Privacy Policy

RollWise is provided to colleges and universities ("Institutions"), not to individuals. When you use the Service, your Institution decides why and how RollWise is used and remains in control of the information processed in it. We process that information on the Institution's behalf and under our agreement with it.

For Institutions subject to the Family Educational Rights and Privacy Act ("FERPA"), we act as a "school official" with a legitimate educational interest: we use education records only to provide the Service to the Institution, we do not disclose them except as described in this policy or as permitted by the Institution, and the Institution retains control of them. Where state privacy laws apply, we act as a service provider or processor for the Institution.

If you are a student, instructor or staff member, your Institution's own privacy notices also apply to you, and your Institution is the first point of contact for questions about your information (see section 9).

We collect only the information needed to provide the Service and operate the Website. The categories below describe that information in general terms.

Information provided by your Institution or its LMS. When you open RollWise from a course, and when the Service synchronises with the Institution's LMS, we receive account and profile information such as your name, email address, user identifiers assigned by the LMS or the Institution's student information system, and your role in the course. We also receive course, section, enrollment and roster information needed to run the Service for that course.

Attendance and participation information. The Service records attendance and participation information for class sessions, including records created by instructors and, where the Institution enables it, records created when students check in themselves. The Service may also display course activity information made available by the LMS.

Information you provide. We collect information that users choose to enter into the Service, such as notes, comments and other content entered by instructors or students, and information Institution staff provide when setting up and managing their accounts.

Communications. We keep records of emails and other notifications the Service sends on the Institution's behalf, and of correspondence you have with us, for example support requests.

Technical and usage information. Like most online services, our systems automatically record technical information needed to operate, secure and troubleshoot the Service, which may include IP address, browser and device type, and the date and time of requests.

Website contact form. If you contact us through the Website, we receive the details you submit, such as your name, email address, institution, role and message.

Information we do not collect. We do not collect Social Security numbers, payment card numbers or bank account details. The Service does not collect precise geolocation.

We use personal information only to:

• provide, maintain and support the Service for your Institution, including recording and reporting attendance and participation and, where the Institution or instructor enables it, sending related notifications and updating the Institution's LMS;
• respond to inquiries and provide customer support;
• keep the Service secure, prevent misuse, and diagnose and fix problems;
• comply with legal obligations and enforce our agreements; and
• develop and improve the Service using aggregated or de-identified information that does not identify any individual.

We do not sell personal information. We do not use it for advertising, and we do not share it with third parties for their own marketing. We do not currently use artificial-intelligence or machine-learning services to process personal information; if that changes, we will update this policy before doing so.

We share personal information only in the following circumstances:

• With your Institution. Information in the Service is available to your Institution and to the instructors and staff it authorises, according to their roles and the Institution's own policies. Depending on the features the Institution or instructor enables, some information is also sent back to the Institution's LMS.
• With service providers. We use a small number of third-party providers to host and deliver the Service and Website. Each is permitted to process personal information only to provide its services to us and is bound by contractual confidentiality and security obligations. Our current providers are:

  Provider	Purpose	Location
  Amazon Web Services (including Amazon Simple Email Service)	Cloud hosting, storage and email delivery	United States
  Vercel	Hosting of the Service's web applications and the Website	United States
  Formspree	Delivery of Website contact-form submissions	United States

  We will update this list if our providers change.

• For legal reasons. We may disclose information when we believe in good faith that it is required by law, subpoena or other legal process, or is necessary to protect the rights, safety or property of RollWise, our users or others. Where the law allows, we will notify the affected Institution before responding.
• In a business transfer. If RollWise is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to this policy and our agreements with Institutions.

The Service and the Website use only the cookies and browser storage that are strictly necessary to work, for example to keep you signed in and to protect against forged requests. We do not use analytics, advertising or tracking cookies, and we do not track users across third-party websites. Because we do not track you, we do not respond to "Do Not Track" browser signals.

We maintain administrative, technical and physical safeguards designed to protect personal information against unauthorised access, use or disclosure. These include encryption of data in transit and at rest, logical separation of each Institution's data, and limiting access to personnel who need it to operate, secure or support the Service.

No method of transmission or storage is completely secure. If we become aware of a security incident affecting an Institution's personal information, we will notify the Institution without undue delay and as required by applicable law and our agreement with it.

We retain personal information for as long as needed to provide the Service to the Institution and as required by our agreement with it. When an Institution's agreement ends, or at any time on the Institution's written request, we delete the Institution's data within 60 days, except where we are required by law to retain it. Backups and system logs are retained for a limited period and then removed automatically.

We may retain aggregated or de-identified information that does not identify any individual.

We store and process personal information in the United States. If you access the Service or the Website from outside the United States, your information will be transferred to, stored and processed in the United States, where privacy laws may differ from those of your country.

Because we process personal information on behalf of your Institution, students, instructors and staff should direct requests to access, correct or delete their information to their Institution, which can act on the request directly or instruct us to. We will assist Institutions in responding to such requests. If you contact us directly, we may refer your request to your Institution.

Depending on where you live, you may have additional rights under applicable privacy law. We honour those rights as required, in coordination with your Institution.

Emails and notifications sent by the Service are configured by your instructor or Institution; to change them, please contact your instructor or Institution.

The Service is designed for colleges and universities and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Where an Institution enrols students under 18, the Institution is responsible for obtaining any consent required by its policies or applicable law. If you believe we have collected information from a child under 13, please contact us and we will delete it.

The Service operates inside your Institution's LMS and may link to other services your Institution uses. Those services are governed by their own privacy policies, not this one. We are not responsible for the privacy practices of your Institution's LMS or of any third-party site.

We may update this policy from time to time. If we make material changes, we will update the effective date above and notify Institutions before the changes take effect.

If you have questions about this policy or our privacy practices, email us at privacy@rollwiseapp.com or use the contact form on our website. Students, instructors and staff may also contact their Institution.