Privacy Policy

Privacy Policy

SmartData All-In-One

Hughes Technology, LLC, operating as SmartData Dashboard

Document ID HT-PP-26.2 · Version 2.1 · Effective October 2026 Supersedes the Privacy Statement effective July 1, 2021, and the Data Privacy and Security Policy HT-PP-26.1.1

The short version

SmartData All-In-One is sold to school districts, and the data in it belongs to those districts — not to us. We hold it to do the job the district hired us to do, and for nothing else.

• We do not sell student data, educator data, or any other district data. Not to anyone, at any price, in any form.
• We do not advertise. No advertising or behavioral analytics trackers operate on any signed-in page of the platform.
• District data is never used to train an artificial intelligence model — not ours, not anyone else's.
• The district owns its data and can get it back or have it destroyed on request, within 60 days.
• Where a district has signed a data privacy agreement with us, that agreement governs and overrides anything in this policy.

The rest of this document is the detail behind those five statements.

1. Who this policy covers

This policy applies to SmartData All-In-One and the modules that run on it, including Program Evaluation, and to our websites at smartdatadashboard.com.

Our customers are school districts, charter organizations, and education agencies. Most of the personal information we hold was given to us by a district, about its own students and staff, so that we can provide a service the district has directed. We are not the decision-maker about that data. The district is.

In the language of federal law, we operate as a school official under the direct control of the district, under the FERPA exception at 34 CFR § 99.31(a)(1)(i)(B). In the language of Texas law, we are an operator under Texas Education Code Chapter 32, Subchapter D. Both carry obligations we accept, and both are reflected below.

2. Where a signed agreement governs instead

Where a district has executed a Student Data Privacy Agreement, Data Processing Agreement, or comparable written agreement with us, that agreement controls and supersedes this policy for all data covered by it.

We sign the standard agreement of the applicable state alliance without modification. In Texas that is the TX-NDPA v1r6 including Exhibit G, executed through the Texas Student Privacy Alliance, with no vendor-specific carve-outs. We also execute the General Offer of Privacy Terms, so that any other district in the state can adopt the same terms without renegotiating them.

Nothing in this policy gives us a right to data that the executed agreement does not.

3. What we collect

From districts, about students and staff. Districts send us the records they already hold. What they send is set out field by field in the schedule of data attached to their agreement, and it is negotiated to the minimum needed for the service. Typically this includes enrollment and demographic information, attendance, course performance, assessment results, behavior and discipline records, intervention participation, and — where the district has purchased the special education modules — referral, evaluation, and eligibility dates.

Fields we ask districts not to send. Social Security numbers. Home addresses. Parent contact details. Medical and counseling records. Free and reduced lunch application detail. Immigration status. If these appear in a district export, we reject the file and ask for a corrected one rather than ingest it.

Pseudonymized identifiers. Districts may replace real student identifiers with their own surrogate keys before sending data and keep the crosswalk internally. Under that option we are structurally unable to re-identify anyone; only the district can.

From people who use the platform. Account information for the educators and administrators who sign in — name, work email, role, district and campus — plus sign-in records and the technical information a browser sends.

From website visitors. Standard traffic and device information, and anything voluntarily submitted through a contact form.

4. What we use it for

We use district data only to deliver and support the service the district has directed: producing analysis and dashboards, running the workflows the district's staff work in, generating the reports and documentation the district needs, providing support, and keeping the platform secure and working.

We use administrator and educator account information to operate accounts, provide support, and send service notices — security alerts, changes to the service, and information a district needs to use what it has purchased. We do not use account information obtained through the platform to send product marketing, unless the district's agreement permits it or the individual educator has separately opted in. Every such message carries a way to unsubscribe. We never send marketing to students.

We do not sell data, rent it, share it for anyone else's marketing, target advertising, or build a profile of any student for any purpose other than the district's own educational one. These are contractual commitments, and in Texas they are also statutory.

5. Who else sees it

Our own staff. Only the named personnel assigned to a district's account, scoped to that district, under multi-factor authentication, with access logged. District data is not copied to laptops or removable media.

Service providers. We use a limited set of infrastructure and service providers — principally Microsoft Azure, Google Cloud Services and Amazon Web Services for hosting — each under a written agreement with data protection terms no less stringent than those we are bound by. We maintain a current register of these providers and furnish it to any district on request.

Nobody else, except where a district instructs us, or where we are compelled by law. If we receive a subpoena, warrant, or other demand for a district's data, we redirect it to the district and notify the district before disclosing anything, unless we are legally barred from telling them.

On a change of control. If Hughes Technology is acquired or merges, district data may transfer only to a successor that accepts obligations at least as strong as those in force — and only with the advance notice and termination rights the district's agreement provides.

6. Artificial intelligence

AI is the question districts ask first now, and it deserves a direct answer rather than a paragraph of reassurance.

District data is never used to train, fine-tune, or improve any AI model. Not ours, and not any external provider's.

Student personal information is not transmitted to external language models. Before any AI-assisted step, real values are replaced with opaque tokens and restored only inside our own environment for display to authorized district staff. Outbound requests and inbound responses are both scanned against the district's roster and against structured personal-information patterns. Every transmission is recorded in a tamper-evident audit log.

One disclosed exception. Reading an uploaded document by the district user — a scanned report, for example — requires transmitting the file itself, because the content is the thing being read; words in an image cannot be tokenized before they are read. That path is disclosed to the user, gated behind an explicit acknowledgement, recorded in the audit log, restricted by file type, and can be switched off entirely for a district.

