PickupFlow™ Privacy Policy

PickupFlow ("we," "our," or "us") is a school dismissal management application operated by CM Santos Group LLC, doing business as Nexpath Infrastructure. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application, web application at app.pickupflow.app, and related services (collectively, the "Service").

By using PickupFlow, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use our Service.

1. Information We Collect

1.1 Information You Provide

• Account Information: When you create an account, we collect your name, email address, and password. For guardians, we also collect phone number and relationship to enrolled students.
• Student Information: Schools provide student names, grade levels, homeroom assignments, and optional student IDs. Guardians are linked to students through school-issued enrollment codes. Staff may add notes about students visible only to school personnel (e.g., special dismissal instructions).
• Vehicle Information: Guardians may register vehicle details (make, model, color, and license plate number) to facilitate identification during pickup.
• Authorized Pickup Persons: Primary guardians may designate additional authorized individuals who can pick up their students, including their names, email addresses, phone numbers, and relationship to the student.
• In-App Messages: Guardians and school staff may exchange messages through the Service. Messages include sender and recipient names, roles, associated student (if applicable), and message content. Messages are stored to provide conversation history.
• Calendar Images (School Administrators only): School administrators may upload images of school calendars for AI-powered conversion to digital calendar events. These images are processed and immediately deleted; they are not stored permanently.
• Staff Information: School administrators provide staff names, email addresses, and job titles (e.g., Teacher, Principal) when adding staff to the Service.

1.2 Information Collected Automatically

• Location Data: With your permission, we collect precise GPS location data when you use the "On My Way" or "I'm Here" features. This data is used solely to calculate your proximity to the school for arrival notification and is not stored after your pickup session ends. Location data is processed locally on your device for distance calculations.
• Camera Access: With your permission, we access your device's camera solely to scan QR codes during the student enrollment process. We do not capture, store, or transmit any images or video. The camera processes QR codes locally on your device, and only the decoded enrollment code text is transmitted to our servers.
• Device Information: We collect device identifiers, operating system version, and app version for troubleshooting and service improvement.
• Push Notification Tokens: We collect Firebase Cloud Messaging (FCM) tokens to send you notifications about pickup status, student dismissal, and school announcements. You can configure notification preferences including per-type toggles and quiet hours within the app.
• Crash Logs and Diagnostics: We automatically collect crash logs, performance data, and diagnostic information to identify and fix technical issues. Crash reports include a pseudonymous user identifier for troubleshooting but do not include names, email addresses, school information, or student data. We actively redact sensitive information from error reports.

1.3 Biometric Authentication

PickupFlow offers optional biometric authentication (Face ID, Touch ID, or fingerprint) as a convenience feature for guardians and staff to unlock the app and re-authenticate during active pickup sessions.

• On-device only: Biometric authentication is processed entirely on your device using your device's built-in biometric hardware and operating system APIs. We never receive, transmit, or store your biometric data (fingerprints, facial geometry, etc.) on our servers.
• Credential storage: If you enable biometric login, your encrypted login credentials are stored in your device's secure enclave (iOS Keychain or Android Keystore). These credentials remain on your device and are protected by your device's hardware-level encryption.
• Optional: Biometric authentication is entirely optional. You can enable or disable it at any time in Settings. Disabling it removes the stored credentials from your device.
• Adults only: Biometric authentication is available only to adult users (guardians and staff). It is never used by or applied to children.

2. Photo Library Access

School administrators may grant PickupFlow access to their device's photo library to upload images of school calendars. This access is:

• Only requested from school administrator accounts
• Used solely for uploading calendar images for AI processing
• Not used to access personal photos
• Not used for any marketing or tracking purposes

Parents and guardians are never asked for photo library access.

3. AI-Powered Features

3.1 Calendar Processing

PickupFlow uses artificial intelligence to convert images of school calendars into digital calendar events.

