Orchard Privacy Policy for Schools and Districts

Effective date: August 7, 2026 · Last updated: August 7, 2026

1. About this Policy

This Privacy Policy for Schools and Districts (this “School Privacy Policy“) describes how Orchard Careers Inc (“Orchard,” “we,” “us,” or “our“) collects, uses, discloses, protects, retains, and deletes personal information when the Orchard platform (the “Services“) is made available to students and staff by a school, school district, or other educational institution or agency (each, a “School“).

This School Privacy Policy applies to:

Students who access the Services through an account created, provisioned, sponsored, or authorized by a School;
School personnel — teachers, counselors, administrators, and other staff — who access the Services in their institutional capacity; and
Personal information about students that a School provides to us, or that is generated through student use of the Services.

This School Privacy Policy controls. Where a person accesses the Services through a School, this School Privacy Policy governs in place of Orchard’s general Privacy Policy. If there is a conflict between the two, this School Privacy Policy prevails as to School-provisioned users and student data.

A signed agreement controls over this Policy. If Orchard and a School have entered into a written services agreement, student data privacy agreement (“DPA“), or an addendum such as the SDPC National Data Privacy Agreement (NDPA), the terms of that signed instrument control over this School Privacy Policy to the extent of any conflict.

2. Our Role: The School Owns the Data

Orchard does not own student data. We process it on the School’s behalf and at the School’s direction.

The School is the owner and controller of Student Data. Orchard acts as a processor, service provider, and — where the School so designates us — a “school official” with a legitimate educational interest under FERPA (34 C.F.R. § 99.31(a)(1)(i)(B)).
Student Data provided to us by a School, or generated by students using the Services, is and remains the property of, and under the control of, the School.
We use Student Data solely to provide, maintain, support, and improve the Services for that School, and for no other purpose, except as this Policy expressly states or the School directs in writing.
We are under the direct control of the School with respect to the use and maintenance of education records.
We will not redisclose Student Data to any third party except as permitted by FERPA, as directed by the School, as described in Section 7 (Service Providers), or as required by law.

3. Information We Collect

3.1 Information the School provides

Depending on the School’s configuration and provisioning method, we may receive:

Student name and, where the School provides it, a student identifier
School-issued email address or username
Grade level and expected graduation year
School, building, and (where applicable) class or section assignment
Teacher, counselor, and administrator names, titles, school email addresses, and role assignments

Limits on rostering. Orchard does not currently support rostering that pulls or synchronizes academic record information such as student grades, transcripts, GPA, course marks, attendance, discipline records, or special education records. Our provisioning is limited to identity and enrollment information necessary to create and organize accounts. Schools should not transmit academic record data to Orchard.

We ask Schools to send us the minimum data necessary to operate the Services. We do not require, and ask Schools not to send, Social Security numbers, home addresses, health or disability records, disciplinary records, free/reduced-lunch status, immigration status, or other sensitive records not needed to deliver the Services.

3.2 Information students and staff generate in the Services

Career explorations, saved careers, and comparisons
Growth Assessment responses and resulting Career Readiness Index (CRI) scores
Student action plans and their contents
Post-secondary/college searches and saved results
Conversations with Orchie, Orchard’s scoped AI career companion
Lesson and assignment activity

3.3 Information collected automatically

Log and usage data: sessions, session duration, timestamps, features used, pages viewed, and actions taken
Technical data: IP address, browser type and version, operating system, device type, and general (city/region-level) location inferred from IP address for security and fraud-prevention purposes
Error and diagnostic data

3.4 What we do not collect from School users

For users accessing the Services through a School, we do not:

Collect precise geolocation (GPS) data
Collect biometric information
Offer or use consumer social-media login (for example, Facebook or X)
Collect payment card or financial account information from students or parents
Build advertising profiles or track students across unaffiliated third-party websites or apps
Knowingly collect information that a School has not authorized

4. How We Use Information

We use personal information collected through the Services solely for the following educational purposes:

