Privacy Policy

1. What we collect

On this website

• Demo sign-ups: to watch a demo video, the name, work email, school or district, role, state, number of campuses and (if you give it) phone number you enter, and which demos you watch. They’re kept in our own sales system so we can follow up, and in your browser so you don’t have to fill them in again.
• Tour requests, funding plan requests and launch sign-ups: the name, work email, school or district, state, role, number of campuses, phone number and message you send us. A funding plan request on our funding guide also says which apps and funding programs you’re interested in and whether your district is rural, so we can send the plan and follow up.
• Emails you send us.
• Basic technical data: like any website, our hosting provider records standard information such as IP address, browser type and pages visited, to keep the site running and secure.

In the Weaverbird Finance service

• Account information: names, work emails, roles, campus, and sign-in details for admins, teachers, staff and vendors.
• Sign-in and security records: each sign-in attempt and password reset request (the email typed, the time, the result, the browser, the network address, and a random device identifier kept in a cookie), used to block password guessing, to email you about sign-ins from a new device, and as a sign-in log your district’s administrators can see. If you turn on two-step sign-in, we keep your authenticator key encrypted and your backup codes only in scrambled (hashed) form.
• Activity log: each change someone signed in makes to your district’s settings, people and records (who, when, what kind of record, and which fields), shown to your district’s administrators beside the sign-in log, kept for three years. Secret values such as passwords are never recorded.
• Financial records: budgets and account codes, purchase requests and orders, invoices and receipts, reimbursements (with mileage and receipts), purchasing cards, grants and their spending, activity funds and deposits, and each approval and note, entered or imported by your district.
• Invoices and receipts we read for you: when someone uploads an invoice or a receipt (or texts a photo of a receipt in), the file is kept with the district’s records and, if the district has it, read by an AI service to fill in the vendor or store, the date, the amounts, the lines and any purchase order number, for a person to check before anything is recorded. Invoices can name vendors and staff; receipts can show the buyer’s name, the last four digits of a card and what was bought.
• Texting receipts in: if someone turns it on, the cell phone number they’ll text from and when they agreed, the photos they text (kept like uploaded receipts), and our replies about what we read and what it matched. Replying STOP turns it off for that number.
• Invoices a district sends: the names, emails and mailing addresses of the people and organizations a district bills, what each invoice is for, payments recorded against it, and when the customer opened their invoice link. We email the invoice, automatic reminders the district turns on and a thank-you for payment on the district’s behalf.
• Time and effort and other signed forms: when staff sign a time-and-effort certification or another business office form in their portal, the name they type to sign, the time, and what they certified, kept with the district’s audit trail.
• Audit documents: files a district uploads for its auditors in Audit Prep, such as payroll registers, bank statements and reconciliations, which can show employees’ names and pay. They’re kept with the district’s other files until the district removes them or its data is deleted.
• Vendor information: vendors’ business names, contacts, addresses, tax forms and payment details a district collects, used only for that district’s purchasing and payments.
• One sign-in for the Weaverbird Works apps: if your district uses more than one of our apps, you can sign in once at app.weaverbirdworks.com. It checks your email and password with each app (between our own servers; your password isn’t stored there), and keeps a short record of each sign-in (your email, the time, the network address and which apps you opened). It also shows your to-dos from each app, fetched from them when you open the page and not stored there.
• Agreements: when you accept our Terms, choose texts or calls, or sign an agreement in Weaverbird Finance, we record your name, email, role, district, what you agreed to, its version and when, and when it was replaced or ended. These records are copied each night to Weaverbird HQ, our own internal system, where only our staff who handle legal matters can see them, so we can show what was agreed and when. We keep them while we provide the Service to your district and for as long afterwards as we may need to show an agreement was made. Your district’s administrators can see who in the district has agreed to what.
• Contested agreements: if an administrator contests someone’s agreement, we receive the person’s name, email and role, the agreement, the administrator’s reason, and a summary of what’s been done under it (such as how many texts or calls were sent, sign-ins and changes made), and keep them with our decision and the administrator’s signed agreement to it.
• To-dos and reminders: what’s waiting on you, tasks you or an administrator add (an administrator can give one to anyone in the district), when each is due and whether it repeats, and your choices of which to show and when to be reminded. If you turn it on, your to-dos with a due date are shown on your calendars and in your private calendar link.
• Quiet hours and missed notifications: the quiet hours you choose, and each email, text or call that arrived during them (its subject and text), kept for you to read in the app for 90 days and then deleted.
• System checklists: which items of the quarterly and yearly review your district’s administrators have ticked, by whom and when; we see each district’s progress, not the people.
• Google and Microsoft sign-in: if you choose to sign in with Google or Microsoft, they tell us your name and the email address on that account, and whether it’s verified. We use it only to find your Weaverbird Finance account; we don’t receive your password, contacts, files or mail.
• Roster sync: if your district connects its student information system (through OneRoster) or a roster spreadsheet, we read its schools and its teachers’ and staff members’ names, emails, roles, grades and phone numbers to keep its Weaverbird Finance roster up to date. We don’t request student records. The connection’s secret is stored encrypted.
• Calendar feeds: if you subscribe to your Weaverbird Finance calendar, the calendar app you use (such as Google Calendar, Outlook or Apple Calendar) fetches what’s on your Weaverbird Finance calendar from a private link, and we note when it last did.
• Support requests from administrators: their note, optional screenshots (which they can mark with circles and highlights) and an optional screen recording (with their voice if they turn on the microphone), the page they were on and their browser. Before their first request, administrators agree not to include anything about a student, health or medical details, government ID or financial account numbers, or passwords, and to close anything private before taking a screenshot or recording. If something sensitive is sent by mistake, tell us and we’ll delete it.
• Download records: when an administrator agrees to the Data Export Agreement (their name, the time and network address) and each report or file they download (who, when, and the dates and campuses it covered), shown to their district’s administrators.
• Billing information: handled by Stripe; we see the plan, status and last four digits of a card, not the full number.

