Privacy Policy

Better Answers Inc. ("Better Answers", "we", "us") operates the Better Answers assessment platform at betteranswersinc.com. For student records, the school or district is the data owner and we act as a school official with a legitimate educational interest under FERPA (34 CFR § 99.31(a)(1)), and as a service provider / processor under applicable state student-privacy laws.

• Staff account data: name, email, password hash, phone (optional), profile photo (optional), role assignments, multi-factor enrollment, and trusted-device records.
• Student records entered by school staff: student name, grade, class or caseload assignment, accommodations, optional demographic fields used for norming, IEP goal titles and compliance dates, and evaluator notes.
• Assessment data: test sessions, item responses, timing, scores, domain results, proctor notes, and generated or teacher-edited reports.
• Parent/guardian data: name and email supplied by the school for invites and report sharing, plus the student links a school grants.
• Operational logs: authentication events, access-log entries for record views, error reports, and email delivery status.

We do not collect student data directly from students beyond their responses during a proctored session, and we do not require student email accounts.

• To deliver assessments, score them, and produce reports for authorized staff.
• To share reports with parents/guardians when an evaluator or administrator chooses to.
• To authenticate users, enforce role-based access, and maintain audit trails.
• To send transactional email (invites, report notifications, IEP reminders).
• To keep the service secure, debug problems, and support school staff.

We do not sell student data, use it for targeted advertising, or build commercial profiles of students. We do not use student personally identifiable information to train third-party AI models.

When an evaluator clicks "Generate Report", the platform sends the student's numeric domain scores, session counts, date range, accommodations, and IEP goal titles to an AI model through our server so it can draft observation language. Output is always a draft that the evaluator reviews and edits before saving or sharing. The AI provider is contractually barred from training on this content, and no report is auto-published.

• Supabase / cloud hosting — database, authentication, and file storage in the United States.
• Email delivery provider — sends transactional mail from notify.betteranswersinc.com.
• AI model provider — processes the report-drafting request described above.

Each sub-processor is bound by contract to confidentiality, security, and use limits consistent with this policy. Schools can request the current sub-processor list at any time by emailing us.

• Encryption in transit (TLS) and at rest for stored records.
• Row-level database policies so users only reach records their role permits.
• Mandatory multi-factor authentication for staff accounts.
• Idle session timeout and revocable trusted devices (30-day maximum).
• Audit logging of record access, sharing, and administrative changes.
• Expiring, single-purpose tokens for iPad kiosk test launches.

No system is perfectly secure. If we become aware of a breach affecting student data, we will notify the affected school without unreasonable delay and cooperate with its notification obligations.

FERPA does not set a fixed retention period; retention schedules are set by the school, district, or state records law. We therefore retain student records as directed by the school for as long as its account is active. A school may request export or deletion of its records at any time, and we will complete the request within 30 days. After an account is terminated, we keep records for 90 days so the school can export them, then delete or de-identify them unless the school directs otherwise or law requires longer retention. Backups age out on a rolling schedule.

Parents and eligible students exercise FERPA rights — inspection, review, and requests to amend records — through the school, not through us. If a request reaches us directly, we refer it to the school and assist the school in fulfilling it. See our Student Data Privacy & FERPA page for the full process.

We use only cookies and local storage that are necessary to keep you signed in, remember a trusted device, and maintain security. We do not run advertising trackers or third-party behavioral analytics on student-facing screens.

Accounts are created by school staff, not by children. Where a school enrolls students under 13, the school provides consent on behalf of parents as permitted under COPPA for school-authorized educational services, and we use the data only for those educational purposes.

We will post any material change here and update the "last updated" date. For changes that materially affect how student data is handled, we will notify school administrators by email before the change takes effect.