Effective: May 13, 2026 · Version 2.0
This policy describes how Immigr8, Inc. ("Immigr8," "we," "us") collects, uses, and protects personal information when:
Immigr8 is the data processor for Student Data and a data controller for Educator and Visitor Data. The district remains the controller of its students' records.
| Category | Source | Examples |
|---|---|---|
| Educator account | Provided by the educator at signup | Name, work email, district affiliation, campus affiliation, role (admin / team / reporting), authentication tokens |
| District profile | Provided by district admin | District name, address, size band, plan tier, billing contact |
| Student transcript records | Uploaded by educator/district | Student name, date of birth (optional, recommended), country of origin, prior school name, courses, grades, attendance, scanned transcript documents |
| Evaluation outputs | Generated by Immigr8 | Course-to-US-equivalent mappings, credit alignment, grade placement recommendations, evaluator notes |
| Usage data | Automatic | Log lines (timestamp, route, status code), IP address, user agent, session identifiers, audit-log of edits |
| Billing data | Stripe (sub-processor) | Last-4 of card, billing zip, transaction ID — Immigr8 servers never receive full card numbers |
What we do not collect: immigration status, visa type, citizenship, religion, biometric identifiers, social security numbers (unless a district uploads a record that contains one — in which case we treat it under the highest sensitivity tier and offer redaction on request).
We do not use Student Data for advertising, profile-building, or any purpose outside the educational use case the district contracted for.
Immigr8 acts as a "school official" under the Family Educational Rights and Privacy Act (FERPA), 34 CFR §99.31(a)(1). This means each district that contracts with Immigr8:
The four conditions above are also written into the Data Processing Addendum (DPA) every district signs with us.
| Data type | Retention period | Deletion trigger |
|---|---|---|
| Educator accounts | Until account closure + 30 days | District admin removes the user, or educator requests deletion |
| Student transcript files (PDFs, images) | Up to 7 years from completion or contract end, whichever first | District requests deletion (typical: at student graduation or transfer) |
| Evaluation outputs (mappings, recommendations) | Same as transcript files | Same as above |
| Audit logs (who edited what, when) | 7 years (compliance retention) | Automatic purge after the period; logs cannot be deleted by district request because they document FERPA-relevant access |
| Billing records | 7 years (IRS requirement) | Statutory; not deletable by district request |
| Aggregated metrics (no PII) | Indefinite | n/a — anonymized data is not personal information |
| Backup snapshots | 30 days rolling | Automatic |
At district contract termination, Immigr8 will either return Student Data to the district in machine-readable format or destroy it (district's choice), within 90 days of termination. A certificate of destruction is provided on request.
If you are an educator or a student whose record we hold, you have the following rights. Note that the district controls Student Data — student rights requests are routed to the district first.
To exercise a right, email privacy@immigr8.net from the account email on file (or, for students, route the request through your school district's records office). We respond within 30 days.
Immigr8 engages third-party service providers ("sub-processors") to support our platform. The current list — including the AI provider that processes transcript content — is published at immigr8.net/subprocessors. Districts receive at least 30 days' notice before a new sub-processor is added that will handle personal information.
Foreign transcripts are sent to Anthropic (Claude API) for an initial mapping draft. A human evaluator reviews and approves the draft before it becomes a final evaluation. The AI draft is clearly flagged in the platform UI so districts can distinguish it from approved human work.
Immigr8 has requested zero-data-retention on its Anthropic workspace, meaning transcript content is not stored by Anthropic beyond the immediate inference window. Anthropic's standard 30-day retention does not apply to our traffic. Verification artifacts are available on request.
The AI is not used for adverse decisions about students. Credit alignment, grade placement, and academic findings are all reviewed and approved by Immigr8 evaluators before delivery. Final placement decisions remain with the district.
Immigr8 hosts application infrastructure on Render (Oregon, United States) and stores transcript files on Cloudflare R2 (United States primary, with global CDN edge caching). The AI provider, Anthropic, processes transcripts in the United States.
If your district is outside the United States and your local law requires data residency in your country, contact us before signing — we currently do not offer non-U.S. hosting.
For Texas school districts, the following additional disclosures apply under the Texas Data Privacy and Security Act (TX HB 18) and SB 207:
California residents have the rights described in Section 6 above. We additionally disclose:
Immigr8 is a B2B platform for school districts. We do not offer accounts to users under 13, do not directly market to children, and do not knowingly collect personal information from children. Transcript records may pertain to minors, but in all cases that information is provided by the district under FERPA's school-official exception. If you believe a child has independently provided information to us, contact privacy@immigr8.net and we will delete it.
We protect personal information using:
In the event of a security incident affecting personal information, we will notify affected districts within 72 hours of discovery, consistent with our DPA.
The Immigr8 platform uses cookies only for authentication (session tokens) and essential functionality. We do not use analytics, advertising, or third-party tracking cookies on the platform. The marketing site (immigr8.net) is also analytics-free at this time; if we add analytics later, we will update this section and provide a cookie consent banner.
Privacy questions, rights requests, or DPA inquiries: privacy@immigr8.net.
Mailing address available on request.
We will update this policy when our practices change or when laws require additional disclosure. Material changes will be announced via email to district admins at least 30 days before they take effect.
If a school district opts in to SMS notifications, we collect the district contact's mobile phone number and consent records solely to send transactional notifications about transcript evaluations (e.g., "your evaluation is ready"). Message frequency varies with evaluation activity. Message and data rates may apply.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, except with our SMS delivery provider (Twilio) solely as necessary to deliver the messages you requested.
You can opt out at any time by replying STOP to any message; reply HELP for help or contact support@immigr8.net. See the SMS program terms in our Terms of Service.