Compliance

MyFeelingsMatter operates as a "school official" with legitimate educational interest under FERPA §99.31(a)(1)(i)(B). All education records remain under the control of the educational agency.

• We use student data only for the educational purposes the district authorizes.
• We do not re-disclose personally identifiable information (PII) without district consent.
• Districts may access, correct, or delete student records at any time.
• Student data is returned or destroyed upon contract termination (default: 90 days).
  

For students under 13, the school provides consent on behalf of parents under the FTC's school-consent exception.

• We collect only the minimum data needed for SEL instruction: first/chosen name, grade level, and SEL responses.
• We do not serve behavioral advertising or build marketing profiles of students.
• Parents may review or request deletion of their child's data through the school's FERPA official.
  

We sign the Student Data Privacy Consortium (SDPC) National DPA v2.0, the standard agreement accepted by thousands of US school districts.

Once signed and listed on the SDPC Resource Registry, the DPA is reusable across districts in the same state — no per-district renegotiation.

Email privacy@myfeelingsmatter.online with your district name and state to start the signing process.

We accept and sign the following state addendums on request:

• California — AB 1584 / SOPIPA
• New York — Ed Law 2-d (Parents' Bill of Rights)
• Illinois — SOPPA
• Texas — TEC §32.151
• Connecticut — Public Act 16-189
• Virginia, New Jersey, Colorado, Utah — on request
• Don't see your state? Email us — we sign most state-equivalent addendums within 5 business days.
  

• CIPA (Children's Internet Protection Act) — we host no user-generated public content and serve no ads.
  
• PPRA (Protection of Pupil Rights Amendment) — districts control what surveys and assessments are administered.
  
• HIPAA — MyFeelingsMatter is an educational tool, not a covered entity. Counselor case notes are FERPA records, not HIPAA records.
  
• GDPR — for districts with EU students, we offer a Data Processing Addendum and Standard Contractual Clauses.
  

• Privacy & DPA: privacy@myfeelingsmatter.online
  
• Security incidents: security@myfeelingsmatter.online
  
• We respond to district vetting questions within 2 business days.