Privacy Policy

Last Updated: 2026-05-28

ProcNote Inc. (“us”, “we”, or “our”) is committed to the privacy of its students, teachers, staff, and all people who use our services. This Policy details and limits which data that we collect, how it can be used, and what controls you can exercise over it. Your use of ProcNote (“Services”) is subject to this Policy. If you do not agree with any part of this Policy, you must not use the Services.

This policy may change from time to time to reflect the needs of our users and growth of the product. If material changes are made, including expanding the types of data collected or the uses of data collected), we will revise the “Last Updated” date at the top of the Policy. All changes to this Policy are effective when they are posted to this page. If you do not agree with the updated Policy, you must cease using our services. Educational providers who have contracted our services will be notified of all material changes to this Policy; any limitations to changes in this Policy outlined in the specific contract will be followed.

ProcNote Privacy Pledge: We pledge to never sell data, amass marketing profiles, or contribute student generated data to AI model training in any form.

1. Educational Use

Educational providers such as schools and districts generally contract with ProcNote to provide our services to their students and teachers. Schools and districts are responsible for having or obtaining consent as may be required by law to permit use of our services and to how we collect, use, and protect information collected. Contracts with schools and districts may further limit which data we collect and how it can be used. If you were given access to our services by a school or district, you may reach out to them to inquire with either us or them if you have questions.

When we receive student personal information from a school or district, we treat that information as an educational record under the Family Educational Rights and Privacy Act (FERPA). In this capacity, ProcNote operates as a "school official" under the FERPA school official exception (34 CFR § 99.31(a)(1)(i)(B)) under the direct control of the school or district with respect to the use and maintenance of student records.

2. What Information We Collect

The following information we collect from students to provide our services:

Full Name, email address, and account profile picture from a provided Google Login (if configured by your school or district to provide this via SSO).
Affiliation with school and/or district and grade level.
Student-generated written content authored on-platform.
Course enrollment & coursework participation levels on-platform.
Grades associated with work on-platform.
User-controlled display and accessibility preferences (such as contrast settings, text sizing, and custom font styles).
Essential, non-tracking first-party cookies used to store authorization information necessary to use the platform and to store accessibility preferences. These cookies are not used for cross-site tracking or retargeting.
District-issued student identifier (if configured or synchronized by your school or district via integration)

The following information is collected from teachers and administrators to provide our services:

Full Name, email address, and account profile picture from a provided Google Login (if configured by your school or district to provide this via SSO).
Affiliation with school and/or district.
Classes that you create or are attached to.
Grades and student feedback that you provide on-platform.
User-controlled display and accessibility preferences (such as contrast settings, text sizing, and custom font styles).
Assignments that you create and resources you upload.
Essential, non-tracking first-party cookies used to store authorization information necessary to use the platform and to store accessibility preferences. These cookies are not used for cross-site tracking or retargeting.

The following information is collected from all users for the expressly limited purpose of operational monitoring, ensuring security and privacy policy compliance, and to help internally understand usage patterns to improve the software:

Occurrences of bugs, unhandled errors, or operational failures.
Service usage information (which pages are visited, which buttons clicked, etc.)
IP addresses and device information (type of device, operating system, browser type)

The following information may be collected from visitors to our public-facing landing pages at procnote.com by authorized third-party web analytics providers:

Pages visited, session duration, and navigation paths.
General device type, browser, operating system, and geographic region.
Anonymized referral source.

This analytics collection applies exclusively to publicly accessible pages that do not require authentication and does not extend to any authenticated application surface or to any data associated with a ProcNote account. Analytics providers used for this purpose are listed in Section 4.

This list constitutes a complete and exhaustive disclosure of all data elements collected by ProcNote for regulatory compliance purposes.

Any other sensitive personally identifiable information (PII) of teachers and administrators, if inadvertently collected, is treated with the same strict security, non-disclosure, and retention standards as student data.

3. How Information is Used On Platform

Students:

Your writing is your data. You may freely export your content at any time by any means, including tools provided by our services.
Your writing is made accessible on-platform in certain ways, and you authorize us to do so, as detailed and limited in this Policy, to those we reasonably believe have access – by being a teacher of a class you are creating work for, and by administrators of your school or district.
- Your written content is accessible on-platform by teachers attached to the classes you are writing content for, and by administrators of your school or district.
- Your written content may be exported off-platform by teachers attached to the classes you are writing content for, and by administrators of your school or district.
Your full name, email address, grade level, and account profile picture (if configured by your school or district to provide this via SSO) are visible to teachers attached to classes you have joined, and to administrators of your school or district.
Your course enrollment & coursework participation levels on-platform are visible per classroom for teachers attached to those courses, and by administrators of your school or district.
Display and accessibility preferences may be visible to teachers and administrators to help support the student's visual needs in the classroom.

Teachers:

Your full name, email address, and account profile picture (if configured by your school or district to provide this via SSO) are visible to students attached to classes you are attached to, and to administrators of your school or district.
Your assignments and their resources are visible to teachers attached to classes the assignments are linked to, by students you have assigned the assignment to, and to administrators of your school or district.
Written feedback and grading information is visible to teachers attached to classes the work was written for, the students you are providing feedback and grading to, and by administrators of your school or district.

Administrators:

Your full name, email address, and account profile picture (if configured by your school or district to provide this via SSO) are visible to fellow administrators of your school or district.

