Privacy Policy

Effective date: June 10, 2026 · Last updated: June 10, 2026

This Privacy Policy explains how Norventis (“Norventis,” “we,” “us,” or “our”) collects, uses, and protects information in connection with the Norventis education-analytics platform and the website at norventis.ai (collectively, the “Service”). It applies to visitors to our website and to authorized users of the Service.

1. Who we are and our role

Norventis provides a software platform that helps K-12 school districts analyze financial, operational, and publicly available education data. Most of the data processed in the Service originates from public records (for example, Ohio Department of Education, Auditor of State, EMIS, and federal NCES datasets) or is provided to us by a school district that subscribes to the Service.

Where a school district provides us with data, the district is the party that controls that data and decides how it is used. In those cases, Norventis acts as a service provider / processor and, where applicable, as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (“FERPA”). We process district-provided data only to deliver the Service under our agreement with that district. If you are a student, parent, or staff member of a district, please direct privacy requests about district data to your district, which can then instruct us.

2. Information we collect

Information you give us

Account information — name, work email, district affiliation, and role, created when a district administrator provisions an account.
Communications — messages you send us (for example, support or sales inquiries).

District and public data

Public education data — district financial reports, enrollment, levy results, performance metrics, and similar information drawn from public state and federal datasets.
District-provided data — information a subscribing district uploads or authorizes us to access in order to analyze its own operations. We do not seek individual student personally identifiable information; the Service is designed to operate on aggregate and district-level data.

Information collected automatically

Authentication and security data — login events, IP address, and device/browser information, used to secure accounts (via Amazon Cognito) and detect suspicious activity.
Operational logs — server and application logs needed to run, secure, and troubleshoot the Service.

We do not use third-party advertising trackers, and we do not sell personal information.

3. How we use information

To provide, operate, secure, and improve the Service;
To authenticate users and protect against unauthorized access, fraud, and abuse;
To respond to inquiries and provide customer support;
To comply with legal obligations and enforce our agreements.

We process information only for the purposes described here or as directed by the subscribing district.

4. Student data and children’s privacy

The Service is a business tool intended for use by district staff and leadership; it is not directed to children, and we do not knowingly allow students under 13 to create accounts. To the extent any student data is made available to Norventis by a district, we handle it consistent with FERPA and applicable state student-data-privacy laws, use it only to provide the Service to that district, do not use it for advertising or to build user profiles unrelated to the Service, and delete or return it as described in Section 8 and in our agreement with the district.

5. How we share information

We do not sell personal information. We share information only as follows:

Service providers (subprocessors) — we host the Service on Amazon Web Services (AWS). AWS stores and processes data on our behalf under its data-protection commitments. A current list of subprocessors is available on request.
Within your district — authorized users at your district can see the district’s own data in the Service.
Legal and safety — when required by law, subpoena, or to protect the rights, safety, and security of users, the public, or Norventis.
Business transfers — in connection with a merger, acquisition, or sale of assets, subject to the protections of this Policy.

6. Where data is processed

The Service is hosted in the United States (AWS, U.S. region). By using the Service you understand that information is processed in the United States.

7. Security

We take security seriously and apply industry-standard safeguards, including encryption in transit (TLS 1.2+), authentication and threat-protection controls through Amazon Cognito, network and access restrictions, secrets management, parameterized database access, and continuous monitoring with alerting. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. We continue to harden the platform as we grow (see our published security roadmap).

8. Data retention

We retain account and operational data for as long as an account or subscription is active and as needed to provide the Service. District-provided data is retained according to our agreement with the district and is deleted or returned upon termination, subject to legal retention requirements. Public education data may be retained as part of historical and benchmarking analysis.

9. Your choices and rights

Depending on where you live and applicable law (for example, the California Consumer Privacy Act), you may have the right to access, correct, or delete personal information we hold about you, and to receive a copy of it. To exercise these rights for account information, contact us at the address below. For data your district controls, we will refer your request to the district. We will not discriminate against you for exercising these rights.

10. Cookies

We use only the cookies and local browser storage strictly necessary to keep you signed in and to operate the Service securely. We do not use advertising or cross-site tracking cookies.

11. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will revise the “Last updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact us

Questions about this Policy or our privacy practices can be sent to:

Norventis
Privacy: privacy@norventis.ai
General: admin@norventis.ai