Privacy Policy

This page is maintained by the Habitus team to describe, in plain language, what data we collect on behalf of school districts and how we handle it. This is not a substitute for the signed Data Processing Addendum.

Our role

Habitus is a school operating system used by K–12 districts. For student and family data, the district is the data controller and Habitus is a service provider / school official under FERPA. We process data only on the district's documented instructions.

What we collect

• Student records — name, grade, section, enrollment status, behavior entries, attendance, referrals, parent communication logs, and similar district-uploaded data.
• Guardian contacts — name, relationship, email, phone, used for district-initiated communications.
• Staff accounts — name, email, role, school assignment.
• Operational telemetry — sign-in events, audit log of sensitive actions, error reports. Used to keep the service running and to investigate incidents.

What we do not do

• We do not sell or rent student or family data.
• We do not use student data to train third-party AI models.
• We do not show advertising in the platform.

How data is secured

• Encrypted in transit (TLS) and at rest (the database, its backups, and logs).
• Database-enforced row-level security isolates each district's data.
• Administrators must sign in with multi-factor authentication.
• Sensitive actions are recorded in a per-district audit log.
• When enabled, push and text-message alerts for safety events are opt-in, per user.
• We do not use analytics, advertising, or third-party tracking cookies.

Text messages (SMS)

Habitus sends text messages only for operational and safety purposes: system alerts to our own on-call staff, and, where a district enables it, safety alerts to staff who opt in. We never send marketing texts. Message frequency varies; message and data rates may apply. Reply STOP to stop receiving texts, or HELP for help.

Mobile numbers and text-messaging opt-in consent are never shared with or sold to third parties or affiliates for marketing or promotional purposes. They are used only to deliver the messages described above, through our messaging provider (AWS).

Subprocessors

Habitus uses a small set of subprocessors to host the platform and handle sign-in. The current list is public on our subprocessors page, and we give district administrators at least 30 days' notice before adding one that handles district data.

Data retention and deletion

Districts can export their data from Admin → Backups & Data Export at any time, and can request deletion by contacting us. On contract termination, district data is returned or deleted per the DPA, within 30 days unless the district requests otherwise.

Parent and student requests

Parents and eligible students should contact their school district directly to exercise FERPA or state privacy rights. Habitus will support the district in responding.

Contact

Privacy questions: open a request from the in-app Contact support page, or email ryanhallford@admysterium.com.

Last updated: 2026-10-08.