To create, provision, authenticate, and maintain student and staff accounts
To deliver the Services’ core functionality — career exploration, the Growth Assessment and CRI, action plans, college search, lessons, and the Orchie AI career companion
To generate participation, engagement, and readiness reporting for authorized School personnel
To provide technical support and respond to requests from the School
To maintain the security, integrity, and availability of the Services, and to detect and prevent fraud, abuse, and unauthorized access
To diagnose and fix technical problems
To comply with legal obligations
To improve and develop the Services, as described and limited in Section 5

5. Our Commitments Regarding Student Data

Orchard makes the following binding commitments with respect to Student Data:

We do not sell Student Data. We have never sold Student Data and we will not sell, rent, or trade it.
We do not use Student Data for advertising. We do not use Student Data to deliver targeted or behavioral advertising to students or their families, to build advertising or marketing profiles, or to amass a profile about a student except in furtherance of the School’s educational purposes.
We do not market to students. We do not send marketing or promotional communications to students based on Student Data. Communications to students are limited to service and account messages necessary to operate the Services.
We do not use Student Data to train third-party AI models. See Section 6.
We do not disclose Student Data except as described in this Policy, as directed by the School, or as required by law.
We limit internal access to Student Data to personnel who need it to deliver, support, or secure the Services, under least-privilege access controls.
We do not change these protections retroactively. If we make a material change to this School Privacy Policy that reduces the protections applicable to Student Data, we will provide advance notice to affected Schools and an opportunity to object or terminate before the change takes effect as to Student Data already collected.

5.1 De-identified and aggregated data

We may create and use de-identified or aggregated data — data from which all personally identifiable information has been removed and which cannot reasonably be used to identify an individual student — for the limited purposes of improving and developing the Services, demonstrating the effectiveness of the Services, and producing aggregate research or benchmarking.

Where we use de-identified data, we will:

Not attempt to re-identify it, and contractually prohibit any recipient from doing so;
Not release it in any form that could reasonably identify a student, a class, or a small cohort, and suppress results for any group smaller than ten (10) students; and
Not condition the provision of the Services on a School’s agreement to this use.

A School may direct Orchard in writing to exclude its data from de-identified research and benchmarking, and Orchard will honor that direction.

6. Artificial Intelligence

The Services include Orchie, an AI career companion, and AI-assisted search and recommendation features.

Model providers. Anthropic is Orchard’s sole AI model provider. Voyage AI is used for the text embeddings that power search and retrieval. Both are accessed under commercial API agreements.

No third-party model training. The commercial terms under which we access these providers prohibit the use of customer inputs or outputs to train their models. Student prompts, responses, assessment answers, and action plan content are not used to train Anthropic’s or Voyage AI’s foundation models.

Scoped, not general-purpose. Orchie is constrained to career readiness topics. Out-of-scope or inappropriate prompts are automatically detected and redirected back to career topics. The student experience does not include open internet browsing or image generation.

Chat visibility. Student conversation history is hidden by default and is released only through an export requested by an authorized School administrator, where School policy permits.

Human oversight. AI-generated career information is informational and is not a substitute for guidance from a school counselor or other qualified professional. AI outputs may contain errors. The Services do not make automated decisions that produce legal or similarly significant effects about a student.

7. Service Providers and Subprocessors

We share personal information with a limited set of vendors who process it on our behalf, under written contracts requiring confidentiality, security, and use restricted to providing services to Orchard. We do not permit them to use Student Data for their own purposes.

Subprocessor	Purpose	Data location
Amazon Web Services (AWS)	Primary cloud hosting; compute and data storage	United States — us-east-2 (Ohio)
Vercel	Application hosting and delivery	United States
Google Cloud	Identity services	United States
Cloudflare	Content delivery network, DNS, and network security	United States
Anthropic	AI model provider for the Orchie career companion	United States
Voyage AI	Text embeddings for search and retrieval	United States
PostHog	Product analytics and error tracking	United States
Clever / ClassLink / Google for Education	Single sign-on and provisioning, where the School elects to use them	United States

A current subprocessor list is available to Schools on request. We will provide affected Schools at least thirty (30) days’ advance notice before engaging a new subprocessor that will process Student Data, and a School may object and terminate if it does not accept the change.