How it works:

• School administrators upload an image of a printed or digital school calendar
• The image is securely transmitted to our AI processing service
• AI extracts dates, event names, times, and descriptions from the image
• Extracted events are added to the school's digital calendar

Data handling:

• Calendar images are processed in real-time and automatically deleted immediately after processing
• We do not retain copies of uploaded calendar images
• Extracted calendar data is stored within your school's secure account
• Images are never used for AI training or any other purpose

Third-party AI processing: Calendar images may be processed using third-party AI services (such as Google ML Kit for on-device text recognition). These services only receive the calendar image for processing, are bound by data processing agreements, and do not receive any user account information or student data.

Recommendations for Schools: When uploading calendar images, we recommend using calendars that do not contain student names or personal information, reviewing extracted events for accuracy before publishing, and only granting calendar upload access to authorized staff members.

3.2 AI Support Assistant

PickupFlow offers an AI-powered support assistant within the app to help answer questions about using the Service.

• Support conversations are stored in your school's secure environment to provide conversation history and improve support quality
• Conversations are processed using AI to generate helpful responses
• AI support conversations are rate-limited by role to prevent abuse
• Support conversations are retained for 6 months, then automatically deleted
• Anonymized usage metrics (not conversation content) may be retained for up to 12 months to improve the support experience

4. How We Use Your Information

We use the information we collect to:

• Provide and maintain the Service
• Facilitate communication between guardians and school staff during dismissal
• Verify guardian identity and authorization for student pickup
• Send push notifications about pickup status and school announcements
• Enable in-app messaging between guardians and school staff
• Process calendar images and create calendar events (school administrators only)
• Provide AI-powered support assistance
• Generate pickup analytics and reports for school administrators
• Improve and optimize our Service
• Comply with legal obligations
• Protect the safety of students, guardians, and school personnel

5. Information Sharing and Disclosure

• With Schools: We share guardian and student information with the schools where students are enrolled. Schools can view guardian arrival status, vehicle information, and pickup history. Authorized school personnel may export student rosters, guardian contact information, and pickup history for school record-keeping purposes.
• With Other Guardians: Primary guardians can see authorized pickup persons they have designated. Authorized pickup persons can see the students they are authorized to pick up. Guardians participating in carpool arrangements can see limited information about other participating guardians as necessary to coordinate pickup.
• Service Providers: We use the following third-party services to operate the Service:
  • Google Firebase: Authentication, database, cloud functions, push notifications, crash reporting, and app integrity verification
  • Google Cloud Platform: Hosting and infrastructure
  • SendGrid (Twilio): Transactional emails including email verification, password reset, enrollment letters, and school invitations
  • Google Sign-In: Optional single sign-on (SSO) authentication for schools using Google Workspace. During SSO, Google processes the authentication request and returns basic profile information (name and email)
  • Google Places API (optional): If enabled by a school, address autocomplete for school location configuration. Search queries are sent to Google and are subject to Google's privacy policy

  These providers are bound by contractual obligations and data processing agreements to protect your data.

• AI Processing Services: Calendar images uploaded by school administrators are processed using AI services to extract event information. Support conversations may be processed using AI services to generate responses. These services do not receive student data or personally identifiable information beyond the content being processed.
• Legal Requirements: We may disclose your information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit using TLS/SSL
• Secure authentication through Firebase Authentication with email verification
• Role-based access controls limiting data access to authorized personnel
• Firebase App Check for app integrity verification
• Rate limiting on sensitive operations to prevent abuse
• Biometric credentials stored in hardware-encrypted secure storage (iOS Keychain / Android Keystore), never on our servers
• Active redaction of sensitive data from crash reports and error logs
• Regular security assessments and monitoring
• Secure cloud infrastructure hosted on Google Cloud Platform
• Immediate deletion of calendar images after AI processing

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service.

