Privacy Policy

IEP SmartGoals ("the Platform") is provided by Codematrix Technologies LLC ("we", "us") to school districts, schools, and educators for managing Individualized Education Program (IEP) goals and student progress data. This policy explains what information the Platform collects, how it is used, and how it is protected — including for student personally identifiable information ("Student PII") covered by FERPA (the Family Educational Rights and Privacy Act).

The Platform is engaged by school districts as a "school official" with a legitimate educational interest, consistent with the FERPA school-official exception. The district (not Codematrix Technologies) is the owner of all student records entered into the Platform. We process Student PII only as directed by the district, only for the purpose of providing the Platform's IEP goal-tracking functionality, and we do not sell, rent, or use Student PII for advertising.

• Student records: name, date of birth, student ID, disability category, IEP goals, and progress data entered by teachers.
• Educator accounts: name, school email, role, and school/district assignment.
• Usage and security logs: sign-in activity, IP address, and an audit trail of actions taken in the Platform, kept for accountability and security investigation purposes.

• To provide the core Platform functionality — creating, tracking, and reporting on IEP goals.
• To generate progress reports for IEP meetings, parent conferences, and compliance documentation, at the direction of the district's staff.
• To maintain account security (sign-in verification, failed-login lockouts, activity auditing).
• To respond to support requests submitted through the Platform's contact form.

• Encryption in transit (HTTPS/TLS) for all traffic to and from the Platform.
• Server-side encryption at rest (AES-256) for the most sensitive Student PII fields (name, date of birth, disability category).
• Role-based access control so a user only sees records within their authorized scope (teacher → assigned students, district admin → their district, etc).
• Server-verified CAPTCHA and per-account lockout on sign-in to deter automated and credential-stuffing attacks, in addition to IP-based rate limiting.
• An audit-minded activity log recording who accessed or changed what, and when.
• Scheduled, tested database backups with a defined retention period.

Student and staff records are archived (soft-deleted) rather than immediately purged when removed from active use, so that historical goal and progress data used for compliance remains intact and auditable. A district may request permanent deletion or a full export of its data at any time, including upon ending use of the Platform.

The district that owns the data may, at any time: request a full export of its student and staff data; request correction of inaccurate records; and request permanent deletion of records no longer required to be retained by applicable law or district policy.

Questions about this policy or a district's data can be sent to support@iepsmartgoals.com.