Data". You acknowledge and agree we may collect, process, store, access, and disclose Personal Data disclosed by you or our Customer to facilitate the provision of Services and related support for the Services in the manner described in this Policy and the Customer Agreement.

2.1 Customer Data

End Users routinely submit the following categories of data to Attendly when using the Services ("Customer Data"):

Account Information. To create or update an End User account for the Services, End Users are asked to provide their full name, email address, phone numbers, and profile images. Customer employees may be asked to provide additional information related to their role.
Student Information. Parents or legal guardians are asked for their children's full name, grade level, student ID, and additional information when applicable.
Program Data. When an End User interacts with the Services, we collect, process, and store any data that is created, posted, uploaded, stored, displayed, transmitted, or submitted on or through the Services as a function of rendering the Services. This includes, but is not limited to, enrollment records, waitlist records, attendance information, program capacity information, and other program-specific information.
Sync Data. Attendly makes tools available to integrate data from Third-Party Services used by Customer into the Services. When the Services are integrated with a Third-Party Service, we will receive all data selected by the Customer to sync with the Services. Sync Data is imported into the Services.
Payment Information. When you make payments through our Services, our third-party payment processor (Stripe, Inc.) collects payment card information, billing address, and transaction details. Attendly does not store complete payment card numbers on our servers. Payment processing is subject to Stripe's Privacy Policy, available at https://stripe.com/privacy. Stripe is a PCI DSS Level 1 certified payment processor.

The above Customer Data is governed by the Customer Agreement. Our Customer is responsible for the management of your account on the Services. If you have any questions or concerns regarding our use or collection of your Personal Data, or if you wish to make a request to exercise your rights as a data subject or a consumer (as explained below), please reach out to our Customer (e.g., your school/school district) as they are best placed to assist you.

2.2 Other Information

Attendly collects the following information from Customers and End Users related to their usage of the Services and interactions with Attendly ("Other Information"):

When an End User interacts with the Services, metadata is generated that provides additional context about the Services and the way End Users use the Services ("Metadata"). We collect aggregated or de-identified Metadata of the Services, so that the resulting data and statistics are not reasonably personally identifiable to any individual End User.
Like most websites and web-based technology services, our servers automatically collect data when you access or use our Sites or the Services. This may include the IP address, pages visited, the time spent on those pages, and access times and dates.
We collect technical data, such as information about devices accessing the Services, including the type of device, device settings, operating system, application software, peripherals, and unique device identifiers.
We collect personal information you provide when you contact us, request support, respond to a survey, send a message through the Service, apply for a job, interact with our social media accounts, or sign up to receive emails or text messages.

2.3 Online Tracking Technology

We and our third-party partners and service providers use cookies and other similar online tracking technologies to gather information when you interact with our Sites, Services, and email communications. A cookie is a small data file sent from a website or application and stored on your computer or device. Cookies allow us to recognize your browser when you return to the Sites or Services, remember your login information, enable access to the Services, and monitor potential account misuse. Cookies also allow us to better understand how you interact with the Sites and Services and to monitor aggregated usage. You can set your browser to detect some cookies, to stop accepting cookies or to prompt you before accepting a cookie. Disabling our cookies will prevent access to some content and limit some of the functionalities within our Services. To learn more about browser cookies, including how to manage or delete them, look in the Tools, Help or similar section of your web browser, or visit www.allaboutcookies.org.

2.4 No Sensitive Personal Data

We do not intentionally collect, process, or store, and we request that you do not post, upload, store, display, transmit, or submit sensitive personal data on or through the Services or in Customer Data, such as biometric or health data. Attendly is not responsible and will not be liable for any loss or damages you or another individual may experience due to your disclosure of sensitive personal data while using the Services.

