Privacy & Security

ParaFlowTool is a secure, cloud-based application. The application is hosted on Vercel, and its data is stored in a managed Postgres backend on Supabase. All data is encrypted in transit over HTTPS/TLS and at rest. Access is restricted to authenticated, authorized school personnel.

Each school’s data is isolated from every other school’s at the database layer. Access is enforced per school, so one school’s staff can never see another school’s schedules, staff, or students.

ParaFlowTool runs on certified infrastructure. Our vendors — Supabase (our database backend) and Vercel (our application host) — each hold SOC 2 Type II attestations and ISO 27001 certification, with details available through their respective trust centers. To be clear, those certifications belong to Supabase and Vercel, not to ParaFlowTool: ParaFlowTool itself is not independently certified. We build on certified infrastructure and hold ourselves to the practices described here.

ParaFlowTool intentionally collects only the minimum information necessary for staffing coordination. This typically includes staff names and a student’s first name with last initial. The platform does not store IEP documents, evaluation reports, grades, protected health information, or full educational records — so it is designed to minimize the FERPA-regulated data a school would otherwise entrust to a vendor.

We do not sell school or personal data, and customer data is never used to train or fine-tune artificial intelligence or machine-learning models.

Website analytics and advertising

Across our website, sign-up flow, and application, we use standard analytics and advertising-measurement tools — including the Meta (Facebook) pixel and Vercel Analytics — to understand how people find and use ParaFlowTool and to measure our advertising. These tools may set cookies and record usage events such as pages viewed, when someone opens the demo, and when a free trial or subscription begins.

This measurement is limited to how our site and product are used. It is deliberately kept separate from your school’s scheduling data: these tools do not receive student, staff, or schedule information, which stays isolated as described above and is never sold. You can limit this tracking through your browser settings or your device’s ad-preference controls.

Upon termination of service, customer data is returned or deleted on written request. Deleted data may persist in secure backups for a limited time before permanent removal.