2. How we use it

• To run Weaverbird Finance: budgets, purchasing, invoices, reimbursements, grants, vendor records and the reports your district downloads.
• To send the emails, texts and calls the Service needs, such as notifications, invites and password resets.
• To provide support, keep the Service secure, and fix and improve it.
• To read invoices and receipts: an AI assistant reads an uploaded or texted invoice or receipt and suggests what to record; a person in the district checks it before it’s saved. This never happens for demo districts.
• To publish what a district chooses: if a district turns on its public transparency page, its budget and spending by fund, and (if it chooses) its payments to vendors by month, are shown to anyone with the link. Staff reimbursements appear only as one total a month, never by name.
• To answer support requests: an AI assistant takes a first look at each request’s note and screenshots to help our support team sort it and draft an answer. A person at Weaverbird Finance reads and sends every reply.
• To answer tour requests, funding plan requests and questions you send us, and to follow up with people who watched a demo.
• To meet legal obligations.

We do not sell personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.

3. Schools and student privacy

In the Service, we act for the school or district that uses Weaverbird Finance. The school decides what goes in and who can see it, and each district’s data is kept separate. We use it only to provide the Service and never use it for advertising. Questions about your records? Contact your school first; we’ll help it respond.

4. Financial information

We hold your district’s financial records for the district, under its direction, and use them only to run Weaverbird Finance for it. Bank account details and tax identification numbers a district collects are stored encrypted and shown only to the people who need them. Weaverbird Finance doesn’t move money: payments are made through the district’s own bank and accounting systems.

