Our core principle
You own your data. We don't sell it, rent it, or do anything sketchy with it. AssemblyNote exists to make school communication easier—not to monetize the private information of students, teachers, or families.
What we collect (and why)
Basic Account Info
Names, email addresses, and school affiliations—the minimum we need to authenticate users and deliver the right newsletters to the right people.
Content You Create
The class updates, templates, and newsletters you build inside Assembly. We store this so you can access it, edit it, and send it—and we never peek at it for marketing purposes.
Usage Data
Analytics (page views, feature usage) to understand how people use Assembly so we can make it better. Two tools: Vercel Web Analytics, which is cookieless and does not build a profile of you, and PostHog, which records how signed-in school staff move through the app against your account's internal ID so we can see which features get used and where people get stuck. PostHog never receives your name, your email address, or the text of anything you click or type, and neither tool follows you across other websites. PostHog also records session replays on the same terms as Sentry, described under “Diagnostics and Error Reports” below. We do not run Google Analytics, advertising pixels, or any third-party ad network on AssemblyNote.
Security and Access Logs
When someone signs in or changes something that matters—a role, a roster, a campaign—we record who did it, what they did, when, and the IP address and browser user agent the request came from. This is how a school investigates a login it doesn't recognise or a change nobody remembers making. We keep these for your plan's audit-log window and then archive them; see “How long we keep things” below. Accepting a Data Processing Agreement also records the signer's IP address and user agent as evidence of who agreed and when, and that record is permanent.
Newsletter Delivery and Engagement
Our email provider (Resend) records what happened to each newsletter we send: whether it was delivered, bounced, or marked as spam, whether it was opened, and whether links in it were clicked. Opens are measured with a small tracking image, and links are rewritten to pass through Resend so clicks can be counted. These are recorded against the recipient's delivery record, which means a school can see engagement for the families it sends to.
We use this to show schools whether their newsletters are reaching people and to diagnose delivery problems. We do not use it to build advertising profiles, and we do not sell or share it.
Diagnostics and Error Reports
When something breaks, our error monitoring service (Sentry) records the technical details we need to fix it: the error, the page, the browser, and a timestamp. Before a report leaves our servers it is automatically scrubbed—email addresses, phone numbers, names, IP addresses, and login tokens are stripped out, so the diagnostic tells us what broke without telling us who it happened to. Sentry also captures a replay of a small sample of sessions—roughly one in ten—and of every session where an error occurs, so we can see what sequence of actions triggered a bug. These replays are recorded with all text masked and all images and media blocked: we see the shape of the page and where you clicked, not the words on it and not the photos on it. PostHog records replays of a sample of sessions on exactly the same terms—all text masked, all images and media blocked—so we can watch how a feature is actually used, not just how a bug happened.
What we don't do
- We don't sell your data. Not to advertisers, not to data brokers, not to anyone.
- We don't show ads. Assembly is funded by school subscriptions, not by exploiting your attention.
- We don't train AI models on your content. Your newsletters, class updates, and templates stay yours.
How we use your data
We use your information to:
- Provide and improve Assembly's core features
- Send transactional emails (password resets, notifications, etc.)
- Provide customer support (only when you reach out or when we're fixing a bug that affects you)
- Analyze usage patterns to prioritize new features and improvements. We look at this per school and per account (which features a school's staff use, where a signup stalls), never to evaluate an individual teacher, and we never share it with your school or anyone else
Security is part of the product
We take security seriously—not just because it's required, but because schools trust us with sensitive information. Here's how we protect it:
- Encryption in transit and at rest
- Role-based access controls
- Secure, industry-standard cloud infrastructure
- Continuous monitoring and access logging
Your rights
You have the right to:
- Access your data. Request a copy of everything we have on you.
- Delete your data. Ask us to permanently remove your account and associated information.
- Correct your data. Update inaccurate information directly in your settings or by contacting us.
- Export your data. Download your content in a portable format.
Most of these you can do yourself: export and correction live in your settings, and a school administrator can remove a student or a staff member directly. For anything you can't do in the product, email privacy@assemblynote.com. We'll acknowledge your request within 2 business days and complete it within 30 days, or tell you why we need longer.
If you are a parent or guardian asking about your child's information, contact the school first. The school controls its student records and can act immediately; we act on the school's instruction.
Student privacy (extra important)
AssemblyNote is designed for schools, which means we often handle student information. We comply with FERPA, COPPA, and other education privacy laws.
Schools control what student data gets entered into AssemblyNote—we never collect it independently. And we treat student information with the highest level of care.
How long we keep things
Different data has different lifespans. For each kind below: what we keep it for, why we need it for that long, and when it goes. This is the whole of it, and where something is kept indefinitely we say so rather than leaving it vague.
- Student records — names, grade, guardian name and email. This is what a newsletter is addressed to and personalised from, so we keep it for as long as the school's account is open — without it there is nobody to send to. Deleted permanently when a school administrator removes the student.
- Staff accounts — name, email, phone. How a teacher signs in and how their class updates are attributed, so we keep it while the account exists. When an account is deleted there is a 30-day grace period during which signing back in cancels it; after that the sign-in record is deleted and the profile is permanently anonymised.
- Newsletters and delivery records — rendered newsletters, recipient addresses, and the delivery and engagement events described above. Kept for 24 months so a school can look back at what it sent, answer a family asking about a newsletter from last term, and see which addresses have stopped working — then permanently deleted. That is two school years, so last year's newsletter is still there during the equivalent week this year. Removing a student also removes theirs, straight away.
- Roster import files — the rows staged from a CSV or SIS import. A finished import clears its own staged rows straight away. If an import is abandoned part-way, its rows are kept for up to 90 days so we can answer what a file contained if the import went wrong, then permanently deleted. A student's rows are also scrubbed when that student is removed.
- Staff replies sent by email — when a teacher answers a reminder or an in-app message by replying to the email copy of it, our email provider (Resend) keeps that reply as a received email for 30 days, then deletes it. What we keep is the text of the reply, as the class update or inbox message it became, and a record of what happened to it — not the email itself, and not the address it came from.
- Security and access logs — so a school can see who did what to its records, and so we can investigate if something goes wrong. Kept 30 days to 1 year depending on your plan, then moved to a permanent archive rather than deleted. An audit trail that can be edited to remove people is not much of an audit trail.
- Data Processing Agreement signatures — permanent, deliberately. It is the record of who agreed to what on which date, and it has to outlast the account it describes.
When a school closes its AssemblyNote account, all of the above is permanently deleted 30 days later. The account is read-only during those 30 days and the closure can be cancelled at any point within them, which restores everything. After that the student records, newsletters, delivery history and roster imports are gone and cannot be recovered. Two things deliberately survive: the security and access logs, and the record of who signed the Data Processing Agreement.
One honest caveat: our database provider keeps point-in-time backups, so for a limited period after we delete something a copy can still exist in a backup we cannot selectively edit. Those backups age out on their own.
When this policy changes
If we make meaningful changes to this privacy policy, we'll notify you via email and post an updated version here. We'll never make changes that weaken your privacy protections without giving you a chance to opt out.
Questions? We’re here.
If you have concerns about privacy or want to exercise your data rights, reach out anytime.