Owl Train runs sign-ups, payments, forms and check-in for schools. The records about students and families belong to the school, and we handle them only to provide the service the school uses. We don’t sell personal information, we don’t advertise to students or parents, and we don’t build profiles of students for anything other than school purposes.
Overview
Owl Train (“Owl Train,” “we,” “us” or “our”) provides school activity software: sign-ups and waitlists, payments, permission slips and forms, check-in and drop-in care, announcements, a parent portal, reports and exports, and school branding. This policy covers the Owl Train app at app.owltrain.com, including each school’s parent pages, and the owltrain.com website (together, the “Service”). Owl Train is a Ball Vision platform.
This policy explains what information we handle, why, who can see it and the choices you have. Because the Service keeps records about students, most of what follows is about how we protect them on the school’s behalf.
Who this policy covers
Owl Train serves four groups of people:
- Schools and their staff, who hold accounts to run a school’s programs: owners, admins, managers, coordinators and viewers.
- Parents and guardians, who claim a family account from their school’s invite link, sign their children up, sign permission slips and forms, and pay.
- Students, who don’t hold Owl Train accounts. Their records are added and kept by their school and their parents.
- Visitors to owltrain.com, including people who write to us about starting a school.
For a school’s records (its families, students, sign-ups, forms, attendance and payments), the school is in control and Owl Train handles that information on the school’s behalf and under its direction. For our own website, the contact details of the people who run a school’s account, and the way the Service itself runs, Owl Train is responsible.
Student records belong to the school
When a school uses Owl Train, the school owns and controls the student and family records it keeps in the Service. The school decides what to collect, which of its staff can see it, and how long to keep it. We use those records only to provide the Service to that school.
Where the Family Educational Rights and Privacy Act (FERPA) applies to a school, Owl Train acts as a “school official” with a “legitimate educational interest” in the records we hold for it. We work under the school’s direct control with respect to the use and maintenance of those records, use them only for the purposes the school has authorized, and don’t disclose them to anyone else except as the school directs or the law requires.
Inside a school, access follows the levels the school assigns, and coordinators can be limited to their own programs. Every staff action is recorded in the school’s audit log with who did it and when.
Owl Train’s own team opens a school’s account only to review and approve the school, provide support the school asks for, fix a problem, or comply with the law. Anything we do inside a school’s account is recorded in that school’s audit log under the name of the person who did it.
Information we collect
We handle information the school enters, information parents enter, information created as the Service is used, and limited technical data.
School and staff accounts
- The school’s name and settings, such as the school year, grades served, homerooms, program types and the school’s own terms (for example, what it calls a permission slip)
- Names, email addresses and roles of the staff a school invites
- The details a school needs to connect its PaidYET merchant account for payments
- Messages you send us
Family and student records
- Parent and guardian names, email addresses and phone numbers
- Student names, grades and homerooms
- Allergy and medical notes the school or a parent chooses to add, so the right staff see them
Sign-ups, forms and attendance
- Program sign-ups, waitlist places and donations
- Answers to the questions a school asks at sign-up, such as sizes, physician contacts or pickup lists
- Signed permission slips and school forms, such as emergency cards, media releases and handbook acknowledgments, with the name of the person who signed and the time they signed; forms the office enters from paper
- Check-in and check-out times, and drop-in days
Billing and payment records
- Charges, payments, credits, refunds, balances and statements
- Limited payment details, such as amount, date, status, method, card brand and the last four digits of a card or bank account, and the name on a bank account (see Payments)
- A record that a parent authorized each bank payment
Messages
- Announcements and reminders a school sends through Owl Train, who they went to, and each parent’s email preference
Technical data
- Server logs, which may include IP address, browser type, the pages requested and the time
- Sign-in codes and invite links, which are single-use and expire
The owltrain.com website doesn’t collect anything itself. Its contact form opens your own email app, so we receive only what you choose to send.
How we use it
We use information to provide the Service to schools and families, under each school’s direction. Specifically, we use it to:
- Sign people in with an emailed code or a one-tap invite link (Owl Train has no passwords)
- Run sign-ups, waitlists, the family cart, forms, readiness and check-in
- Process payments through PaidYET and keep each family’s ledger and balance
- Send the emails the Service depends on, such as sign-in codes, invites, receipts to each guardian, waitlist updates, form reminders and notices about returned bank payments
- Send a school’s announcements to the families it chooses
- Produce the reports and exports a school asks for
- Answer support requests
- Keep the Service secure, and detect and prevent fraud and misuse
- Meet our legal, tax and regulatory obligations
We may use aggregated, de-identified information, such as how often a feature is used, to keep the Service reliable and make it better. It can’t be used to identify a student, a family or a school.