2.5 Children's Data

Attendly's Sites and Services are directed to other businesses and the Services are intended for use only by those who are 18 years of age and over. The Services are not directed to or intended to be used by children, and Attendly does not intentionally collect, process, or store any Personal Data from any person under 13 years of age except as required to perform our core Services. If we do collect such data as required to perform our core Services, we do so only with the consent, or at the direction, of parents/guardians and schools and in compliance with the Children's Online Privacy Protection Act ("COPPA"). In the event we discover we have inadvertently collected, processed, or stored any Personal Data from a person under 13 years of age that is unrelated to our core Services, we will promptly take the appropriate steps to delete such data or seek the necessary verifiable parental or school consent for that collection in compliance with COPPA.

Parents and guardians of children under 13 who use any of the Services have certain rights under COPPA and Attendly recognizes those rights. Parents and legal guardians using the Services should contact their school or school district to exercise their rights and we will work with the parent/guardian and school together to facilitate those requests.

3. How and Why We Use Your Information

Customer Data will be used by Attendly in accordance with Customer's instructions, including any applicable terms in the Customer Agreement, and as required by applicable law. Customer may, for example, use the Services to grant and remove access, create End Users accounts, assign roles and configure settings, access, modify, share, restrict, export, and remove Customer Data and otherwise apply its own policies to the Services.

Other Information will be used by Attendly in furtherance of our legitimate interests in operating our business and providing the Sites and Services, to perform contractual obligations, and/or pursuant to your express consent for a specific purpose. Specifically, Attendly may use Other Information for these purposes and legal bases:

Providing the Websites and Services. To make the Sites available and support delivery of the Services under a Customer Agreement, manage End Users' requests interacting with the Services (e.g., login and authentication, remembering settings, etc.), hosting and back-end infrastructure, analyze and monitor usage, monitor and address service performance, security, and technical issues.
Improving the Websites and Services. To test features, interact with feedback platforms and questionnaires, manage landing pages, heat mapping, traffic optimization, data analysis and research, and in some cases using third parties to do this.
Support Services. To respond to support requests via live chat, phone, or email and otherwise provide support for and resolve problems with the Services.
Communications. To send service, technical, and administrative emails, messages, and other communications. Service-related communications about changes to the Services and important Services-related notices, such as maintenance and security announcements, are essential to delivery of the Services and you cannot opt-out. Marketing communications about new product features, service offerings, and other news about Attendly are optional and you have the choice whether or not to receive them.
Account Management. To contact for billing, account management, feedback, and other administrative matters.
Security Purposes. To help prevent and investigate security issues and abuse.
Legal Obligations. To comply with legal obligations as required by applicable law, legal process, or regulations.

Prohibited Uses of Student Data. Attendly does not use student Personal Data for any purpose other than providing the Services to our Customers. Specifically, Attendly:

Does not use student Personal Data for targeted advertising or marketing purposes;
Does not use student Personal Data to create advertising or marketing profiles of students;
Does not sell, rent, or trade student Personal Data to any third party; and
Does not use student Personal Data for any purpose not explicitly authorized by the Customer Agreement.

4. When and Why We Disclose Your Information

Except as described in this Policy or the applicable Customer Agreement, Attendly will not use or disclose your Personal Data for any purpose other than to the extent necessary to perform the Services and related support for the Services, unless you expressly consent to any other use or disclosure. Attendly may share and disclose data with respect to:

