REWARDVAULT ← Back to home

Privacy Policy

Effective date: April 11, 2026  ·  Last updated: April 11, 2026

1. Who We Are

RewardVault ("we," "us," or "our") is a software-as-a-service platform operated by RewardVault. We provide schools with a digital recognition and reward management system that replaces paper-based currency programs. Our registered contact address and data inquiries email are listed at the bottom of this document.

2. Who This Policy Covers

This policy applies to all users of the RewardVault platform, including:

• School administrators who configure and manage the platform
• Staff members (teachers, approvers, store managers) who use the platform to award and fulfill requests
• Students who receive recognition and access the student wallet and store
• Visitors to getrewardvault.com who do not have an account

When a school subscribes to RewardVault, the school or school district is the data controller for student and staff data. RewardVault acts as a data processor on the school's behalf.

3. Data We Collect

From school administrators during account setup:

• School name, school district, and school address
• Administrator name and professional email address
• Billing contact information (processed through Stripe; we do not store payment card numbers)

From staff roster import:

• Staff name (salutation, first name, last name)
• Professional email address
• Role assignment within the platform

From student roster import:

• Student first name and last name
• Grade level and homeroom classroom assignment
• Student ID (SIS ID) provided by the school
• Student email address (if provided by the school for account linking)

Generated through platform use:

• Award records: which staff member sent an award, which student received it, the amount, the behavior reasons selected, and the timestamp
• Store transaction records: items requested, quantities, approval status, and fulfillment status
• Student wallet balances and transaction history
• Login activity logs for security purposes

We do not collect:

• Student Social Security numbers
• Student home addresses
• Biometric data of any kind
• Health or medical information
• Behavioral or disciplinary records beyond what a school administrator explicitly enters
• Any data from students under 13 beyond what is described above and authorized by the school

4. How We Use Data

We use the data described above solely to operate and improve the RewardVault platform. Specifically:

• To authenticate users and maintain secure sessions
• To display student rosters to authorized staff for the purpose of sending recognition awards
• To maintain accurate currency balances in student wallets
• To process and fulfill student store requests
• To generate activity reports visible to school administrators
• To send transactional emails (password setup links, billing receipts) to authorized staff and administrators
• To diagnose technical issues and improve platform reliability

5. FERPA Compliance

RewardVault is designed for use in schools subject to the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g. Student records stored in RewardVault are "education records" under FERPA.

When a school uses RewardVault, we operate as a "school official" with a "legitimate educational interest" as permitted under FERPA 34 CFR § 99.31(a)(1). This means:

• We access student data only as directed by and on behalf of the school
• We do not disclose student education records to third parties without school authorization, except as required by law
• Schools retain ownership and control of all student data they provide to us
• We support schools in fulfilling FERPA-related parent and student data access requests

Schools that require a signed Data Processing Agreement (DPA) before using our platform may request one at info@getrewardvault.com. We maintain a standard DPA that aligns with Student Data Privacy Consortium (SDPC) requirements.

6. COPPA and Students Under 13

RewardVault is operated as a school-directed service. We do not knowingly collect personal information directly from children under 13 for our own purposes. Student data entered into the platform is provided by the school under the school's authority and parental consent framework.

Under the Children's Online Privacy Protection Act (COPPA), schools may provide consent on behalf of parents for the collection of student data when the service is used solely for educational purposes and is consistent with the school's authorization under COPPA's school consent exception.

If a parent believes their child's information has been collected without appropriate authorization, they should contact their school administrator first. Parents may also contact us directly at info@getrewardvault.com.

7. Data Sharing and Third Parties

We do not sell student or staff data. We do not share data with advertisers. We do not share data with data brokers.

We use the following third-party service providers to operate the platform. Each is contractually required to handle data only as necessary to provide their service:

• Stripe — payment processing for school subscription billing. Stripe's privacy policy is available at stripe.com/privacy. We do not store payment card numbers.
• Hosting and infrastructure provider — Namecheap.com. All data is stored in the United States.
• Postmark (Wildbit LLC) — delivery of password setup links and system notifications to authorized staff accounts only.

We may disclose data if required to do so by law, court order, or lawful government request. We will notify affected schools of any such request to the extent permitted by law.

8. Data Security

We implement technical and organizational measures to protect the data in our care, including:

• Passwords are hashed using industry-standard algorithms. We never store passwords in plain text.
• All data transmission between users and our servers is encrypted using TLS.
• Student passwords are temporary and school-supervised. They are only displayed at the moment of creation and are not stored in recoverable form after that point.
• Staff setup links expire after use.
• Access to student data within the platform is role-restricted. Teachers see only the students in their school. Students see only their own data.
• We maintain access logs for security monitoring.

No system is completely secure. In the event of a data breach that affects student or staff personal information, we will notify affected schools within 72 hours of discovery and cooperate fully with required notification procedures.

9. Data Retention and Deletion

We retain school and student data for as long as the school's subscription is active.

When a school cancels its subscription:

• The school administrator may request a full data export before cancellation at no charge.
• All student and staff data associated with the school will be permanently deleted from our systems within 30 days of subscription end.
• We will send a written confirmation of deletion to the school's registered administrator email upon completion.
• Anonymized, non-identifiable aggregate usage statistics may be retained for platform improvement purposes.

Schools may request deletion of specific records at any time by contacting info@getrewardvault.com. We will fulfill deletion requests within 10 business days.

10. Parent and Student Rights

Parents and eligible students (age 18+) have rights under FERPA regarding education records. Because RewardVault operates as a service provider to schools rather than as the custodian of record, most rights requests should be directed to the student's school first.

Schools may contact us to facilitate:

• Access to a specific student's data held in RewardVault
• Correction of inaccurate student data
• Deletion of a specific student's data

We will respond to school-directed data requests within 10 business days.

11. Cookies and Tracking

RewardVault uses session cookies strictly necessary for authentication and platform operation. We do not use third-party advertising cookies. We do not use tracking pixels or behavioral analytics tools that share data with third parties.

Visitors to getrewardvault.com who do not have an account may be subject to standard web server logging (IP address, browser type, pages visited) for security and performance purposes only. This data is not linked to any individual identity and is not shared.

12. Changes to This Policy

We may update this Privacy Policy as the platform evolves or as legal requirements change. When we make material changes, we will notify active school administrators by email at least 14 days before the changes take effect. The effective date at the top of this document will always reflect the most current version.

Continued use of RewardVault after a policy update constitutes acceptance of the revised terms.

13. Governing Law

This Privacy Policy is governed by the laws of the United States and the state of Illinois. Any disputes arising from this policy will be resolved in accordance with those laws.