Our Data Model
ThinkKits operates two distinct data layers — it is important to understand both.
Layer 1 — Intelligence layer (public federal data): ThinkKits aggregates publicly available federal data from NCES, USASpending.gov, USAC E-Rate, and state education agencies. This data is published by the federal government, contains no individually identifiable student information, and is available to anyone.
Layer 2 — Account data (owned by the account holder): Data created by users on the platform — saved searches, grant applications, team comments, uploaded files — is owned by the account holder, not by ThinkKits. ThinkKits acts solely as a data custodian. This data is never shared, sold, or analyzed across accounts.
We do not collect, store, process, or have access to:
- Student names, grades, or academic records
- Individually identifiable student information of any kind
- Parent or guardian personal data
- Student disciplinary records
- Student health records
FERPA Applicability
Key Point
ThinkKits does not access, collect, or process student education records as defined under FERPA (20 U.S.C. § 1232g; 34 CFR § 99.3). All school-level intelligence data is sourced from publicly available federal datasets and contains no individually identifiable student information. Account data created on the platform is owned by the account holder and is not shared, sold, or used for any purpose other than providing the service. District-uploaded enrollment data contains aggregate counts only — no individual student records — and remains the sole property of the uploading district.
We document our practices in full because district procurement teams need to verify these claims. Transparency is the standard.
What We Process vs. What We Don’t
| Data Category | We Process | We Don’t Process |
|---|---|---|
| School demographics (name, address, type, locale) | ✓ Publicly available via NCES CCD | — |
| Enrollment counts (total, by grade, by race/ethnicity) | ✓ Aggregate counts from NCES | ✗ Individual student enrollment |
| Free/Reduced Lunch percentages | ✓ School-level % from NCES | ✗ Individual student eligibility |
| Federal funding allocations | ✓ Title I, IDEA, E-Rate from public sources | ✗ Individual student funding |
| Assessment proficiency rates | ✓ School-level % proficient from state DOEs | ✗ Individual student scores |
| Board meeting minutes | ✓ Publicly posted agendas/minutes | ✗ Executive session content |
| User account data | ✓ Email, name, org (from Clerk auth) | ✗ Student/parent accounts |
| Platform account data (searches, grants, comments) | ✓ Owned by account holder, custodied by ThinkKits | ✗ Shared, sold, or analyzed across accounts |
| District SIS uploads (enrollment counts) | ✓ Aggregate counts only, owned by uploading district | ✗ Individual student records or cross-district sharing |
FERPA Does Not Apply to ThinkKits
ThinkKits processes only publicly available, aggregate education data. No student personally identifiable information (PII) is collected, stored, or processed. FERPA does not apply to ThinkKits’ data practices.
Because ThinkKits never receives education records from schools, no FERPA exception — including the school official exception under 34 CFR § 99.31(a)(1) — is required or relied upon. Districts send us no student data; there is nothing to regulate.
If a district’s DPA template includes school official exception language as boilerplate, we will sign it and note in the agreement that no covered data flows to ThinkKits under normal platform operation.
Data Handling Practices
Even without FERPA-regulated data, we follow best practices:
- Encryption — AES-256 at rest, TLS 1.3 in transit
- Access Control — Role-based access via Clerk with MFA support
- Audit Logging — All data access logged with 3+ year retention
- Data Minimization — We only store data necessary for platform functionality
- Retention — User account data retained while account is active; deleted within 30 days of account closure
- Vendor Assessment — All sub-processors assessed for security practices
Parent Rights Under FERPA
72-Hour Breach Notification
In the unlikely event of a data breach affecting user account information (email, name, organization), ThinkKits commits to:
- Notifying affected users within 72 hours of confirmed breach
- Notifying the relevant district administrator if organizational accounts are affected
- Filing required state breach notifications per applicable state law
- Providing a detailed incident report within 30 days
Data Processing Agreement
We maintain a standard Data Processing Agreement (DPA) template aligned with the Student Data Privacy Consortium (SDPC) National DPA. Districts can:
- Download our pre-signed DPA from the Trust Center
- Submit their own DPA for review (typical turnaround: 5 business days)
- Contact legal@thinkkits.com for custom DPA requests
Contact
For FERPA-related questions: privacy@thinkkits.com | (267) 936-0332