We may also disclose information: (a) as directed or authorized by the School; (b) to comply with law, legal process, or a lawful government request; (c) to enforce our agreements or protect the rights, safety, and security of Orchard, our users, or the public; and (d) in connection with a merger, acquisition, financing, or sale of assets — in which case the acquiring party will remain bound by the commitments in this Policy with respect to Student Data, and the School will be notified and may terminate and request deletion.

8. Data Residency

All customer data at rest resides in the United States. AWS is our primary cloud provider, with all compute and data storage in us-east-2 (Ohio). Supporting infrastructure — Vercel application hosting, Google Cloud identity, and Cloudflare CDN — is likewise US-region.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including:

Encryption: TLS 1.2 or higher in transit; AES-256 at rest
Access control: role-based permissions across student, teacher, counselor, and administrator roles; least-privilege internal access; access reviews
Audit logging: administrative actions, access events, review events, and shared artifacts are logged to support compliance review and School oversight
Network protection: CDN-level protections and monitoring

Certifications. Orchard does not currently hold a SOC 2 attestation. We will complete a School’s security questionnaire and provide supporting documentation on request.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data Breach Notification

If we confirm a security incident involving unauthorized access to or acquisition of Student Data, we will:

Notify the affected School without undue delay and no later than 72 hours after confirming the incident;
Provide the information reasonably available to us about the nature and scope of the incident, the categories of data involved, and the steps we are taking;
Provide regular updates as our investigation progresses;
Provide a post-incident report once remediation is complete; and
Reasonably cooperate with the School in its own notification obligations to parents, students, and regulators.

Notice will be given to the School contact designated in the applicable agreement. Orchard does not notify parents or students directly unless the School requests it in writing or law requires it.

11. Retention, Deletion, and Return of Data

We retain Student Data only as long as necessary to provide the Services to the School.
Student personal information is retained no longer than three (3) months past termination of the account or the School’s agreement, unless a longer period is required by law or requested in writing by the School.
A School may request export or deletion of its Student Data at any time. We will fulfill deletion requests within thirty (30) days of a verified request and, on request, provide written certification of deletion.
Backup archives are encrypted and are overwritten on a rolling basis. Student Data that has been deleted from active systems is not restored to active systems from backup.
We will not knowingly retain Student Data beyond these periods for our own purposes.

12. Access, Correction, and Parent Rights

Because the School controls Student Data, requests to access, review, correct, or delete a student’s information should be directed to the School, not to Orchard.

Parents and eligible students have rights under FERPA to inspect and review education records, and to seek correction of records they believe are inaccurate or misleading. These rights are exercised through the School.
On the School’s direction and verified request, we will provide the School with a copy of a student’s data, correct it, or delete it.
If a parent contacts Orchard directly, we will refer them to the School and notify the School of the request.

13. FERPA

Where the Services are used by an educational agency or institution subject to the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99):

The School may designate Orchard as a school official with a legitimate educational interest in education records under 34 C.F.R. § 99.31(a)(1)(i)(B).
Orchard performs an institutional service or function for which the School would otherwise use its own employees.
Orchard is under the direct control of the School with respect to the use and maintenance of education records.
Orchard uses education records only for the purposes for which the disclosure was made and does not redisclose them to any other party without the School’s authorization, except as permitted by FERPA or required by law.
The School is responsible for determining whether its use of the Services complies with FERPA and its own annual notification of rights, and for providing any notices to parents and eligible students that FERPA requires.

14. Children’s Privacy (COPPA)

The Services are offered to students through Schools for educational purposes.

