How Guiden handles student educational records under the Family Educational Rights and Privacy Act
FERPA grants parents and eligible students (students 18 or older, or attending a post-secondary institution) rights to access, review, and control disclosure of educational records. FERPA requires that schools obtain written consent before disclosing educational records to third parties — with important exceptions.
FERPA permits schools to disclose educational records without consent to "school officials" who have a "legitimate educational interest" in the records. 34 CFR § 99.31(a)(1). Guiden qualifies as a school official under this exception because:
Our legitimate educational interest in student educational records is limited to:
Access to student records within Guiden is role-based: teachers may only access records of students enrolled in their classrooms. Administrators access records only for legitimate institutional management purposes. We do not access student records for any purpose outside the educational mission.
Under FERPA, "education records" are records directly related to a student and maintained by an educational agency or institution, or by a party acting on its behalf. In Guiden, the following data constitutes education records:
| Chat Session Transcripts | Full text of student-AI tutor conversations within assignment sessions |
| Assignment Submissions | Submitted chat histories associated with graded assignments |
| AI-Generated Grades | Numerical scores (0–100) and rubric breakdowns generated by the AI grader |
| AI Feedback | Written feedback generated by the AI grader for each submission |
| Learning KPI Data | Teacher-facing analytics: reasoning scores, hint usage, confidence levels, misconceptions |
| Submission Status | Whether a student has started, is in progress, submitted, or been graded on each assignment |
| Student Profile Data | Name, grade level, enrolled school, and interests linked to the student's educational account |
We do not disclose student educational records to any third party without written authorization from the school, except as required by law or permitted by FERPA. Specifically, we do not share student records with:
When student chat messages are sent to OpenAI's API for processing, this does not constitute a re-disclosure under FERPA because:
We may be required to disclose educational records pursuant to:
Schools have the right to inspect and review all student educational records held by Guiden on their behalf. Upon written request from an authorized school official, we will provide complete access to the requested records within 10 business days.
If a school believes that student educational records held by Guiden are inaccurate, misleading, or violate a student's privacy rights, the school may request that we amend the records. We will respond to such requests within 10 business days.
Schools retain full control over the disclosure of student educational records. Schools may direct us to share records with specific parties (e.g., parents, other authorized school officials) by submitting a written request.
Schools and eligible students may file complaints regarding alleged FERPA violations with the U.S. Department of Education's Student Privacy Policy Office (SPPO):
| Name | Student Privacy Policy Office |
| Address | 400 Maryland Avenue, SW, Washington, DC 20202-8520 |
| Web | studentprivacy.ed.gov |
| FERPA@ed.gov |
FERPA rights belong to parents until the student turns 18 or attends a post-secondary institution, at which point the rights transfer to the student (who becomes an "eligible student").
| Right to Inspect Records | Parents/eligible students may request access to their educational records held by Guiden through the student's school |
| Right to Request Amendment | Parents/eligible students may request correction of inaccurate or misleading records |
| Right to Control Disclosure | Schools must obtain written consent before disclosing records to non-authorized parties |
| Right to File Complaint | With SPPO (see above) if FERPA rights are violated |
To exercise FERPA rights related to records held by Guiden, students and parents should first contact their school's registrar or principal. Schools may then contact us at privacy@colorcodedkids.com.
| Encryption at Rest | AES-256 encryption for all stored educational records |
| Encryption in Transit | TLS 1.3 for all data transmitted between client, server, and AI provider |
| Access Control | Role-based access: teachers see only their enrolled students' records |
| Audit Trail | All administrative access to educational records is logged |
| Authentication | JWT-based authentication with secure, HttpOnly cookies |
| Breach Notification | Schools notified within 72 hours of a confirmed breach affecting their students' records |
Educational records held by Guiden are retained for 3 years after the student's last login, or until the School Partner requests deletion, whichever comes first. Upon termination of a school's Guiden account, we will:
Schools using Guiden agree, by accepting our Terms of Service, to: