Crudspa Foundation Privacy Policy

Effective date: May 11, 2026

1: Introduction

Crudspa Foundation ("Crudspa," "we," "our," or "us") is committed to protecting the privacy of students, families, educators, school staff, administrators, partners, and other users of our websites and hosted software services.

This Privacy Policy explains how we collect, use, protect, and disclose information when you use Crudspa websites, portals, support channels, and related services, including text messaging services. It is intended for publication on Crudspa's public website. Separate written agreements with school districts, research partners, or other customers may impose additional privacy, security, and data-use obligations.

2: Information We Collect

We may collect the following types of information:

• Contact and account information: Names, email addresses, telephone numbers, organization names, job titles, account identifiers, and similar information.
• Student and education records: Student identifiers, class, school, assignment, assessment, content, participation, and other education-related records provided by or on behalf of a school district or authorized education partner.
• Usage and device information: Information about how users access and use our services, including IP address, browser type, operating system, device information, pages or features used, timestamps, logs, and performance data.
• Support and communication records: Information you provide when you contact us, request support, complete a form, consent to receive messages, or communicate with Crudspa.
• Content data: Information entered, uploaded, transmitted, or stored in our services by authorized users.

3: How We Use Information

We use information for the following purposes:

• To provide, operate, maintain, and improve Crudspa services.
• To create and manage user accounts and access permissions.
• To support school districts, educators, students, families, and other authorized users.
• To send service, account, security, support, and administrative communications.
• To provide reports, analytics, and educational functionality authorized by a school district or other customer.
• To comply with legal, contractual, security, audit, and operational obligations.
• To protect the rights, safety, and security of Crudspa, our users, school districts, and the public.

4: SMS and Mobile Messaging Privacy

Crudspa may send text messages to users who have provided a mobile phone number and have consented to receive messages from Crudspa or from a participating school district, program, or authorized representative using Crudspa services.

SMS consent may be collected through paper forms, electronic forms, web forms, account workflows, support workflows, or other consent processes approved by the relevant school district or program. Consent to receive recurring text messages is voluntary and is not a condition of purchase, donation, or general participation in Crudspa services. Some account-security or account-recovery workflows may separately require a current contact method.

Crudspa text messages may include account access codes, security notices, support updates, service reminders, program notifications, and other non-marketing messages related to Crudspa services.

Message frequency varies based on your use of Crudspa services and the services requested by your school district or program. For example, account verification messages are sent when you request access or sign in, and service or support messages are sent as needed.

Message and data rates may apply. Your mobile carrier may charge fees for text messages or data according to your mobile plan.

You may opt out of Crudspa text messages by replying STOP to a Crudspa message. You may request help by replying HELP or contacting us at support@crudspa.org. Opting out of text messages may affect your ability to receive certain account, support, or service notifications by SMS.

Crudspa does not sell, rent, or trade mobile phone numbers. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Crudspa does not share mobile phone numbers or SMS consent records with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are used only to provide requested messages and related support.

5: How We Share Information

Crudspa does not sell personal information.

We may disclose information only as described below:

• With school districts and authorized education partners: We may process or disclose data as directed by, or under agreement with, a school district or authorized education partner.
• With service providers: We may use vendors that help us provide hosting, security, support, analytics, communication, audit, and operational services. These providers may use information only to provide services to Crudspa and must protect it under appropriate confidentiality and security obligations.
• For legal and security purposes: We may disclose information if required by law, subpoena, court order, governmental request, audit obligation, contract, or to protect rights, safety, and security.
• With consent or direction: We may disclose information when an authorized user, school district, parent, guardian, eligible student, or other authorized party directs or consents to the disclosure.

SMS opt-in data, SMS consent records, and mobile phone numbers are not shared with third parties or affiliates for marketing or promotional purposes.

6: Data Security

We use administrative, technical, and physical safeguards designed to protect information, including:

• Encryption of data in transit and at rest where appropriate.
• Access controls based on role, responsibility, and need to know.
• Logging, monitoring, and security review practices.
• Vendor and system review processes.
• Incident response and breach notification procedures.

No system can be guaranteed to be completely secure, but we work to protect information using safeguards appropriate to the sensitivity of the data.

7: Data Retention

We retain information for as long as necessary to provide services, comply with legal or contractual obligations, resolve disputes, enforce agreements, support audits, and maintain security. When information is no longer needed, we delete, de-identify, archive, or return it according to applicable law, contract terms, and retention policies.

8: Student Privacy

Crudspa provides services to U.S. K-12 institutions and works to support compliance with laws that may include the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), the Protection of Pupil Rights Amendment (PPRA), and applicable state student-data privacy laws.

When Crudspa receives student information from or on behalf of a school district, Crudspa generally acts as a service provider or school official under the district's direction and applicable agreements. We collect and use student information only as authorized by the school district, applicable agreements, and applicable law.

We do not use student data for targeted advertising. We do not sell student personal information.

Parents, guardians, and eligible students should direct requests to inspect, correct, export, or delete student education records to the relevant school or school district. Crudspa will support the district in responding to authorized requests.

9: Your Rights and Choices

Depending on your location and relationship to Crudspa, you may have rights to request access, correction, deletion, restriction, portability, or objection regarding certain personal information. These rights may be subject to legal, contractual, and school-district requirements.

To make a privacy request, contact us at support@crudspa.org. If your request concerns student records controlled by a school district, we may direct you to the relevant district.

10: Third-Party Websites and Services

Crudspa services may link to third-party websites or services. We are not responsible for the privacy practices of those third parties. Review their privacy policies before providing information to them.

11: Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and provide notice as appropriate through our website, services, agreements, or other communication channels.

12: Contact Us

If you have questions or concerns about this Privacy Policy or Crudspa's data practices, contact:

Crudspa Foundation
Privacy Officer
1603 Sicily Drive
Longmont, CO 80503
support@crudspa.org