How Sure Step Education collects, uses, protects, and never sells your student data.
Student data collected through TransitionReady is used exclusively to support students' educational transition goals. We do not sell student data. We do not use student data for advertising. We do not share student data with third parties except as required to operate the platform or comply with law. We do not use student data to build profiles for any purpose other than providing TransitionReady services.
This Privacy Policy describes how Sure Step Education ("we," "us," or "our") collects, uses, stores, and protects information through TransitionReady, our student transition portfolio platform. It applies to all users of TransitionReady including students, case managers, district administrators, and Sure Step Education staff.
This policy is designed to comply with the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g), the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506), the Student Online Personal Information Protection Act (SOPIPA, Cal. Bus. & Prof. Code § 22584), California Education Code § 49073.1 (AB 1584), and applicable IDEA confidentiality provisions.
The Designated Responsible Individual for privacy compliance at Sure Step Education is Nicholas Crabtree.
Sure Step Education is the operator of TransitionReady. We provide transition portfolio services to K–12 school districts under written data privacy agreements that comply with AB 1584 and applicable state and federal law.
We act as a "School Official" under FERPA when we access student education records, meaning we use that access only for legitimate educational purposes and under the direct control of the educational institution.
Because TransitionReady serves students 16 and older, COPPA (which applies to children under 13) does not apply to our student-facing services. However, we maintain COPPA-equivalent protections for all student data as a matter of policy.
If we become aware that a student under 16 has been added to the platform, we will work with the district to remove that account promptly.
We collect only the data necessary to provide TransitionReady services. The following categories of information may be collected:
Account information: Full name, email address, role (student, case manager, district administrator), school, and district. This is provided at account creation via an invite link.
Portfolio content (students only): Information students voluntarily enter into their portfolio, including personal profile details (name, phone, address, graduation year, GPA), career interests and goals, work samples, supporting documents, and AI-generated documents such as resumes, cover letters, letters of recommendation requests, and 5-year plans.
Optional profile photograph: If a student chooses to upload a profile photograph, it is stored only in the student's own web browser on the device used to upload it. Profile photographs are not uploaded to our cloud database or our file storage and are not accessible to case managers, district administrators, or Sure Step Education staff. Clearing browser site data will remove the photograph.
Case manager suggestions: Proposed edits submitted by a student's assigned case manager, including the field, suggested value, and status (pending, approved, or rejected by the student).
Case manager contact directory (post-graduation follow-up): A student's assigned case manager may record durable contact details for the student to support transition follow-up after graduation, including the student's name, graduation year, personal phone and personal email, social-media handles (Instagram, Snapchat, TikTok, Facebook, LinkedIn), and free-text notes. These records are owned by, and visible only to, the case manager who created them. Because their purpose is to maintain contact after a student's portfolio account is deactivated, these contact records are deliberately retained beyond the life of the student account (see Section 12) and store a snapshot of the student's name. They are not visible to other case managers, to other students, or to Sure Step Education in the ordinary course.
Usage data: Account creation date, last portfolio save timestamp, and aggregated platform activity metrics. We do not track individual browsing behavior or use third-party analytics tools.
Communications: Invite tokens generated for account creation. We do not store the content of any emails sent through the platform.
We use the data we collect solely for the following purposes:
We do not use student data for any purpose beyond providing and improving TransitionReady services.