• Account data is retained while your account is active. When you delete your account, your login credentials and personal profile are deleted immediately and permanently — there is no waiting period, and the deletion cannot be reversed (see Section 10.4 for details).
• Pickup records document that a specific student was released to a specific authorized adult at a specific date and time. These are safety and attendance records belonging to your child's school, which we maintain on the school's behalf as a "school official" under FERPA. They are not automatically deleted or expired, and are retained for as long as the school requires them. Pickup records are deleted only at the school's direction, in accordance with the school's records-retention obligations and applicable law. These records identify the participants in a pickup — including the name of the adult who collected a student — and that information is retained even after that adult deletes their PickupFlow account (see Section 10.4).
• In-app messages between guardians and school staff are automatically deleted six months after the conversation is created. If you delete your account before then, your participant entry is removed from the conversation, but the text of messages you sent — and the sender name shown on them — remains until the conversation is deleted.
• Notifications are automatically deleted within 30 days, and most types are deleted within 14 days.
• Support conversations are retained for 6 months, then automatically deleted.
• AI support analytics (anonymized usage metrics only) are retained for 12 months, then automatically deleted.
• Location data from pickup sessions is used for real-time distance calculations on your device and is not stored on our servers.
• Calendar images are deleted immediately after AI processing is complete; they are not stored.
• Extracted calendar events are retained as part of the school's calendar data.
• Biometric data is never stored on our servers. On-device credentials are removed when you disable biometric login or delete your account.

Schools retain pickup records in accordance with their record-keeping policies and applicable law, and direct us as to their deletion. When you delete your account, we delete your account profile and contact information from our active systems immediately. However, completed pickup records that document who collected a student are the school's safety records and are retained — including your name — for the school's audit, attendance, and child-safety purposes, even after your account is deleted. These records retain the names of the participants and, where a vehicle was used, the vehicle description recorded for that pickup; they do not retain your email address, phone number, or account profile.

8. Children's Privacy and COPPA Compliance

PickupFlow is designed for use by adults — guardians and school staff. The Service complies with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506) and its implementing regulations (16 CFR Part 312).

8.1 How We Handle Children's Information

• No direct collection from children: We do not collect personal information directly from children under 13. Children do not create accounts, log in, or interact with the Service. Student information is provided solely by schools and parents/guardians.
• Limited student data: The only student information we process is: first name, last name, grade level, homeroom assignment, school-assigned student ID, guardian linkage, transportation mode preferences, and optional staff notes (e.g., dismissal instructions). We do not collect student photographs — the photo field in our system is always empty.
• No behavioral tracking: We do not track, profile, or create behavioral profiles of students. No analytics identifiers, cookies, or tracking pixels are associated with student records.
• No biometric data from children: Biometric authentication is available only to adult users. No biometric data is collected from or about children.

8.2 School Official Exception

Under COPPA's "school official" exception (16 CFR § 312.5(c)(2)), schools may consent to the collection of student information on behalf of parents solely for school-authorized educational purposes. When a school subscribes to PickupFlow:

• The school acts as the agent of the parent for purposes of consenting to the collection of student information
• The school is responsible for providing notice to parents about the Service's data practices
• Student information is used solely for the school-authorized purpose of managing student dismissal
• We do not use student information for any commercial purpose unrelated to the school's authorized educational purpose

8.3 Parental Rights Under COPPA

Parents and guardians have the right to:

• Review: Request a review of the personal information we have collected about their child by contacting us or their school
• Delete: Request deletion of their child's personal information from our systems by contacting us or their school. Schools can withdraw a student through the Service, which deactivates the student's record and immediately ends pickup access; the underlying record is retained as part of the school's education records until the school directs us to delete it
• Refuse further collection: Direct us to stop collecting their child's personal information by contacting us or their school, understanding that this may require the school to remove the student from the Service

To exercise these rights, parents may contact their school directly or contact us at privacy@pickupflow.app. We will respond to verified requests within 30 days.

8.4 Data Minimization for Children

We practice data minimization for all student information. Our crash reporting service receives only a pseudonymous user identifier — it does not receive student names, school identifiers, or any student-associated data. We redact student-related keywords from error reports before they leave the device.

If we learn that we have inadvertently collected personal information from a child under 13 without proper consent, we will promptly delete that information and notify the relevant school. If you believe we have collected such information, please contact us immediately.

9. Student Education Records (FERPA)

PickupFlow may process student education records as defined by the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g). With respect to FERPA:

• We operate as a "school official" under the school's direct control as defined by 34 CFR § 99.31(a)(1), providing a service for which the school would otherwise use its own employees
• We use education records only for the purposes for which the school authorized access — specifically, managing student dismissal and pickup coordination
• We do not re-disclose education records to third parties except as described in this Privacy Policy and as permitted by the school's FERPA policies
• Schools control access to their student education records and may request deletion at any time
• We maintain the confidentiality of education records in accordance with FERPA requirements

Schools subscribing to PickupFlow execute a Data Processing Addendum that governs the processing of student education records and ensures compliance with FERPA, COPPA, and applicable state student privacy laws.

