Data Collection Transparency Report

Data Collection Overview

ThinkKits collects only the minimum amount of data necessary to provide our educational intelligence platform services. All data collection is governed by strict privacy controls, legal compliance requirements, and educational purpose limitations.

Student Privacy Protection

ThinkKits does not collect personal information from students. Our platform processes only publicly available school-level aggregate data from federal sources (NCES, CRDC, USAC). We do not access student education records and are not subject to FERPA. We never sell data or use it for advertising purposes.

Data Categories

Account Information

User identification and access control

Name, email address, role, organization, state, subscription plan, account preferences

Lifetime + 30 days

Contract performance, legitimate interest

Public Education Data

School-level analysis and reporting

Publicly available school-level demographics, assessment scores, enrollment data from NCES CCD, CRDC, and state open data portals

Continuously updated from public sources

Publicly available data, legitimate interest

Usage Analytics

Service improvement and user experience

Search queries, page views, feature usage, session duration, click patterns (anonymized after 90 days)

2 years

Legitimate interest, service optimization

Security Data

Platform security and fraud prevention

IP addresses, login attempts, device information, session tokens, security event logs

90 days

Security monitoring, fraud prevention

Billing Information

Payment processing and financial compliance

Billing address, payment methods (tokenized), transaction history, tax information

7 years

Contract performance, legal compliance

Communication Data

Customer support and service delivery

Support tickets, email communications, feedback, survey responses

3 years

Customer service, quality assurance

Data Collection Methods

User Registration

Users provide basic information during account creation via Clerk authentication system

Public Data Ingestion

Publicly available school-level data ingested from federal sources (NCES, CRDC, USAC, Census)

Platform Interaction

Automatic collection of usage analytics and security data during platform use

Payment Processing

Stripe processes billing information for subscription services (PCI DSS compliant)

Public Data Sources

Automated collection from public sources (NCES, state DOE, USAC) for platform intelligence

Detailed Data Inventory

This comprehensive inventory details every type of data collected by ThinkKits, organized by collection method, purpose, and retention requirements.

Data Element	Collection Method	Educational Purpose	Retention Period	Legal Basis	Third Party Sharing
Full Name	User Input	User identification, personalization	Lifetime + 30 days	Contract performance	None
Email Address	User Input	Account management, communications	Lifetime + 30 days	Contract performance	Clerk (auth), Resend (email)
Organization Name	User Input	Service customization, access control	Lifetime + 30 days	Legitimate interest	None
Role/Title	User Input	Feature access, content personalization	Lifetime + 30 days	Legitimate interest	None
School Demographics	Public Data (NCES)	School-level analysis, equity reporting	Continuously updated	Publicly available data	None
Assessment Scores	Public Data (State portals)	School-level performance analysis	Continuously updated	Publicly available data	None
Enrollment Data	Public Data (NCES CCD)	Resource planning, analysis	Continuously updated	Publicly available data	None
Search Queries	Platform Use	Service improvement, personalization	1 year	Legitimate interest	None
Page Views	Platform Use	Usage analytics, optimization	2 years	Legitimate interest	PostHog (analytics)
Feature Usage	Platform Use	Product development, support	2 years	Legitimate interest	PostHog (analytics)
IP Addresses	Automatic	Security, fraud prevention	90 days	Security monitoring	Clerk (auth), Railway (hosting)
Device Information	Automatic	Security, compatibility	90 days	Security monitoring	PostHog (analytics)
Session Data	Automatic	Authentication, user experience	90 days	Security monitoring	Clerk (auth)
Payment Information	Stripe	Billing, subscription management	7 years	Contract performance	Stripe (payment processor)
Billing Address	User Input	Tax calculation, compliance	7 years	Legal compliance	Stripe (payment processor)
Support Messages	User Input	Customer support, issue resolution	3 years	Customer service	Crisp (support platform)

Data Use Principles

Purpose Limitation

All data collected by ThinkKits is used exclusively for the specific educational and business purposes outlined in our privacy policy and user agreements. We do not:

Use student data for advertising or marketing to students or parents
Create behavioral profiles for non-educational commercial purposes
Sell or license any personal data to third parties
Use data for purposes unrelated to our educational platform services

Data Minimization

We implement strict data minimization principles:

Collect only data that is necessary for specific educational purposes
Regularly review and purge unnecessary data
Anonymize or pseudonymize data when possible
Limit access to data based on job function and need-to-know

Consent and Legal Basis

Our data collection is based on appropriate legal grounds:

Contract Performance: Data necessary to provide our services
Legal Compliance: Data required by law (financial records, audit trails)
FERPA Exempt: ThinkKits processes only publicly available, aggregate education data. No student PII is collected, stored, or processed. FERPA does not apply to ThinkKits’ data practices.
Legitimate Interest: Platform improvement and security (with privacy impact assessments)

Data Sharing and Sub-Processors

ThinkKits shares data only with trusted sub-processors who provide essential services and have signed data processing agreements:

Sub-Processor	Service	Data Shared	Location	Privacy Safeguards
Clerk	Authentication	Account data, login information	United States	DPA, SOC 2 Aligned (Type II in progress); GDPR-aligned practices
Stripe	Payment Processing	Billing information, payment data	United States	PCI DSS, DPA, privacy shield
Railway	Cloud Hosting	All platform data (encrypted)	United States	SOC 2 Aligned, DPA, encrypted storage
Supabase	Database	User profiles, application data	United States	SOC 2 Aligned, DPA, encrypted at rest
Neo4j	Graph Database	Educational intelligence data	United States	Enterprise agreement, encryption
Pinecone	Vector Database	Search embeddings, content	United States	Enterprise agreement, encryption
PostHog	Analytics	Usage analytics (anonymized)	United States	GDPR-aligned practices; US data residency
Resend	Email Delivery	Email addresses, message content	United States	DPA, encrypted transmission

Student and Parent Rights

Under FERPA, COPPA, and other privacy laws, students and parents have rights to access, review, and request correction or deletion of educational records. Schools and districts may exercise these rights on behalf of students, or parents may contact us directly at privacy@thinkkits.com.

Data Security Measures

ThinkKits protects all collected data with comprehensive security measures:

Encryption: AES-256 encryption at rest, TLS 1.3 in transit
Access Controls: Role-based access with multi-factor authentication
Network Security: Firewalls, intrusion detection, VPNs
Monitoring: 24/7 security monitoring and incident response
Auditing: Comprehensive audit logging of all data access
Training: Regular security and privacy training for all staff

Data Subject Rights

Individuals have the following rights regarding their personal data processed by ThinkKits:

Right to Access

Request copies of personal data we have about you, including sources and purposes

Available within 30 days of verified request

Right to Rectification

Request correction of inaccurate or incomplete personal data

Corrections made within 30 days

Right to Erasure

Request deletion of personal data under certain conditions

Deletion within 45 days for educational records

Right to Portability

Receive personal data in machine-readable format

Available in JSON or CSV format

Data Collection Questions?

Contact our privacy team for questions about data collection, usage, or to exercise your privacy rights.

Contact Privacy Team View SDPC Compliance

Last Updated: February 2026 | Next Review: May 25, 2026 | Questions about this transparency report?