How WaiverSaver handles student data

Schools hand us something sensitive: the names of their students and the families behind them. This page explains, in plain language, the laws that govern that data and exactly what WaiverSaver does — and doesn't do — with it.

FERPA

The Family Educational Rights and Privacy Act is the federal law that protects student education records. It applies to any school that receives funding from the U.S. Department of Education — which means every public school and district, and some private schools. If your school is covered, FERPA controls when you may share student information with an outside company like us.

How schools can use a vendor under FERPA

FERPA lets a school share records without individual parental consent with a “school official” who has a legitimate educational interest. A contractor counts as a school official when all of the following are true:

• It performs a service the school would otherwise do with its own staff — here, collecting permission forms.
• It is under the school's direct control regarding how the records are used and maintained.
• It uses the records only for the purpose the school authorized, and does not share them further.

How WaiverSaver meets that standard

• Our Data Processing Agreement designates WaiverSaver as your school official. It is accepted when your account is created and restricts us to exactly what FERPA requires.
• We use student information only to run the service — showing a parent the right form, recording who signed, producing the certificate.
• We never re-disclose it. No other schools, no partners, no advertisers. Only your staff and the parent who signed can see a record.
• You stay in control. Your staff decide what is collected, can export everything, and can ask us to delete it.
• Parents' rights are built in. Every signer gets a certificate of exactly what they signed — the parent's right to see the record, satisfied automatically.
• We tell you if something goes wrong. If we ever discover unauthorized access to your data, we notify your school promptly so you can meet your own obligations.

COPPA

The Children's Online Privacy Protection Act is the federal law about collecting personal information online from children under 13. It is the reason apps ask whether you are 13 or older. A service that collects information directly from a young child must first obtain verified parental consent through a strict process.

Why COPPA does not restrict WaiverSaver

COPPA is about who provides the information. On WaiverSaver, the person filling in a form is always an adult: a parent or guardian entering their own child's name, or a staff member at the school. We collect information about students, from adults — exactly like the paper permission slip a parent fills out at the kitchen table.

• Students never have accounts and never sign anything on WaiverSaver.
• No part of the service is directed to children. Every page is written for adults.
• We do not knowingly collect information from anyone under 13. If we learn that we have, we delete it.

We deliberately do not rely on COPPA's “school consent” exception, because we never collect from children in the first place.

Georgia's Student Data Privacy Act

Georgia's Student Data Privacy, Accessibility, and Transparency Act (O.C.G.A. § 20-2-666 and following) applies to companies whose services are used for K-12 school purposes — including WaiverSaver. It is stricter than FERPA in one useful way: it spells out what a vendor may never do with student data, regardless of what any contract says.

What the law prohibits, and our answer to each

• Targeted advertising using student data — WaiverSaver shows no advertising of any kind.
• Selling student data — we do not sell any data, student or otherwise.
• Building a profile of a student for anything other than the school's purpose — we build none.
• Using data for purposes the school did not authorize — our only purpose is the one you signed up for.

The law also requires reasonable security and deletion on the school's request. Both are described below and written into our agreement with you.

Electronic signatures

Georgia's Uniform Electronic Transactions Act and the federal ESIGN Act give a drawn or typed signature the same legal effect as ink, provided the signer intended to sign and agreed to do so electronically. WaiverSaver records that intent, and records what makes a signature provable:

• An exact, frozen copy of every document the signer saw, with a cryptographic fingerprint (SHA-256) taken at the moment of signing.
• The signature itself, the signer's name and relationship to the participant, the time, and the network address it came from.
• A certificate the signer can download, and your staff can retrieve at any time.

Security and retention

• Encrypted in transit and at rest. All traffic uses HTTPS; stored files and database records are encrypted on disk.
• Each school is isolated. Your data lives under your own address and can never be reached from another school's.
• Access is limited to your staff — people you have added — and to the parent who signed a given form.
• Signed records are kept permanently. A minor's claims in Georgia can be brought years after an event, so we never expire a signed record on a timer. You may request deletion at any time.

Your responsibilities

Compliance is shared. WaiverSaver handles the technology and the commitments above; your school handles what only a school can:

• Write your own forms, and have your counsel review them — we remind you each year before your school year begins.
• Add only the staff who need access, and remove them when they leave.
• Follow your own record-keeping and parental-notice policies.

This page explains our practices in plain language. The binding terms are in our Terms of Service, Privacy Policy, and Data Processing Agreement. Nothing here is legal advice; schools should consult their own counsel about their obligations.