What we never do with student data
- We don’t sell, rent or trade personal information about students or families.
- We don’t show advertising in the Service, and we don’t use student or family information to target advertising to students or parents, anywhere.
- We don’t build profiles of students for any purpose other than the school purposes the school directs.
- We don’t use student records to market our own or anyone else’s products.
These commitments stay with the records. If Owl Train is ever part of a merger or sale, any new owner must keep them for the student information it receives.
Children’s privacy
Owl Train accounts are for adults: school staff and parents or guardians. The Service isn’t directed to children, and we don’t knowingly collect personal information directly from children under 13.
Information about children comes from their school (for example, a roster import or office entry) or from their parent or guardian in the parent portal. Where the Children’s Online Privacy Protection Act (COPPA) applies, a school may give consent on parents’ behalf for Owl Train to handle children’s information for the school’s own educational purposes, and we use it only for those purposes. Parents can ask their school what is kept about their child.
If you believe a child under 13 gave us personal information directly, or that a child’s information was added without the consent the law requires, email us at [email protected]. We’ll work with the school to delete it.
Reviewing and correcting records
Parents and guardians can see their family’s information in the parent portal, including their students, sign-ups, signed slips and forms, balance and payment history.
To review a record, correct something that’s wrong, or ask for something to be removed, contact your school. The school controls the records and can make the change in Owl Train. Where FERPA applies, parents (and students once they turn 18) have the right to inspect education records and ask for corrections, and those requests go through the school.
If you contact us instead, we’ll pass your request to your school and help the school answer it.
Email from Owl Train and your school
Sign-in codes, invites, receipts, waitlist updates, reminders about forms and balances, and notices about your account are always sent, because they’re part of how the Service works.
Schools can also send announcements to families. You can unsubscribe from announcements with the link in any announcement email. Owl Train doesn’t send text messages.
Payments
Card and bank (ACH) payments run through our payment partner, PaidYET, to the school’s own merchant account. Owl Train never holds the money; payments settle to the school.
Card numbers are entered into PaidYET’s payment form and never reach Owl Train’s servers. Bank account and routing numbers pass through our server once, only to be exchanged with PaidYET for a token, and are never stored. A saved card or bank account is kept as a PaidYET token, and schools never see full numbers.
We keep limited payment details, such as amount, date, status, method, card brand and last four digits, so schools can reconcile deposits, issue refunds and run reports. If a school turns on its optional tech platform fee, the amount is shown to the parent before paying a card payment and recorded separately. PaidYET also handles payment information under its own privacy policy.
Retention, return and deletion
We keep a school’s records while the school uses Owl Train. Signed slips and forms are kept with their timestamps for as long as the school’s account is open, because schools often need to show them later.
A school can download a full export of its records at any time: families, students, programs, sign-ups, waitlists, the ledger, payments, attendance, form responses, announcements, its team and its audit log.
When a school closes its account or its use of Owl Train ends, we give the school its records through that export on request, then delete or de-identify the school’s personal information within 90 days, except where the law requires us to keep something longer, such as payment records for tax purposes. Copies in backups are deleted on our backup schedule and are never restored for any other purpose. A school can also ask us to delete specific records sooner.
Security
We protect information with encrypted connections (HTTPS) everywhere, sign-in by one-time emailed codes and single-use invite links instead of passwords, separation of each school’s data so one school can never see another’s, role-based access inside each school, and an append-only audit log. Card and bank numbers are tokenized by PaidYET.
No method of sending or storing data is completely secure, so we can’t promise absolute security. If we learn that a school’s records were accessed without authorization, we’ll tell the school promptly and help it notify families as the law requires. If you think your account has been compromised, contact us right away at [email protected].
Your privacy rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Correct information that’s inaccurate or incomplete
- Delete your personal information, subject to legal exceptions
- Get a copy of your data in a portable format
- Object to or restrict certain processing
Residents of California and other states with privacy laws have these rights under those laws. We don’t sell personal information or share it for cross-context behavioral advertising, for anyone.
To exercise any of these rights, email [email protected]. We’ll respond within 30 days and may need to confirm your identity first. If your request is about records a school controls, we’ll pass it to that school or act on its instructions.
Changes to this policy
We may update this policy from time to time. If we make material changes, we’ll tell schools by email or in the Service at least 14 days before they take effect, and update the date at the top of this page. We won’t use student information we already hold in a materially different way without first telling the school and giving it the chance to say no.
Contact us
Questions, concerns or requests about this policy or how we handle information:
Email: [email protected]
Web: owltrain.com
We aim to respond to privacy questions within five business days.