Loading page…
Last updated: September 24, 2026
This page summarizes the data processing terms UnTapped Genius (“UG,” “we,” “us”) operates under when a district or campus partner uses Genius OS. A signed, district-specific Data Processing Agreement covering these same terms is available on request as part of contracting; this page is the plain-language summary of what that agreement contains, published so a reviewer doesn’t have to request a document to know what’s in it.
The district or campus partner is the data controller: it determines what data goes into Genius OS and for what purpose. UG acts as a data processor, handling that data only to provide the platform and the underlying partnership services, and only under the district’s instructions as reflected in our service agreement.
Partnership records entered into Genius OS: goals and key results, evidence and coaching video, KPI and observation data, and the staff account information (names, emails, roles) needed to operate the platform. Genius OS is not designed to be a system of record for individual student-level education records, and student-identifiable data is not a data type the platform is built to collect as part of its core workflow. If student-identifiable data is going to flow through the platform in a specific use case, for example inside an uploaded file or a coaching note, tell us and we’ll document that specifically rather than relying on this general statement.
We process district data only to operate Genius OS and support the partnership: goal and KPI tracking, evidence and portfolio management, reporting, and related platform features. We do not sell district or campus data, and we do not use it for advertising or for purposes unrelated to the services we provide. See our Security Overview for the technical and organizational measures we use to protect it.
We rely on a defined set of subprocessors to deliver Genius OS, each scoped to a specific function (hosting, database, file storage, email, video, and similar). See our Subprocessors page for the current list. We don’t add a new subprocessor with access to district data without it appearing there.
Application compute, our database, file storage, and video storage are all provisioned in United States regions. Vercel’s content delivery network, which caches static public-site assets, is global by design; application code execution and all persistent storage of district data stay in our configured U.S. region.
If we become aware of a security incident involving a district’s data, we will notify the affected district without unreasonable delay, and when feasible, within 48 hours of confirming an incident meets our notification threshold. This is the standard commitment in our Consulting Agreement, not just an internal target. We’re glad to discuss specific notification timeline requirements as part of contracting.
The district retains ownership of the data it inputs into Genius OS. At contract end, we will work with the district to export or delete its partnership data on request. We do not claim ownership rights over district-generated inputs, outputs, or metadata. We will not destroy records subject to an active litigation hold or a Texas Public Information Act preservation request, even past a normal retention window, and we will reasonably assist a district in responding to lawful requests for records we created or maintain as part of the engagement.
After a Statement of Work ends, we may retain and use data that has been de-identified or aggregated to the point that it cannot reasonably identify your district, its staff, or its students, and does not disclose any protected or confidential information, for purposes such as case studies, research, proposals, and marketing materials. This is distinct from, and doesn’t change, our commitment above not to sell your data or use it for advertising: de-identified/aggregate data by definition can’t be traced back to you.
UG staff and consultants with access to district data are subject to role-based access controls scoping them to only the districts and campuses they’re assigned to, and to confidentiality obligations as part of their engagement with UG.
If your district requires a countersigned Data Processing Agreement, including specific FERPA “school official” designation language or terms particular to your procurement process, contact us and we’ll get that in place as part of contracting.
Email us at ug@untappedgenius.org or use our contact page.