Parents' Bill of Rights for Data Privacy and Security
Last reviewed: August 3, 2026
New York Education Law 2-d requires every educational agency to publish a Parents' Bill of Rights and to append supplemental information for each contract involving student data. We publish ours for every state, because parents everywhere deserve the same plain answer to "what happens to my kid's information?"
Who this applies to. This statement covers student data iVenza handles on behalf of a school, district, or university under a data privacy agreement. If your athlete uses iVenza on their own, outside a school program, our Privacy Policy governs instead.
Your rights
- Student data cannot be sold or released for commercial purposes. iVenza does not sell personal data and does not release student data for marketing or advertising.
- You have the right to inspect and review your child's education records. Requests go through your school or district, which can obtain the data from us.
- Student data is protected by safeguards including encryption in transit and at rest, database-enforced access controls, and multi-factor authentication for administrative access, while it is stored or moving between systems.
- You have the right to know where complaints go. Complaints about a possible breach of student data may be directed to your school or district. In New York, complaints may also be submitted to the New York State Education Department's Chief Privacy Officer. You can always contact us directly at help@susos.co.
- You have the right to be notified of a breach affecting your child's data, in accordance with applicable law.
- You have the right to have your child's data deleted. Your school or district can direct us to delete it at any time, and must do so at the end of our agreement.
Supplemental information
Education Law 2-d requires this information for each contract. The answers below are our standard commitments; a specific school's agreement is appended to its own copy.
| Exclusive purposes for which student data will be used | Solely to provide the athletic program services the school licensed: rosters, schedules, attendance, training records, forms and eligibility documents, and communication between coaches, athletes and guardians. No other purpose. Not product development, not research, not model training, not marketing. |
|---|---|
| How we ensure sub-processors abide by confidentiality and security | Every sub-processor is bound by written terms no less protective than our agreement with the school, and we remain fully responsible for their performance. Our complete, current list is published at ivenza.app/trust/subprocessors/. We give 30 days' notice before adding a sub-processor that would process student data, with a right to object. |
| When the agreement expires and what happens to the data | Student data is deleted or returned at the school's direction, within the period the agreement sets, and by the school's chosen method. We retain no student data afterwards for any purpose of our own, and we claim no right to keep de-identified or aggregated student data. |
| How to challenge the accuracy of student data | Contact your school or district, which can correct the record and direct us to correct our copy. Requests made directly to us are referred to the school rather than acted on unilaterally, because the school is the record's custodian. |
| Where the data will be stored and how it is protected | Data is stored with United States cloud providers, encrypted in transit with TLS and at rest with AES-256. Access is enforced by row-level security policies in the database itself rather than by application code alone, so access rules cannot be bypassed by a modified client. Administrative access requires multi-factor authentication, enforced at the database level, and administrative actions are logged. |
| Encryption of data in motion and at rest | Yes, both. In transit: TLS 1.2 or higher. At rest: AES-256 through managed database and object storage. We do not claim end-to-end encryption, because the service must be able to read stored data in order to display it. |
What we do not do with your child's data
- No advertising. We show none, and we do not integrate advertising or tracking software.
- No selling or trading personal data, ever, and that promise survives if the company is acquired.
- No commercial profile of a student for anything other than delivering the service.
- No third-party analytics companies. Usage data stays in our own systems and can be switched off.
- No AI training. Some optional features send content a user submits to an AI provider to generate a result. That content is not used to train models, is sent only when someone explicitly uses one of those features, and never drives an automated decision about a student.
Younger athletes
Community and social features in iVenza are closed to users under 13, enforced with device age assurance and stored birthdate. Athletes aged 13 to 17 can use the app with guardian involvement, and features that publish a profile publicly require a guardian to approve it in the app - approval that can be withdrawn at any time. In a school program, consent runs through the school under our agreement with it, rather than being collected by us directly.
Questions or complaints
Start with your school or district - they hold the record and the agreement. You can also reach us at help@susos.co and we will respond, keeping the school informed as our agreement requires. In New York, complaints may additionally be submitted to the New York State Education Department's Chief Privacy Officer.
Show Up Show Out LLC, doing business as iVenza · Florida, United States