10. Your Rights and Choices

10.1 General Rights

• Access and Correction: You may access and update your account information through the app settings at any time.
• Location Permissions: You can enable or disable location services through your device settings. Disabling location services will prevent the use of arrival notification features.
• Camera Permissions: You can enable or disable camera access through your device settings. If disabled, you can still complete enrollment by manually entering the enrollment code.
• Photo Library Permissions: School administrators can enable or disable photo library access through device settings. Disabling this will prevent the use of the AI calendar conversion feature.
• Biometric Authentication: You can enable or disable biometric login at any time in Settings. Disabling it removes stored credentials from your device.
• Push Notifications: You can manage notification preferences within the app, including per-type toggles (pickup, calendar, announcements) and quiet hours. You can also disable notifications entirely through your device settings.
• Account Deletion: You can delete your account at any time from within the PickupFlow app. Go to Settings → Account Settings, open the Delete Your Account section, and tap Delete My Account. You will be asked to confirm twice and to type DELETE; if you sign in with a password, you must also re-enter it. Deletion is immediate and permanent and cannot be undone, and you will receive an email confirming that your account has been deleted. Completed pickup records are retained by your school and continue to identify the adult who collected a student — see Section 10.4 for exactly what is deleted and what is kept. For step-by-step instructions, visit our account deletion help page.

10.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, completing a transaction).
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale: We do not sell your personal information. We do not share personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: We use sensitive personal information (such as precise geolocation) only for purposes authorized by you and as necessary to provide the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

Categories of personal information we collect: Identifiers (name, email, phone); geolocation data (with permission, during pickup only); professional or employment-related information (job title for staff); education information (student records provided by schools).

To exercise your rights, contact us at privacy@pickupflow.app. We will verify your identity and respond within 45 days.

10.3 Other State Privacy Laws

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), or Texas (TDPSA), you may have additional rights including the right to access, correct, delete, and obtain a copy of your personal data, and the right to opt out of targeted advertising. We do not engage in targeted advertising, sell personal data, or profile users for automated decision-making.

To exercise your rights under any applicable state law, contact us at privacy@pickupflow.app. If we decline your request, you may appeal by contacting us with "Privacy Appeal" in the subject line.

10.4 What Is Retained After Account Deletion

What is deleted. When you delete your PickupFlow account, we delete your login credentials and your personal profile — including your email address, phone number, profile details, registered vehicles, notification preferences, and device push tokens. We also delete your notifications, your support conversations and support tickets, your authorized-pickup relationships, your school membership records, and any pickup you had in progress at the time. On-device biometric credentials, if you enabled biometric login, are removed from your device. Deletion begins immediately, is permanent, and cannot be reversed. You will receive an email confirming that your account has been deleted.

What is retained, and why. Your name remains associated with completed pickup records you participated in. A pickup record is the school's record of who collected a child — a safety and attendance record the school controls and may be legally required to keep. These records retain the names of the participants and, where a vehicle was used, the vehicle description recorded for that pickup. They do not retain your email address, phone number, or account profile. We may also retain limited information where reasonably necessary to comply with our legal and contractual obligations, protect the safety and security of children, families, and schools, investigate safety incidents, prevent unauthorized pickups, and establish or defend legal claims.

Messages. Deleting your account removes your participant entry from message threads with school staff, but the text of messages you sent, and the sender name shown on them, remain until the thread is deleted six months after it was created.

Your school's records. Because completed pickup records belong to your child's school, requests to delete or correct them are directed by the school. To request review, correction, or deletion of a school record, please contact your child's school. Staff and administrator accounts follow the same account-deletion process; actions a staff member recorded remain part of the school's operational records.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and within the app, and updating the "Effective Date" above. For significant changes affecting the collection or use of children's information, we will provide direct notice to schools. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us at: