Data privacy and family data basics

Schools collect a lot of family data. Names, birthdays, parent emails, attendance records, photos in some cases. Here is what Rosterra does with that data and what you should tell families.

What we store

• Students. Name, birthday, gender (if you collect it), rank progression, attendance history, waiver signatures, medical or allergy notes you add, and any uploaded photos.
• Guardians. Name, email, phone, address (if you collect it), card on file (stored at Stripe, not at Rosterra), login credentials.
• Communications. Every email and SMS we have sent on your behalf.
• Audit log. Every meaningful change anyone made, with who and when.

Where we store it

• Application data: Rosterra's database (Postgres hosted on Azure US-East).
• Card details: Stripe's PCI-compliant vault, not Rosterra's database.
• Files (waivers, documents): cloud object storage in the US.

Deleting a family

When a family asks to be deleted (right-to-erasure under GDPR, or just a "please delete my account"):

1. From the family profile, click Delete family.
2. Confirm.

Rosterra runs an erasure workflow that anonymizes the family's identifiable data while preserving the historical records your school needs (counts of how many students attended a class, total revenue figures). Names become "Removed". Emails become hashed. The card on file is unwound at Stripe.

The deletion is logged so you can prove to the family it was carried out.

Family data export

A family can ask for a copy of everything you have on them. From the family profile, click Export data. They get a ZIP with their student profiles, attendance history, waivers, billing history, and any photos they uploaded. The export is delivered as a download link by email, expires after 7 days.

What to put in your privacy policy

If you have a privacy policy on your marketing website, mention:

• You use Rosterra (Trixy LLC) as your customer relationship management software.
• Card payments are processed by Stripe.
• You may use email and SMS to communicate, with an opt-out.
• Families have the right to see, export, or delete their data on request, and how to ask for it.

A short paragraph is fine. The Rosterra team can share a sample paragraph you can adapt.

Children's data

If you have students under 13, you need a guardian consent on file. Rosterra captures this automatically when a guardian creates an account for a child under 13. You do not need to manage it separately.

Photos

If you take photos at class or post them on social media, get a photo release as part of your waiver. Rosterra's waiver tool can include a photo release section. Families who decline have their student flagged so staff know not to include them in photos.