Where a School authorizes students under 13 to use the Services, the School may provide consent on behalf of parents under the Children’s Online Privacy Protection Act (“COPPA“), consistent with FTC guidance, provided the data is collected and used solely for an educational purpose and for no commercial purpose.
By enabling student accounts, the School represents that it has the authority to consent on behalf of parents, or has obtained the necessary parental consents, and has provided required notice to parents.
We collect from students only the information reasonably necessary to deliver the Services.
We provide the School, on request, a description of the types of personal information collected from students, an opportunity to review that information, and the ability to have it deleted and to refuse further collection.
We do not condition a student’s participation on disclosing more information than is reasonably necessary.

Student accounts are created only by Schools. Student accounts exist only where a School has provisioned or authorized them. Individual educators using a self-service consumer account cannot create student accounts. See Section 19.

15. Protection of Pupil Rights Amendment (PPRA)

The Growth Assessment and the Services do not collect information from students concerning the eight protected categories under the Protection of Pupil Rights Amendment (20 U.S.C. § 1232h) — political affiliations or beliefs; mental or psychological problems; sex behavior or attitudes; illegal, anti-social, self-incriminating, or demeaning behavior; critical appraisals of close family members; legally recognized privileged relationships; religious practices, affiliations, or beliefs; or family income (other than as required to determine program eligibility).

The Services do not collect personal information from students for the purpose of marketing or selling that information.

16. State Student Privacy Laws

Orchard designs the Services to meet the requirements commonly imposed by state student data privacy laws, including commitments not to sell student information, not to use it for targeted advertising, not to create non-educational profiles, to maintain reasonable security, and to delete student information at the School’s request.

State-specific addenda

Additional terms apply to Schools in the following states. Where a state addendum conflicts with the general terms of this Policy, the addendum controls for Schools in that state.

Pennsylvania — Orchard will execute the Pennsylvania Student Data Privacy Agreement (PA NDPA) through the Student Data Privacy Consortium (SDPC).

Schools in states with additional statutory requirements — including New York (Education Law § 2-d), Illinois (SOPPA), California (SOPIPA and Education Code § 49073.1), Colorado (Student Data Transparency and Security Act), and Connecticut (Public Act 16-189) — may contact us to execute the applicable state agreement and receive any required supplemental disclosures.

17. Changes to This Policy

We may update this School Privacy Policy from time to time. We will update the “Last updated” date above.

If we make a material change that reduces the protections applicable to Student Data, we will notify affected Schools at least thirty (30) days in advance through the administrative contact on file and, where practical, through the Services. A School that objects may terminate and request return or deletion of its Student Data before the change takes effect.

18. Individual Educator Accounts Are Not School Accounts

Orchard offers self-service accounts for individual use. These are not School accounts, and this Section describes their limits.

A teacher, counselor, administrator, or other school or district staff member who signs up through a self-service consumer account holds that account for individual personal use only.
Self-service accounts cannot create student accounts and cannot be used to enroll, roster, invite, or provision students.
Self-service accounts are not granted access to organization-level functionality, including School dashboards, class or building rosters, cohort reporting, administrative exports, or any view of another user’s data.
Individual self-service accounts are governed by Orchard’s general Privacy Policy and Terms of Service, not by this School Privacy Policy.

School-level deployment — including student accounts, rostering, and reporting — requires a School agreement with Orchard.

19. Contact Us

Schools and districts. Please direct all inquiries to your school or district’s designated Orchard contact. This includes questions about this Policy, requests for security documentation or our current subprocessor list, requests to execute a student data privacy agreement, and requests to export or delete Student Data.

If you do not know who your designated contact is, or for general questions about this Policy, write to [email protected] and we will route your inquiry to the right person.

Security incidents. Notice of a security incident will be given to the School contact designated in the applicable agreement, as described in Section 10.

Mailing address
Orchard Careers Inc
2000 Mallory Lane, Suite 290 #1442
Franklin, TN 37067

Parents and eligible students: please contact your child’s school or district first. Schools control the student data in the Services and are the correct point of contact for access, correction, and deletion requests.