Last updated: September 9, 2026 · Version 2026-09-09
This page describes the baseline data-privacy commitments SwayForm LLC ("SwayForm") makes to any K-12 school or district using the Learning Portal or S1 hardware. It is written for school administrators, IT/procurement staff, and legal counsel evaluating SwayForm.
SwayForm will collect, access, and use student data only for the purpose of providing, maintaining, and improving the SwayForm services the school has requested — not for any unrelated purpose, and not on SwayForm's own independent authority. See the Student & Children's Privacy Notice for the full description of what is collected and why.
SwayForm will not sell student data, will not use it for targeted or behavioral advertising, and will not use it to build a commercial advertising profile of any student.
With respect to FERPA-covered education records, SwayForm acts as a school official/service provider under the school's direct control: SwayForm uses education records only for purposes the school authorizes, does not redisclose them except as the school authorizes or law requires, and does not claim any independent right to use them beyond that authorization.
SwayForm discloses student data only to the subprocessors listed in the Privacy Policy, each of which is contractually limited to using that data solely to provide its service to SwayForm. SwayForm will update that list, and notify schools, before adding a new subprocessor that will receive student data.
SwayForm maintains administrative, technical, and organizational safeguards described on the Security page, including access controls and encrypted connections. A school may request a summary of SwayForm's security practices as part of its own procurement review.
If SwayForm becomes aware of a security incident involving unauthorized access to a school's student data, SwayForm will investigate and notify the affected school(s) without unreasonable delay, and in any event as required by applicable law and any signed agreement with that school — including any state-specific notification timeline (for example, Georgia's student-data breach-notification requirements) that applies once a signed agreement is in place.
An authorized school representative may request deletion of some or all of that school's student data. SwayForm will complete deletion of an entire school's data within 45 days of a verified request, consistent with Georgia's expectations for student-data deletion timelines. Individual student records can typically be deleted faster — see the Data Retention & Deletion Policy.
SwayForm may use properly de-identified or aggregated data (from which a specific student cannot reasonably be identified) to understand feature usage, diagnose performance, and improve our products. SwayForm will not attempt to re-identify properly de-identified student data.
SwayForm does not use identifiable student data, student-written code, or classroom video/audio to train general-purpose AI models.
If SwayForm is acquired, merged, or sells substantially all of its assets, any successor remains bound by these commitments with respect to student data collected before the transfer.
To keep this arrangement workable, SwayForm asks schools to: designate an authorized representative to sign agreements and submit data requests; provide any parent notice the school's own policies or state law require before students begin using SwayForm products; and promptly notify SwayForm if a school-side account (especially an admin account) is compromised.
To request a signed Data Privacy Agreement, or ask questions about this page, contact contact@swayform.net.