Parent Portal Privacy Policy

1. Information about you

• Contact details — name and email address, used to sign in and to send notifications, plus phone number and home address if you add them on the Your Info page, used by the office for anything that isn't a photograph or a notice.
• Sign-in records — which method you used to sign in (passkey, email link, or a Google/Microsoft/Facebook account), and routine security records of sign-in activity.
• Notification preferences — which kinds of notices you've chosen to receive, and, if you turn on push notifications, a subscription identifier issued by your browser for that purpose.
• Download and print activity — a record that a specific photograph was downloaded or sent to a print provider through your account, kept as an audit trail. We do not log ordinary page views inside the portal.

2. Information about your child

• Photographs taken at school and approved by staff for the portal, filed under the event or day they were taken.
• An enrolment photograph, used to help staff, and an automated matching service described next, recognize your child in newly uploaded photographs. It is never published or made public.
• Biometric face-matching data. This is a mathematical representation of your child's enrolment photograph, sent to our face-recognition provider (Amazon Rekognition) solely to build staff a suggestion list — nothing more. A suggestion is never automatic: it is an unticked checkbox a staff member reviews and confirms by hand before any photograph is associated with your child, the same as every other photo tagging decision at the school. Because it never does more than that, this is turned on by default for every enrolled child rather than asked of each family individually — it is not part of the enrollment agreement's broader release described above, and is entirely separate from it. You can turn it off for your child at any time from the portal or by asking the school, and turning it off deletes the biometric data held about your child, both here and at Amazon.
• Consent and sharing settings — whether photographs your child appears in with other families' children may be downloaded or printed by those other families.

3. How this information is used

To show you your own child's approved photographs, the school calendar and announcements, to notify you about new activity if you've chosen to be notified, and to fulfill a download or a print order you request. Face-matching data, unless you've turned it off, is used only to suggest — never to decide — which photographs might include your child.

4. Who can see what

You can see photographs your own child appears in, and the names of only your own children tagged in a group photograph — never which other families' children are also in it. A photograph is never visible to any parent until a staff member has approved it.

5. Photographs leaving the portal

A photograph you download from the portal is the same file the school holds — it is not separately marked the way a photograph published to the public gallery is. Downloading a photograph that includes another family's child is only available where that family has agreed to it, described further in the Terms of Service. The original file, including any location data it was taken with, is never provided to you or to a print provider — only a copy with that information removed.

6. Third parties involved

The portal is built on infrastructure provided by DigitalOcean (hosting, database, and photo storage), Clerk (sign-in), Resend (email delivery), and, only if you have opted your child into face matching, Amazon Web Services (Rekognition). Each processes information solely to provide their part of the portal to the school — none of them uses it for their own separate purposes, and photographs sent for face matching go as image data only, never with your child's name attached.

7. How long we keep this

Photographs and records are kept for as long as needed for the purposes above, including after a child leaves the school — a photograph does not lose the day it was taken because a family's enrollment ended. Biometric face-matching data is the exception: it is deleted immediately when you withdraw consent, whether or not your child is still enrolled.

8. Your choices

You can turn face-matching consent, and consent for other families to download photographs your child appears in, on or off at any time. You can turn routine notifications on or off. You can delete your own account — name, email, and sign-in — at any time from /portal/account, and it happens immediately rather than as a request someone has to act on. Deleting your account does not delete your child's own photographs or school records; it removes you as a guardian able to see them, the same as if staff had removed the link. To correct information, or ask what is held about your family, contact the office; to have a specific published photograph taken down without deleting anything else, use /report.

9. Changes to this policy

We may update this policy from time to time. The effective date above reflects the most recent revision.

10. Contact

Hillwood Academic Day School, 2521 Scott Street, San Francisco, CA 94115 — [email protected] — (415) 931-0400.