Effective: May 13, 2026 · Version 2.0
This policy describes how Immigr8, Inc. ("Immigr8," "we," "us") collects, uses, and protects personal information when:
Immigr8 is the data processor for Student Data and a data controller for Educator and Visitor Data. The district remains the controller of its students' records.
| Category | Source | Examples |
|---|---|---|
| Educator account | Provided by the educator at signup | Name, work email, district affiliation, campus affiliation, role (admin / team / reporting), authentication tokens |
| District profile | Provided by district admin | District name, address, size band, plan tier, billing contact |
| Student transcript records | Uploaded by educator/district | Student name, date of birth (optional, recommended), country of origin, prior school name, courses, grades, attendance, scanned transcript documents |
| Evaluation outputs | Generated by Immigr8 | Course-to-US-equivalent mappings, credit alignment, grade placement recommendations, evaluator notes |
| Usage data | Automatic | Log lines (timestamp, route, status code), IP address, user agent, session identifiers, audit-log of edits |
| Billing data | Stripe (sub-processor) | Last-4 of card, billing zip, transaction ID — Immigr8 servers never receive full card numbers |
What we do not collect: immigration status, visa type, citizenship, religion, biometric identifiers, social security numbers (unless a district uploads a record that contains one — in which case we treat it under the highest sensitivity tier and offer redaction on request).
We do not use Student Data for advertising, profile-building, or any purpose outside the educational use case the district contracted for.
Immigr8 acts as a "school official" under the Family Educational Rights and Privacy Act (FERPA), 34 CFR §99.31(a)(1). This means each district that contracts with Immigr8:
The four conditions above are also written into the Data Processing Addendum (DPA) every district signs with us.
| Data type | Retention period | Deletion trigger |
|---|---|---|
| Educator accounts | Until account closure + 30 days | District admin removes the user, or educator requests deletion |
| Student transcript files (PDFs, images) | Up to 7 years from completion or contract end, whichever first | District requests deletion (typical: at student graduation or transfer) |
| Evaluation outputs (mappings, recommendations) | Same as transcript files | Same as above |
| Audit logs (who edited what, when) | 7 years (compliance retention) | Automatic purge after the period; logs cannot be deleted by district request because they document FERPA-relevant access |
| Billing records | 7 years (IRS requirement) | Statutory; not deletable by district request |
| Aggregated metrics (no PII) | Indefinite | n/a — anonymized data is not personal information |
| Backup snapshots | 30 days rolling | Automatic |
At district contract termination, Immigr8 will either return Student Data to the district in machine-readable format or destroy it (district's choice), within 90 days of termination. A certificate of destruction is provided on request.
If you are an educator or a student whose record we hold, you have the following rights. Note that the district controls Student Data — student rights requests are routed to the district first.
To exercise a right, email privacy@immigr8.net from the account email on file (or, for students, route the request through your school district's records office). We respond within 30 days.
Immigr8 engages third-party service providers ("sub-processors") to support our platform. The current list — including the AI provider that processes transcript content — is published at immigr8.net/subprocessors. Districts receive at least 30 days' notice before a new sub-processor is added that will handle personal information.
Immigr8's evaluation drafts are produced by an in-house deterministic engine — transcript content is not sent to any external AI/LLM provider in the default path. The reading step (optical character recognition of uploaded transcript images) runs Immigr8-owned software on Cloudflare Containers: ephemeral, in-memory processing pinned to North America, with nothing persisted by the OCR step. A human evaluator reviews and approves every draft before it becomes a final evaluation, and drafts are clearly flagged in the platform UI.
Anthropic (Claude API) is retained only as an optional assist that is off by default. When a district's evaluation uses it, that traffic runs under a zero-data-retention configuration Immigr8 has requested on its Anthropic workspace (written confirmation pending; until confirmed, Anthropic's standard API retention applies to that optional traffic).
Automated drafts are not used for adverse decisions about students. Credit alignment, grade placement, and academic findings are all reviewed and approved by Immigr8 evaluators before delivery. Final placement decisions remain with the district.
Immigr8 hosts application infrastructure on Render (Oregon, United States) and stores transcript files on Cloudflare R2 (United States; private bucket accessed by internal binding — not CDN edge-cached). OCR of transcript images runs on Cloudflare Containers pinned to North America. When the optional Anthropic provider is enabled, that processing occurs in the United States.
If your district is outside the United States and your local law requires data residency in your country, contact us before signing — we currently do not offer non-U.S. hosting.
For Texas school districts, the following additional disclosures apply under the Texas Data Privacy and Security Act (HB 4, 2023 — Tex. Bus. & Com. Code Ch. 541) and the Texas Student Privacy Act (HB 2087, 2017 — Tex. Educ. Code §32.151 et seq.):
California residents have the rights described in Section 6 above. We additionally disclose:
Immigr8 is a B2B platform for school districts. We do not offer accounts to users under 13, do not directly market to children, and do not knowingly collect personal information from children. Transcript records may pertain to minors, but in all cases that information is provided by the district under FERPA's school-official exception. If you believe a child has independently provided information to us, contact privacy@immigr8.net and we will delete it.
We protect personal information using:
In the event of a security incident affecting personal information, we will notify affected districts within 72 hours of discovery, consistent with our DPA.
The Immigr8 platform uses cookies only for authentication (session tokens) and essential functionality. We do not use analytics, advertising, or third-party tracking cookies on the platform. The marketing site (immigr8.net) is also analytics-free at this time; if we add analytics later, we will update this section and provide a cookie consent banner.
Privacy questions, rights requests, or DPA inquiries: privacy@immigr8.net.
Mailing address available on request.
We will update this policy when our practices change or when laws require additional disclosure. Material changes will be announced via email to district admins at least 30 days before they take effect.
What we collect and why. If a school district opts in to SMS notifications, we collect the district contact's mobile phone number and consent records (the consent language shown at opt-in, the timestamp, and the IP address and browser user agent of the person who opted in). We use this information for one purpose only: to send transactional notifications about transcript evaluations (e.g., "your evaluation is ready") to the district staff who asked for them. We do not use mobile numbers or messaging consent data for marketing, advertising, profiling, or any purpose other than delivering the notifications the district requested. Message frequency varies with evaluation activity. Message and data rates may apply.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. No mobile information will be sold, rented, or provided to any third party, affiliate, or lead generator at any time. Text messaging originator opt-in data and consent will not be shared with any third parties.
Immigr8 uses a single SMS delivery provider that transmits the messages you requested strictly on Immigr8's behalf, as a service provider acting under written contract and under Immigr8's instructions. That provider is contractually prohibited from selling, renting, or disclosing your mobile number or messaging consent data, and from using it for its own marketing or promotional purposes. This is a processing relationship necessary to deliver the messages you asked for; it is not a disclosure of your mobile information to a third party for marketing, and nothing in it qualifies the commitments in the paragraph above.
You can opt out at any time by replying STOP to any message; reply HELP for help or contact support@immigr8.net. Opting out of SMS does not affect your district's account or service. See the SMS program terms in our Terms of Service.