Data Handling & Privacy
Last updated: September 2026
What NOVA+ Collects
NOVA+ collects only what it needs to support instruction:
- Enrollment and scheduling records: student name, district student number, district email, grade level, and class enrollments, loaded from a district export limited to enrollment and scheduling fields.
- Learning records: summaries of tutoring sessions, and which assigned activities a student has marked done along with the teacher's decision. NOVA+ does not store a copy of a student's answers on practice items.
- Accommodation records: when a special education case manager authorizes an accommodation, NOVA+ stores its type and detail, whether it comes from an IEP or a 504 plan, who authorized it, and a delivery entry each time the tutor applies it.
- Daily check-ins: a student can record how they are doing (Good, Okay, or Struggling) as often as they like. Good and Okay are stored and shown to no staff member. Struggling appears on a list for the student's teachers, their special education case manager, the interventionist, and administrators, who mark it seen. It does not send a notification. The student is told someone will reach out, and is shown crisis resources. Check-ins are deleted at the end of each school year, on June 30.
- Badges and teacher notes: staff can recognize a student with a badge and an optional note of up to 280 characters. The student sees the badge, the note exactly as written, and the staff member's name as the student knows it. Notes are encrypted, and the audit log records that an award was made but never the note. Badges are positive recognition only; there is no field for a behavior problem.
- Staff accounts: name, email, the roles a staff member holds, and a record of every change to those roles.
- Sign-in sessions: signing in with Google creates a session record holding the account id, email, name, Google profile photo address, role, and district. It is encrypted twice and deleted eight hours after the last activity, or at sign-out.
Attendance is not collected in the pilot. It is outside the district's current authorization, and NOVA+'s attendance import refuses to load until a data agreement covers it. An automated feed from the district's student information system is planned.
Crisis Language in the Tutor
The tutor checks each student message for language about self-harm or harm from others. The check uses fixed patterns, not the AI model, and works the same way whether or not the AI is available. When it matches, the student is shown crisis resources (988 and the Crisis Text Line), and an alert is drafted for the counselor, administrators, the interventionist, and the student's case manager. They receive an email at their district address saying that a student needs support; the email does not name the student, and they open NOVA+ to see who. A staff member reviews and acts on every alert. No text message is sent.
What NOVA+ Does Not Collect
NOVA+ is built around a minimum-data principle. The following categories are not collected:
FERPA Compliance
NOVA+ is intended to operate as a School Official under FERPA (20 U.S.C. § 1232g). Student education records remain under the control of the school district at all times. NOVA+ does not sell, share, aggregate, or use student data for any purpose outside of instructional delivery for the district.
Administrators and the interventionist can view a student's accommodation record on the Struggling list, under FERPA's school-official, legitimate-educational-interest standard. Every view is logged.
COPPA: If a district deploys NOVA+ to students under 13, the district is responsible for obtaining appropriate parental consent under COPPA. NOVA+ will not collect data from students under 13 without district-verified consent on file.
IDEA Accommodation Logging
When the tutor applies an accommodation a case manager has authorized, NOVA+ records a delivery entry naming the accommodation, the session, and who authorized it. A case manager can export the last 90 days of delivery records, with a check that the audit log behind them is intact. Delivery records are kept for the period IEP service documentation requires.
Access also drafts IEP content for staff review. NOVA+ never writes, edits, or files an IEP. A draft is a proposal that a staff member with caseload authority must read, change if needed, and commit; nothing reaches a plan without that person's action. Drafting from a student's existing special education records is deferred to a separate discussion with Calhoun ISD, so the feature works from what a staff member provides directly.
Data Storage and Security
- Pilot records are kept until the pilot closes on July 31, 2027, then destroyed. A student who leaves the program earlier is destroyed at the end of the school year in which they left.
- All data in transit is encrypted with TLS 1.2 or higher.
- Encrypted at rest twice over. The database file is encrypted as a whole, and on top of that the most sensitive records (generated drafts, audit details, state student numbers, teacher notes on badges, and sign-in sessions) are individually encrypted at the application layer with AES-256-GCM. Reading the database file is not enough to read those records.
- A tamper-evident audit log. Every agent action, every change to a staff member's roles, and every refused record access is written to a hash-chained log that can be independently certified. Any alteration to a past entry breaks the chain and is detected.
- Access is scoped by role and enforced by the server. Teachers see the students in their own classes, and case managers see their own caseload; administrators and the interventionist see the whole school. A staff member who holds more than one role works in one at a time, and every action records which. An out-of-scope request is refused and the refusal itself is written to the audit log, so attempts are visible rather than silent.
- Nothing reaches a student without a person approving it. Every AI-generated lesson, briefing, and alert waits in an approval queue for a staff member.
- The AI cannot write to a student's record. This is structural, not a policy. The agent tool registry exposes six tools, and the only database writes any of them can reach are adding an entry to the human approval queue and appending to the audit log. The functions that write session records, mastery scores, and analytics events are not reachable from a tool at all, so an approved human decision is the only path by which generated content becomes part of a student's record.
- Every record carries its district's identifier, and every query is limited to the caller's district, with no co-mingling across districts.
- Server-side AI proxy, so the model API key is never exposed to the browser.
- No student data is used to train AI models, by NOVA+ or any third-party processor.
- Hosted on Railway in the United States. Backups are encrypted, kept for 30 days on a rolling basis, and stored in the district's own Google Workspace.
Third-Party Services
NOVA+ uses a small number of sub-processors. Each is disclosed below with the data they access and why:
| Service | Purpose | Student data exposure |
|---|---|---|
| Anthropic (Claude API) | Writes tutor replies, and drafts lessons, briefings, and IEP sections for staff review | What a student types to the tutor, the lesson context, and, when the tutor applies an accommodation, the support itself (for example, read aloud), never whether it comes from an IEP or a 504 plan. Student names from NOVA+'s records are not sent; the student is identified by an opaque id. Under Anthropic's standard API terms, inputs are deleted within 30 days, and exchanges flagged by its safety systems may be kept for up to two years. No zero-data-retention agreement is in place. Anthropic does not use API inputs to train models. Anthropic Privacy Policy → |
| Railway | Cloud hosting (United States) | Runs NOVA+ and stores its database, encrypted at rest. |
| Sign-in with Google, and alert emails sent from the district's Google Workspace | At sign-in, the account's email and name. Alert emails go only to district addresses and do not name the student. | |
| Synthesia | Hosts one pre-recorded lesson video | None. A viewer's browser loads the video from Synthesia's servers. |
Fonts are served by NOVA+ itself, so no font service is contacted. Lesson videos are rendered by NOVA+'s own service, also on Railway, and no student information is sent to it.
This Website and the Public Demo
The public site at nova-plus.org holds no student data. Its pages load fonts from Google Fonts and play an overview video hosted by Synthesia. Its demo pages use fictional students; anything a visitor types into a demo tutor is sent to Anthropic to write a reply, and is not stored by NOVA+. Signing in to the demo with a Google Workspace account keeps the account's name, email, and photo address in server memory for up to eight hours.
Data Deletion
Districts may request deletion of all student data at any time by written request. All data associated with the district will be permanently deleted within 30 days of the request or contract termination, whichever comes first. Individual student deletion requests received from a district will be honored within 10 business days. Deletion reaches NOVA+'s database and its backups; it cannot reach a copy the AI provider holds under the terms described above.
Contact
Questions about data handling, FERPA requests, IDEA documentation, or security disclosures:
Jason Raddatz · Founder, NOVA+ · Marshall, Michigan