Customer's Instructions. Attendly will share and disclose Customer Data in accordance with a Customer's instructions, including any applicable terms in the Customer Agreement and Customer's use of the Services functionality, and as required by applicable law. Pursuant to the Customer Agreement, Customer Data is generally treated as the confidential information of Customer unless stated otherwise.
Customer Access. Account administrators, End Users, and other Customer representatives and personnel may be able to access, modify, or restrict access to your data. For example, our Customer (e.g., your school/education provider) may use the Services administrative controls and features to access or modify your account details or view certain activities in their Customer account.
Displaying the Services. When an End User submits data on the Services, it may be displayed to the Customer and other End Users on the same account.
Rendering the Services. Attendly employees and contractors may have access to your data on a need to know and confidential basis to the extent necessary to render the Services and related support for the Services.
Third-Party Service Providers. Attendly engages third parties to host and process data in support of delivering of the Services ("Third-Party Service Providers"). Attendly may share your data, including Personal Data, with Third-Party Service Providers (e.g., email services, platform hosting, cloud computing services, data storage and processing facilities) to the limited extent necessary to let them perform business functions and services for us or on our behalf in connection with the provision of the Services; provided that such Third-Party Service Providers process data in a manner consistent with this Policy and applicable data protection laws and will not use or disclose Personal Data for any other purpose. A current list of our Third-Party Service Providers (subprocessors) is available on our Trust Center or upon request.
Payment Processor. Stripe, Inc. processes all payment transactions made through the Services. When you make a payment, Stripe receives your payment card information, billing address, and transaction details. Stripe's handling of your information is governed by their Privacy Policy, available at https://stripe.com/privacy.
Security and Infrastructure Providers. Cloudflare, Inc. provides content delivery, DDoS protection, DNS services, and web application firewall services for the Services. When you access the Services, Cloudflare processes your IP address, HTTP request headers, and traffic metadata. Cloudflare's handling of your information is governed by their Privacy Policy, available at https://www.cloudflare.com/privacypolicy/.
Third-Party Services. By using our Services, Customers may enable or permit integrations with or use of Third-Party Services in connection with the Services. When enabled, Attendly may share certain data with such Third-Party Services as requested to effectuate the integration. Third-Party Services are not owned or controlled by Attendly and third parties that have been granted access to your data may have their own policies and practices for its collection and use. You should check the privacy settings and notices of these Third-Party Services to understand their privacy practices.
Changes to Attendly's Business. If Attendly engages in a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of its assets or stock, financing, public offering of securities, acquisition of all or a portion of our business, a similar transaction or proceeding, or steps in contemplation of such activities (e.g., due diligence), Attendly may share or disclose data in connection therewith, subject to standard confidentiality obligations.
Aggregated or De-identified Data. If any data is aggregated or de-identified so it is no longer reasonably associated with an identified or identifiable natural person, we may use or disclose such aggregated or de-identified data for any purpose, to the extent permitted by applicable laws. For example, we may share aggregated or de-identified data with prospects or partners for business or research purposes, such as statistical analysis, to research trends and predictive analysis, or to develop or improve the Services.
Enforcement of Agreements. Attendly may disclose data to ensure compliance with and enforce Customer Agreements and any other contractual or legal obligations with respect to the Services and our business.
Protection of Rights. Attendly may disclose data to protect and defend our rights and property, including intellectual property rights, and to ensure compliance with applicable laws and enforce third party rights, including intellectual property and privacy rights.
Legal Compliance. If we are compelled by law, such as to comply with a subpoena, court order, or other lawful process, or in response to a lawful request by public authorities to meet national security or law enforcement requirements, Attendly may disclose data if we reasonably believe disclosure is in accordance with or required by any applicable law, regulation, or legal process.
Safety and Security. Attendly may disclose data to protect your safety and security; to protect the safety, security, and property of Customers; and to protect the safety, security, and property of Attendly and our employees, agents, representatives, and contractors.
Your Consent. Attendly may disclose your data to third parties when we have your express consent to do so.

5. Education Law Compliance

Attendly is committed to complying with applicable federal and state laws governing student data privacy. When providing Services to K-12 educational institutions, Attendly operates as a "school official" under the Family Educational Rights and Privacy Act ("FERPA") and processes student education records solely at the direction of, and on behalf of, the educational institution.

