How Leap Log IEP collects, uses, and protects student information
Last updated: March 11, 2026
Leap Log IEP LLC · Kansas City, Missouri
Leap Log IEP is a Special Education progress monitoring platform built for K-12 school districts. This policy explains how we collect, use, and protect student data — including education records protected under FERPA, IDEA, and COPPA. If you have questions, contact our Privacy Officer at support@leaplogiep.com.
Our Student Data Privacy Commitment
We built Leap Log IEP for one purpose: helping Special Education teams spend less time on paperwork and more time with students. Our data practices reflect that:
These are absolute commitments, not subject to business-case exceptions. We are a signatory to the Student Privacy Pledge.
School staff and administrators using the platform under their school's Leap Log IEP subscription. Governed by your school's agreement with us and applicable law, including FERPA.
Parents and guardians accessing the parent portal to view their child's IEP progress. Parents see only their own child's data — never another student's.
Students whose Special Education records are entered and managed by school staff. Student data is used solely for IEP tracking and progress monitoring purposes.
Student data is submitted by school staff at the direction of the school. It may include:
This data constitutes education records under FERPA and is processed under our Data Processing Agreement with your school.
| Purpose | How We Use It |
|---|---|
| Deliver the Service | IEP goal tracking, progress monitoring, service logging, compliance reports, parent portal, messaging |
| Account security | Authentication, session management, role-based access enforcement |
| FERPA audit trail | Every access to and modification of student records is logged — who, what, when |
| Transactional notifications | Email alerts for new messages and IEP reminders — no student PII in email bodies |
| Service improvement | Aggregated, de-identified usage data only — cannot identify any individual student |
| Legal compliance | Disclosure when required by law, with advance notice to the school where permitted |
We share student data only with the following service providers, each bound by written data protection agreements:
| Provider | Role | Student PII? | Location |
|---|---|---|---|
| Supabase | Managed database and authentication | Yes — primary data store | United States |
| Vercel | Application hosting | Transient request processing only | United States |
| Resend | Transactional email | First name + login link only | United States |
| Cloudflare | DNS, DDoS protection, CAPTCHA | No student PII | Global CDN |
We will notify schools at least 30 days before adding any new subprocessor that processes student PII.
| Data Type | Retention Period |
|---|---|
| Student education records | Duration of subscription + 30-day export window, then securely deleted |
| Audit logs | 5 years (supports IDEA dispute resolution timelines) |
| Staff accounts | Active employment; deleted within 30 days of deactivation |
| Parent accounts | Duration of child's enrollment; deleted within 30 days of deactivation |
| Security logs | 90 days |
After your contract ends, all student data remains available for export for 30 days, then is securely deleted. Written confirmation of deletion is available on request.
We protect student data with AES-256 encryption at rest, TLS 1.2+ in transit, database-level row security, automatic 30-minute session timeouts, full audit logging, and Cloudflare bot protection on all login pages.
In the event of a breach affecting student data, we notify the affected school within 72 hours of discovery. See our full Security page for technical details.
Rights to inspect, correct, or delete education records belong to the school and — where applicable — to eligible students and their parents. To exercise FERPA rights, contact your school or district directly. We cooperate with school-directed FERPA requests within 10 business days.
Leap Log IEP processes information about students under 13 under the COPPA school consent exception (16 C.F.R. § 312.5(b)(1), including 2024 amendments with full compliance effective April 22, 2026). By executing our Data Processing Agreement, the school represents it has authority to consent on behalf of parents for this educational service. We collect only the data necessary to deliver the service — never for commercial purposes.
Designed to support compliance with the Texas Student Data Privacy Act (HB 18, 2023 SCOPE Act) and the Texas Data Privacy and Security Act (HB 4390, effective July 1, 2024). We do not sell student data or build profiles for non-educational purposes. We respond to district vendor security questionnaires as required by Texas SB 1792.
Compliant with the Kansas Student Online Personal Protection Act (K.S.A. 72-6331) and the Kansas Student Data Privacy Act (K.S.A. 72-6312), including breach notification requirements and data deletion on request.
Registered with the Student Data Privacy Consortium (SDPC). Missouri districts requiring a DPA on the SDPC National DPA template — we support that. See our Data Processing Agreement for details.
We provide at least 30 days' advance notice of material changes via email to school administrators. The current version is always posted at leaplogiep.com/privacy with a revision date.
Privacy Officer — Leap Log IEP LLC
support@leaplogiep.com
Kansas City, Missouri