Privacy Policy
Privacy built around schools, teachers, and students.
DetermiNext operates under Serbesa Software LLC. This policy applies to all DetermiNext accounts. Campus and district customers should additionally execute a Data Processing Agreement.
Effective date and contact
This Privacy Policy is effective as of May 16, 2026. DetermiNext operates under Serbesa Software LLC. For privacy questions, FERPA requests, or deletion requests: teng.bernabe@determinext.com. Schools entering a campus or district agreement should additionally execute a Data Processing Agreement.
Teacher and administrator data
We collect full name, email address, school or district affiliation, optional phone number, account credentials (passwords are stored hashed and never in plaintext), and billing contact information for teachers and school administrators. Billing information is processed by Stripe and is never associated with student records.
Student data
We collect and store student first and last name, username, assessment code, assessment responses (career interest and transition planning answers), AI-generated transition planning reports, assessment attempt history and completion status, launch access records and timestamps, and school and teacher associations used for roster scoping.
Operational data
We collect authentication events (login, logout, password reset, invite acceptance), IP addresses for security monitoring and suspicious activity detection, short-lived server-side session tokens, and aggregate usage logs. Operational data is not tied to individual student actions.
How student data is used
Student education records are used solely to: provide transition planning assessment services under the direction of the school; generate AI-assisted transition planning reports for teacher review; maintain classroom records accessible to the teacher and authorised school staff; and support the teacher or school account. Student data is not used for targeted advertising, building student profiles beyond what the service requires, selling or renting to third parties, or training, fine-tuning, or improving AI models.
FERPA and the school official relationship
DetermiNext operates as a "school official with a legitimate educational interest" as permitted under FERPA (34 CFR § 99.31(a)(1)). Schools retain ownership of student education records at all times. DetermiNext processes student records only under the direction of the school and within the scope of the service, and is subject to the same FERPA obligations as school employees with respect to student data. Schools with campus or district agreements formalise this relationship through a signed Data Processing Agreement.
AI processing and Google Gemini
Assessment responses are transmitted to the Google Gemini API to generate transition planning reports. Prompt design minimises personally identifying details included in AI requests. Teachers are responsible for reviewing all AI-generated output before it is used in IEPs, student meetings, or official records. Under Google's API data processing terms, student data submitted via the API is not used to train or improve Google's AI models.
Cookies and analytics
Required browser storage supports sign-in sessions, security, and remembering privacy preferences. Optional analytics (Vercel Analytics, Vercel Speed Insights) are off by default, never active on student-facing pages (/assessment, /launch) or teacher dashboard pages (/app), and only active on public marketing pages after explicit opt-in via the cookie consent prompt.
Data retention and deletion
Student data is retained while the account is active. After account closure, all student personally identifiable information is permanently deleted within 90 days. Schools may request deletion of specific student records at any time by emailing teng.bernabe@determinext.com; requests are honoured within 30 days. Raw assessment answers and report content are not included in default support exports.
Security
All data is encrypted in transit via HTTPS/TLS and at rest in Railway PostgreSQL. Data access is scoped by tenant — one school cannot access another's records. Internal admin access requires elevated authentication and all admin actions are audit-logged. Raw student data is excluded from default support exports. In the event of a confirmed breach affecting student PII, schools are notified within 72 hours.
Contact and FERPA rights
For FERPA access, correction, or deletion requests, or any privacy questions, contact: teng.bernabe@determinext.com — DetermiNext (Serbesa Software LLC). Schools with a signed Data Processing Agreement may also exercise rights through the process defined in that agreement.
Subprocessors
Only the following subprocessors may process student personally identifiable information. Stripe, Vercel, and Resend handle teacher and administrator data only.
| Subprocessor | Purpose | Location |
|---|---|---|
| Google LLC (Gemini API) | AI-assisted transition planning report generation | United States |
| Railway Inc. | Database hosting and infrastructure | United States |