5.1 Federal Compliance

FERPA (Family Educational Rights and Privacy Act, 20 U.S.C. §1232g). Attendly complies with FERPA requirements and acknowledges that student education records remain under the control of the educational institution. We use student education records solely to provide the contracted Services and do not disclose such records except as permitted by the educational institution or as required by law.
COPPA (Children's Online Privacy Protection Act, 15 U.S.C. §§6501–6506). As described in Section 2.5 above, Attendly complies with COPPA when collecting personal information from children under 13 years of age. Attendly relies on the school consent exception under COPPA: schools may consent on behalf of parents for the collection of children's personal information when the data is used exclusively for educational purposes. Attendly collects only the data necessary to provide attendance tracking services, does not use student data for any commercial purpose (including advertising or behavioral targeting), and does not disclose data to third parties except as necessary to provide the contracted educational service. Schools are provided with our full privacy policy and a description of our data collection practices to enable informed consent on behalf of parents.

5.2 California Compliance

For California educational institutions, Attendly additionally complies with:

SOPIPA (Student Online Personal Information Protection Act, Cal. Bus. & Prof. Code §22584). Attendly does not use student information for targeted advertising, does not create advertising profiles of students, does not sell student information, and does not disclose student information except as permitted under SOPIPA.
AB 1584 (Cal. Ed. Code §49073.1). Attendly certifies that student records continue to be the property of and under the control of the educational institution. Students retain the ability to access, export, and transfer their records. Upon termination of the Customer Agreement, Attendly will return or delete all student records as directed by the educational institution.

5.3 Student Data Privacy Agreements

Attendly is a signatory to the California Student Data Privacy Agreement (CA-NDPA) and may enter into similar student data privacy agreements with educational institutions and consortia. The terms of such agreements are incorporated into the applicable Customer Agreement and govern our handling of student data for those Customers.

6. Retention and Deletion

Attendly will retain Customer Data in accordance with a Customer's instructions, including any applicable terms in the Customer Agreement and Customer's use of the Services functionality, and as required or permitted by applicable law. Attendly may retain Other Information and any data pertaining to you, including Personal Data, for as long as your End User account is active and thereafter for as long as necessary for the purposes described in this Policy, including for the period of time needed to pursue our legitimate business interests, provide our Customer (e.g., your school/school district) with the Services, conduct audits, resolve disputes, comply with contractual obligations (including but not limited to Customer Agreements), and comply with (and demonstrate compliance with) legal obligations.

Data Deletion for Educational Institutions. Upon termination or expiration of a Customer Agreement with an educational institution, or upon written request from the educational institution:

Attendly will delete or return all student Personal Data within sixty (60) days, unless retention is required by law or the educational institution requests an extension to facilitate data export.
Prior to deletion, the educational institution may request export of their data in a commonly available format (e.g., CSV, JSON).
Attendly will provide written confirmation of deletion upon request.

7. Security Measures

Attendly maintains physical, technical, and administrative procedures to safeguard and secure the data we collect. We work hard to protect data in our custody and control from loss, misuse, and unauthorized access, disclosure, modification, or destruction.

7.1 Technical Safeguards

Attendly implements the following technical security measures:

Encryption in Transit. All data transmitted between users and our Services is encrypted using Transport Layer Security (TLS) 1.2 or higher.
Encryption at Rest. All stored data, including backups, is encrypted using AES-256 encryption.
Access Controls. Role-based access controls with per-tenant isolation. Access is scoped to each district's dedicated environment.
Infrastructure Security. Our Services are hosted on enterprise-grade cloud infrastructure (Google Cloud Platform) with industry-standard security certifications.
Monitoring. Automated error monitoring and alerting via Sentry, with cloud-native security monitoring and DDoS/WAF protection via Cloudflare and GCP Cloud Operations.

7.2 Important Reminders

However, please remember:

You provide Personal Data at your own risk.
No data transmission over the Internet is guaranteed to be 100% secure; we cannot guarantee that unauthorized access, hacking, data losses, or other breaches will never occur, and we are not responsible for security incidents not reasonably foreseeable or reasonably within our control.
You are responsible for safeguarding your End User account and password.
If you believe your privacy has been breached, please contact us immediately at support@attendly.com.

8. Security Incident Response

Attendly maintains a formal incident response program to detect, respond to, and recover from security incidents.