Access to student data is strictly controlled by role. The table below describes what each role can and cannot access:
| Role | What they can access | What they cannot access |
|---|---|---|
| Student | Their own portfolio only. They can view, edit, and export their own data. They choose which case manager to connect (and can disconnect at any time), and they approve or reject suggestions made by that case manager. | Any other student's data. |
| Case Manager | Read-only view of the portfolios of students who have connected them as their case manager. Can generate student invite links to add students. Can submit portfolio suggestions for the student to approve or reject. Can keep a private contact directory (personal phone/email and social-media handles) for their own students, for post-graduation follow-up. | Portfolios of students who have not connected them, or who have disconnected them. The ability to edit student portfolios directly. |
| District Administrator | Read-only view of all student portfolios and case manager accounts in their district. Can execute data deletion upon verified request. Can generate case manager invite links. | Student data from other districts. The ability to edit portfolios. Export of individual student PII. |
| Sure Step Director | Aggregate platform metrics only (total students, completion rates, district-level counts). Can provision and deactivate districts. Can view the system audit log. Holds narrowly scoped read access to stored portfolio files, used solely for technical support and data recovery at a district's request (see Section 10). | Individual student portfolio content in the application. Student dashboards, profiles, or any student-identifiable reporting. |
These access controls are enforced at the database level using Row Level Security (RLS) policies. They are not merely application-layer controls — they are enforced by the database itself and cannot be bypassed through the application interface.
A case manager's access to a student's portfolio is always controlled by the student (see Section 19). A student connects a case manager by entering that case manager's email address on their Profile tab and clicking “Connect”; a case manager can also send a student an invite link to create their account. A case manager can never add themselves to a student's portfolio.
A student is connected to one case manager at a time, and the connection is read-only — the case manager can view the portfolio and submit suggestions, but cannot edit it. To change case managers, the student disconnects the current case manager and connects a new one. Disconnecting immediately revokes the case manager's access to the portfolio.
Sure Step Education does not assign, reassign, or remove case managers on a student's or district's behalf. There is no district-administrator approval step for connecting or disconnecting a case manager — the action takes effect when the student performs it.
These are not aspirational commitments — they are operational realities reflected in how the platform is built and how our subprocessor agreements are structured.
TransitionReady handles student education records as defined under the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g). FERPA grants parents and eligible students (those 18 or older, or attending post-secondary institutions) specific rights regarding education records.
Right to inspect and review: Students 18 and older (and parents of students under 18) have the right to inspect and review education records maintained in TransitionReady. Requests should be directed to the student's district administrator or to Sure Step Education at the contact information in Section 15.
Right to request amendment: If a student or parent believes information in TransitionReady is inaccurate or misleading, they may request that Sure Step Education or the district amend the record. We will respond within a reasonable timeframe and, if we decline to amend, inform the requester of their right to a hearing.
Right to request deletion: Students and parents may request deletion of student data from TransitionReady. Deletion requests are processed by the student's district administrator and result in permanent removal of the student's profile, portfolio, and associated data from the platform. Deletion is logged in the audit trail for compliance purposes.
Right to consent to disclosure: We do not disclose student education records to third parties without written consent from the student (if 18+) or parent (if under 18), except as permitted under FERPA's "school official" exception for platform operation, or as required by law.
Sure Step Education's use of TransitionReady complies with California Education Code § 49073.1 (AB 1584) and the Student Online Personal Information Protection Act (SOPIPA, Cal. Bus. & Prof. Code § 22584). These laws establish strong protections for K–12 student data in California and reflect our baseline standard for all users nationwide.
In accordance with these laws, Sure Step Education:
Student data collected through TransitionReady is used only to provide, maintain, improve, and support the educational services offered through TransitionReady. It is not used for any commercial purpose.
Student data is stored in Supabase, a secure cloud database platform hosted on AWS infrastructure in the United States. All data is encrypted at rest and in transit using industry-standard encryption (AES-256 at rest, TLS 1.2+ in transit).
Uploaded files — work samples and supporting documents (letters of recommendation, awards, certifications) — are stored in a private, access-controlled Supabase Storage bucket. Files are never publicly accessible: the bucket exposes no public URLs, and every retrieval is an authenticated request checked against the bucket's per-user access rules before any bytes are returned. Access controls on the file bucket are deliberately stricter than the database: each student can access only the files in their own folder. Case manager and district administrator accounts cannot read student files at all — staff see the titles, descriptions, and skills a student writes about a file, never the file itself. Sure Step Education retains narrowly scoped read access to file storage, used solely for technical support and data recovery (for example, restoring a student's file at a district's request).