AI drafts; people decide. AI in the platform summarizes, drafts, and suggests. It does not determine eligibility, disability classification, placement, discipline, or any other consequential outcome. Those decisions belong to the people and committees with the legal authority to make them. AI-generated text is labeled as a draft for human review wherever it appears.

Districts can turn it off. AI features can be disabled for a district entirely, without affecting core analytics, and document processing has its own separate switch.

7. How we protect it

Separation between districts is structural. Each district's data lives in its own database schema rather than in a shared table filtered by a district column. One district's records are not merely hidden from another — they are in a different namespace, and cross-district access is unavailable rather than prevented by application logic remembering to filter.

Encryption. Data is encrypted in transit using TLS 1.2 at minimum, with TLS 1.3 preferred and HSTS enforced; plain HTTP is redirected, never served. File transfers from districts run over SFTP on SSH-2. Data is encrypted at rest with AES-256 using managed key services. Credentials live in a managed secrets service with defined rotation, never in source code or configuration files.

Access. Role-based, scoped by district rather than by seniority, least-privilege, multi-factor authenticated on administrative and infrastructure access, and logged.

Platform. Web application firewall, continuous vulnerability and container image scanning, threat detection, centralized security posture management, network segmentation, and centrally managed patching.

Audit logging that cannot be quietly revised. Our AI transmission audit log is a cryptographic hash chain — each entry incorporates the hash of the one before it, so altering or removing a historical entry breaks every hash that follows and the break is detectable.

A note on certifications, stated precisely. The infrastructure hosting district data — Microsoft Azure, Google Cloud Services and Amazon Web Services — holds SOC 1, SOC 2 Type II and SOC 3 attestations, ISO/IEC 27001, 27017 and 27018 certification, and FedRAMP authorization. All providers publish those reports directly, so a district can verify them without going through us.

Hughes Technology does not hold its own company-level SOC 2 Type II attestation. We are not going to imply otherwise. We implement the CIS Critical Security Controls, Implementation Group 1 as our named cybersecurity framework, documented as a dated, safeguard-by-safeguard self-assessment available to any district on request. An independent company-level audit is on our roadmap, and when we complete it we will say so.

8. Where the data lives

All district data is stored within the United States. We maintain a written inventory of storage locations and provide it to any district that asks.

9. How long we keep it, and how it is destroyed

We keep district data only as long as we are providing the service, or as long as the district's agreement requires.

• On district request, we delete covered information within 60 days. Our deletion procedure reaches primary storage, exports, derived tables, logs, and backup retention — not just a soft-delete flag.
• On termination, all district data is returned or destroyed, and the obligation survives the end of the agreement until it is done.
• For pilots and evaluations, source files are removed from the transfer environment within five business days of ingest, and the district's environment is destroyed within 30 days of close unless the district proceeds.
• A written certificate of destruction — identifying each dataset, the date received, the date destroyed, and the method — is issued on completion. Districts may request destruction at any time, for any reason or none.

10. Access, correction, and rights

Parents and eligible students hold rights of access and amendment under FERPA, and those rights run against the school district, which is the custodian of the education record.

Requests to see or correct a student's information should therefore go to the district. If such a request comes to us directly, we forward it to the district and support the district's response. District administrators can export and correct a student's complete record without opening a support ticket with us.

Educators and administrators can review and update their own account information, and may contact us about it directly.

11. If something goes wrong

If we confirm a security incident affecting a district's data:

• We notify the district's designated contact immediately on discovery, and in any event within 24 hours.
• We provide a written preliminary assessment within 72 hours — what was affected, what was not, and what has been done.
• We provide a full written report, including root cause and remediation, when the investigation closes.

Our notification is built to be usable as the district's own regulatory reporting input: affected counts by campus, the categories of information involved, the date or date range, whether notice was delayed at law enforcement request, and a description of the incident. Districts carry their own reporting duties — to their state education agency and to families — and a vague vendor advisory does not let them meet those. Ours is written so that it does.

12. Cookies and tracking

We use cookies that are necessary to sign you in and keep your session working, and we measure basic traffic on our public websites.

We run no data access advertising, and no third-party advertising or behavioral analytics tracker operates on any authenticated page of the platform. Most browsers let you control cookies; the platform requires session cookies to sign in.

13. Children

SmartData All-In-One is provided to school districts for educational purposes and is not directed to children for personal use. Where students under 13 are involved, the school's consent stands in for parental consent under COPPA, and use remains strictly educational. There is no commercial use of student information, at any age.

14. Health information and HIPAA

Records a school district maintains about its students — including health, nurse, special education, and evaluation records — are education records under FERPA. Federal regulations exclude FERPA education records from HIPAA's definition of protected health information (45 CFR § 160.103). SmartData All-In-One therefore operates under FERPA rather than HIPAA, and we do not describe ourselves as HIPAA-compliant.

If a customer's particular use brings records within HIPAA — for example, records maintained by an outside health care provider operating a school-based clinic, rather than by the school itself — we will execute a Business Associate Agreement before processing those records.

15. Changes to this policy

We may update this policy. When we do, we post the revised version here with a new effective date and document ID, and we notify districts of material changes. Where a district's executed agreement requires advance notice or consent for a change, that requirement governs.

16. Contact us

Hughes Technology, LLC (operating as Hughes Education and SmartData Dashboard) PO Box 389, Mountain Home, Arkansas 72654

General and privacy enquiries: support@hugheseducation.net Phone: (844) 437-6123 Web: smartdatadashboard.com

Districts evaluating us may request our service provider register, our data location inventory, our incident response procedure summary, and our standard data privacy agreement.