Privacy Policy

Effective date: July 1, 2026

Basin is a school-to-family communication and operations platform, provided to schools that choose to use it. This policy explains what data we collect on a school's behalf, why, and how it is protected. We do not sell data. We do not use data for advertising. Ever.

1. Who We Are

Basin is developed and operated by Brian McDaniel (contact: hello@basinschools.com). When this policy refers to "Basin," "we," "us," or "our," it means us. When it refers to "school," it means the independent school that has engaged Basin to provide this service to its staff and families.

2. Our Role — A Service Provider to Schools

Basin acts on behalf of the school as a service provider for the limited purpose of school-to-family communication and operations. The school remains the party responsible for its students' educational records and for complying with FERPA and any other applicable law. Basin does not sell, disclose, or use data for any purpose beyond providing the service the school has engaged us for.

3. What Basin Does NOT Store

By design, Basin does not store or process:

  • Grades, transcripts, or other academic records — Basin is a communication and operations layer, not a gradebook or student information system.
  • Social Security numbers, financial account information, or biometric data — ever, from anyone.

4. What We Collect

  • Staff account information: Name, email, and role, provided by the school for staff who use Basin's dashboard.
  • Family/roster information: Child name, grade, classroom/teacher assignment, and parent contact information, provided by the school so communications can be routed correctly.
  • Operational safety notes: Allergy or medical notes a school chooses to share with a substitute teacher for coverage purposes — nothing beyond what the school itself already records for that purpose.
  • Messages and broadcasts: School-to-family announcements, forms, and responses sent through Basin, along with delivery, read, and acknowledgment status.
  • Device information: Push notification tokens, device type, and OS version, to deliver notifications reliably.

5. How We Use Data

  • To deliver school communications, forms, and program registrations to the correct families.
  • To power AI-assisted features (e.g. drafting a progress note, answering a staff roster question) — always scoped to the requesting staff member's own school, never trained on by the underlying AI provider.
  • To track delivery, read, and response status so a school can confirm a message actually reached families.

6. Who We Share Data With

  • Supabase (database and authentication) — data is stored on Supabase servers hosted on AWS, SOC 2 compliant.
  • OpenAI (AI-assisted drafting and query features) — used with API-level data protections; not used to train models.
  • Families, through Koalie — parents receive relevant communications, forms, and program information through their own Koalie account.

We do not share data with advertisers, data brokers, or any third party for commercial purposes.

7. FERPA

Basin handles data as directed by the school and acts under the "school official" exception where applicable, using data only for the purpose the school has authorized. Basin does not independently disclose educational records to third parties.

8. Data Security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256). Access is enforced by row-level security, scoped per school — one school's staff cannot access another school's data. We do not store passwords in plain text.

9. Data Retention and Deletion

Data is retained for the duration of a school's engagement with Basin. If a pilot or contract ends, the school's data is deleted within 30 days unless the school requests otherwise in writing.

10. Changes to This Policy

We may update this policy as Basin grows. Schools will be notified of material changes at least 14 days before they take effect.

11. Contact Us

Questions about this privacy policy: hello@basinschools.com