Authentication is invite-based: accounts can only be created through single-use, expiring invite links issued by authorized staff, and sign-in uses email and password. Passwords are stored only as salted hashes by our authentication provider (Supabase Auth) — Sure Step Education never sees or stores plaintext passwords. A case manager may issue a temporary password for a student on their caseload who is locked out; students can change their password at any time using the self-service reset flow.
Access controls are enforced at the database level using Row Level Security (RLS) policies, meaning database queries are filtered by role before data is returned — not merely filtered in the application layer after retrieval. The same per-user model is applied to the file storage bucket.
Case manager connections and disconnections, and account-lifecycle events, are recorded with timestamps and the identifiers of the users involved. These records cannot be modified through the application interface and are available for compliance review by district administrators (for their district) and Sure Step Education's director.
In the event of a data breach that affects student data, we will notify affected districts within 72 hours of discovery and cooperate fully with any required notifications under applicable law.
We work with the following third-party subprocessors to operate TransitionReady. Each subprocessor has been evaluated for appropriate data protection terms for education use:
We do not use Google Analytics, Facebook Pixel, or any third-party behavioral tracking or advertising technology.
We retain student data only as long as necessary to provide TransitionReady services or as required by law.
Active accounts: Student portfolio data is retained while the student has an active account and their district has an active contract with Sure Step Education.
Upon district contract end: When a district's contract with Sure Step Education ends, student data associated with that district will be deleted within 60 days unless the district requests a shorter or longer retention period in writing.
Upon deletion request: When a student or parent submits a deletion request, the district administrator will execute the deletion. This permanently removes the student's profile, portfolio content, case manager suggestions, and student assignment records. Deletion is logged in the audit trail. The audit log entry itself is retained for compliance purposes but contains no student PII.
Case manager contact directory: The private post-graduation contact records described in Section 4 are owned by the case manager and are designed to outlive the student account, so they are not automatically removed when the portfolio account is deleted. A student, parent, or district may request deletion of these contact records as well; on such a request the case manager or district administrator will remove them.
Backup retention: Supabase maintains encrypted backups for up to 7 days. Deleted data may persist in backups for up to 7 days before being permanently purged.
TransitionReady uses the Anthropic API to provide two categories of AI-assisted features:
Data minimization: We send only the fields necessary for each feature. For writing polish, we send only the text being checked — never the student's name, school, district, grade, disability status, IEP content, or any surrounding portfolio context. For document generation, we send only the portfolio fields the document requires; the student's name is included only where it must appear in the generated document itself (such as a cover letter heading and signature). We never send school or district identifiers, grade level, disability status, IEP content, or any other special education data to the AI service.
Scope of writing polish: The writing polish feature is constrained by system instructions to correct only spelling, grammar, and punctuation. It is instructed not to change the student's voice, vocabulary, tone, sentence structure, or content. The student's pre-correction text is not retained by Sure Step Education once the student either accepts or rejects the suggestion — only the final portfolio text is stored. A flag is retained on each field indicating whether the student used the polish tool on that field, which case managers may see as a small "AI-polished" badge.
Student control: All AI-assisted features are student-initiated. No correction or generated content is ever applied to a student's portfolio without the student's explicit action. Students retain full control over whether to use, keep, edit, or delete AI-assisted content.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the effective date at the top of this policy and notify active district administrators by email.
Continued use of TransitionReady after the effective date of any update constitutes acceptance of the revised policy. If you have questions about any changes, please contact us at the information below.
For questions about this Privacy Policy, to exercise FERPA rights, to submit a data deletion request, or to request our AB 1584 data privacy agreement, contact:
Designated Responsible Individual for Privacy Compliance
Nicholas Crabtree
nicholas@surestepeducation.com
We respond to privacy inquiries within 45 days.