8.1 Breach Notification

In the event of a security incident that results in unauthorized access to, or disclosure of, student Personal Data or other Customer Data:

Attendly will notify the affected Customer within seventy-two (72) hours of confirming the breach, unless a shorter timeframe is required by law or the applicable Customer Agreement.
Notification will include, to the extent known: (a) the date of the breach; (b) the nature of the incident; (c) the types of data affected; (d) the number of individuals potentially affected; (e) steps taken to contain and remediate the incident; and (f) contact information for further inquiries.

8.2 Cooperation

Attendly will cooperate with affected Customers in their own incident response and notification efforts, including providing information necessary for the Customer to notify affected individuals, regulators, or other parties as required by law.

9. Your Rights

Individuals located in certain jurisdictions have certain statutory rights in relation to their personal data. Subject to any exemptions provided by law, you may have the right to exercise your rights and request certain actions with respect to your Personal Data.

9.1 California Residents

As a California resident, you may have certain rights regarding your personal information under the California Consumer Privacy Act and the California Privacy Rights Act (Cal. Civ. Code §1798.100–1798.199.100). These rights include:

Right to Opt-out. You may have the right to opt out of an organization selling your information to third parties. We do not sell information to third parties, but should this change, we would update this Policy to provide further information on our practices and the exercising of this right.
Right of Notice. You may have the right to be notified of which personal information we are collecting from you, the reasons why, and how it would be used. This Policy provides you with this information.
Right of Disclosure. You may have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months.
Right of Deletion. You may have the right to request that we delete any personal information we have collected from you in the last 12 months, in certain circumstances.

In order to prevent unauthorized access to your information, we are required by law to verify your identity before we may address your request.

9.2 To Exercise Your Rights

Attendly is used in schools at the direction of our Customers. In addition, we are obligated under FERPA to remain under the direct control of our Customers with respect to our use and maintenance of student personal information that is part of the education record. As such, if you wish to exercise your rights in respect to student personal information, please contact our Customer (e.g., your school/school district) and we will work with them to facilitate your request.

Additionally, if you are an End User and you seek to access, correct, update, or delete Personal Data held or processed by us on behalf of a Customer, you should direct your inquiry to our Customer (e.g., your school/school district). Upon receipt of a request from one of our Customers for us to remove the data, we will respond to their request in a timely manner.

When applicable, you can access, correct, update and delete your Personal Data by emailing us at support@attendly.com. If you are an End User, you can also do this by signing in to your account and editing your information as desired.

Your exercise of the above rights is subject to certain exemptions to safeguard the public interest and our interests. Requests to exercise these rights may be granted in whole, in part, or not at all, depending on the scope and nature of the request and applicable law. Where required by applicable law, we will notify you if and why we are unable to fulfill your request.

We will not discriminate or otherwise penalize anyone for exercising their rights.

10. Changes to This Privacy Policy

Attendly may change, modify, or update this Policy from time to time, in whole or in part, in Attendly's sole discretion, at any time without prior notice by posting updated versions on the Attendly website. When we do, we will revise the "last updated" date on this page. If and when we make material changes to this Policy, we will make commercially reasonable efforts to notify you by email, through the Services, or by posting a prominent notice on our Website. We encourage you to visit this page to stay informed on our privacy practices and review our most current Privacy Policy. Any changes, modifications, or updates to this Policy will become effective immediately upon such posting. Your continued use of the Services constitutes your agreement to be bound by such changes to this Policy. If you disagree with the changes to this Policy, your only remedy is to discontinue use of the Services and deactivate your account.

11. Contact Attendly

We encourage you to contact us with any questions, complaints, or requests with respect to your Personal Data, this Privacy Policy, or our privacy practices.

You may contact us at:

Attendly, Inc.
2120 University Ave.
Berkeley, CA 94704

General Inquiries: support@attendly.com
Privacy Inquiries: privacy@attendly.com
Security Inquiries: security@attendly.com