4. How Information Leaves the Platform

Students may export their own writing at any time for any purpose by any means, including by tools that our services provide.
We never publish student-generated content or data publicly nor provide direct tools for students to do so directly on-platform.
Teachers and administrators may export students' writing that they have access to (see “How Information is Used On Platform”) for educational or grading purposes.
Occurrences of bugs, unhandled errors, or operational failures may be anonymized and recorded to authorized US-based third party providers of observability and operations monitoring products, including Sentry (https://sentry.io/) and PagerDuty (https://www.pagerduty.com) in order to provide improved service reliability. We take all reasonable steps to ensure that these third party providers are capable of maintaining the confidentiality and security of data we provide to it and that their written policies constitute assurances to that effect.
Anonymized analytics data from visitors to our public-facing, signed-out landing pages at procnote.com may be shared with authorized third-party web analytics providers, including Google Analytics (https://analytics.google.com/), Google Tag Manager (https://tagmanager.google.com/), and Google Ads (https://ads.google.com/). This data is expressly limited to unauthenticated public pages and is not commingled with any application data, educational records, or information from signed-in users.
We may from time to time use anonymized and aggregated data to create reports of public good and interest for free public use by educational providers, institutions, and/or the general public.

5. Security and Protection of Your Information

We take the security of personal information seriously and implement industry-standard measures to protect against unauthorized access, disclosure, or misuse of data consistent with applicable law.

We adhere to the NIST Cybersecurity Framework. Our measures include encryption, secure data transmission, access controls, regular monitoring of our systems, and regular security and vulnerability audits.

As a cloud-native solution, ProcNote utilizes Amazon Web Services as our principal hosting provider with resources located exclusively in the United States. All sensitive data is protected with strong encryption at rest, using industry-accepted algorithms like AES-256. All sensitive data is transferred using encryption in transit.

All ProcNote employees who will have direct contact with students, including via support channels or other means, are required to pass criminal background checks.

In the unlikely event of a data breach, ProcNote will notify affected parties without unreasonable delay, and in no event later than 72 hours after confirmation of the incident. Such notices will include any applicable remedial information as is known at the time and follow-ups may further develop that information.

While we strive to protect all personal information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we follow best practices to minimize risk.

6. Retention of Your Information

We retain information only as long as necessary to provide our services to the school or district or as required by law.

Students: Within 60 days of the end of each school year (to allow schools and districts an export window), or earlier upon the request of the school or district, we delete all personal information related to students including all student-generated content. Anonymous data and aggregated data that cannot be traced back may persist indefinitely.

Teachers, Administrators: If your account is deleted, assignment prompts, resources, and classes that no other users have access to are also deleted. Assignment prompts, resources, and classes accessible by other active users are retained to continue providing our services to those users.

All data deletion requests are honored within 60 days of request.

This section constitutes our written data retention policy, establishing the purposes for data collection and a definitive timeframe for deletion of student information, as required by law.

7. Other Provisions

Marketing and Advertising. We do not display advertisements on our services.
Automated Decision Making. We do not use any personal information for automated decision-making in our services, including profiling, in a way that produces legal effects concerning an individual or significantly affecting an individual.
Global Privacy Control (GPC) preferences. ProcNote reacts to a Global Privacy Control (GPC) signal by storing an opt-out preference for logged in users and skipping first-party capture and storage of non-essential service usage information while the signal is present. On public-facing, signed-out landing pages, a GPC signal will also suppress third-party analytics collection.
Children Under 13. We do not permit children under 13 to create an account and do not knowingly collect information from a child under 13 unless the child is provided access to our services by the child’s school or authorized legal guardian for use in an educational setting as provided by FERPA, COPPA, and, when applicable, by state law.
Legal Compliance. We may disclose information to comply with applicable laws, regulations, legal processes, or government requests, or to enforce our terms and agreements, protect the security of our platform, or prevent fraud or harm. If we receive a subpoena or other legal order to disclose information we will endeavor to provide notice of the request to you prior to disclosure, if such notice is permitted by applicable law.
Merged, Acquisition, or Change of Control. In the event of a Change of Control event, such as a merger, acquisition, or transfer of assets, the receiving entity would be obligated to follow this Policy or delete data it is unwilling or unable to protect with this Policy.
New York Education Law § 2-d Compliance. For contracts in New York, we agree to comply with New York Education Law § 2-d, including incorporating the state-mandated 'Parents' Bill of Rights for Data Privacy and Security' into the applicable Data Protection Agreement.
No Special Education Records. ProcNote does not collect, request, or store formal special education plans, IEPs, 504 plans, or student health/disability records.

8. Your Data Rights

All requests to inspect, correct, export, or erase data should be directed to the student’s school or district, which will work with ProcNote to fulfill the request.

Right to Inspection and Correction. Parents, guardians, and eligible students have the right to inspect and review educational records and request corrections to inaccurate records.
Right to Export. Students have the right to export all of their data on-platform in a machine-readable format.
Right to Erasure. Students have the right to request erasure of their data.

ProcNote will maintain a record of all disclosures of personal information and will provide this record to the school or district upon request to ensure the school can comply with its own FERPA recordkeeping obligations.

9. Contact Information

If you have any questions or concerns about this Privacy Policy or how we handle personal information, please contact us at: privacy@procnote.com