5. Who we share it with

We share information only with service providers that help us run Weaverbird Finance, under contracts that limit their use of it to providing their service to us:

• Hosting and security: running this website, the app and its database, keeping an encrypted off-site copy of our backups, and the bot check on the sign-in page. New passwords are checked against known data breaches without the password itself ever being sent.
• Payments: processing subscription payments.
• Messaging: delivering the emails, texts and automated calls the Service sends, and receiving the receipt photos people text in (with the phone number they came from).
• Address suggestions: when someone types an address into Weaverbird Finance (a campus, a vendor, a home address, or an address question on a form), what they’ve typed so far is sent from our servers to an address search built on OpenStreetMap (Photon, run by komoot) to suggest matching US addresses. Only the typed words are sent: not who typed them, their district, or anything else, so the search service never learns who it was. Typing the whole address and ignoring the suggestions works just the same.
• Reading invoices and receipts: an AI service (Anthropic’s Claude) receives the invoice or receipt file to read it; it doesn’t use files to train its models, and files from demo districts are never sent.
• Support: an AI assistant that takes a first look at support requests (the note and screenshots an administrator sends, not recordings; it doesn’t use them to train its models), and tools for tracking and fixing reported bugs, which never receive the district, names, contact details, screenshots or recordings.
• Website forms and scheduling: delivering tour requests and launch sign-ups, and booking live demos on our calendar.

For a current list of our service providers and what each one does, email privacy@weaverbirdworks.com. Districts with a data privacy agreement get this list, and notice when it changes.

Between your district’s own apps. If your district uses other Weaverbird Works apps and connects them to Weaverbird Finance, information it chooses to share moves between them: for example what someone fills in on a form in Weaverbird Builder (their name, email, answers and an approver’s note) arriving here as a reimbursement, purchase request or new vendor, with how it’s going sent back. Only the forms and requests the district sets up are shared, only within the district, and it stays the district’s information. Connected apps also keep the district’s setup once: its campuses (names, addresses and phone numbers), its grade, department and subject lists, and its teachers and staff (names, emails, campuses, roles, departments, grades and phone numbers) are kept in one of its apps (Weaverbird HR first, if the district uses it) and copied to the others it connects, and someone turned off there is turned off in the others. Passwords, sign-in settings, consents and notification choices are never copied. When Weaverbird HR starts someone’s onboarding or offboarding, the steps for IT, facilities and the business office (with the person’s name, email, role, campus and start or last day) go to the district’s Weaverbird Help Desk, Weaverbird Facilities and Weaverbird Finance, which add the devices, keys or purchasing cards they have there so they can be collected, and say back when the work is done. The district’s vendors (business names and contact details) are kept in Weaverbird Finance when it’s connected and copied to the others, and a work order can ask it for a purchase order. If the district connects Weaverbird HR and Weaverbird Finance and an Weaverbird HR admin turns on position budgeting (it’s off until they do, and they agree to share this first), Weaverbird Finance reads the district’s positions from Weaverbird HR to budget them (each position’s title, campus, department and FTE, the name of the person in it and their yearly salary from the district’s salary schedule), and tells Weaverbird HR which positions its adopted budget funds. Turning it off stops this straight away.

Inside a school’s Weaverbird Finance, information is shared with the people who need it, for example a request’s details with the people who approve it. What a district publishes on its transparency page is public, at its choice; vendor names and amounts paid to them can appear there. We may also share information if the law requires it, to protect people’s safety, or as part of a merger or sale of our business, in which case this policy continues to apply.

6. Texts and calls

We text or call someone only after they agree to it themselves in Weaverbird Finance, separately for texts and for calls; no one can agree for them. Texting receipts in is its own choice too: we reply only to the phone number someone gave for it, about the receipts they send. During their quiet hours, texts and calls aren’t sent (except security messages, and urgent alerts they allow), and while an administrator’s contest of their agreement is open, none are sent at all. Phone numbers and consent are never shared with third parties for their marketing. Reply STOP to any text to opt out. See our Text and call terms.

7. Cookies

This website doesn’t use advertising or tracking cookies. We count visits with Cloudflare Web Analytics, which doesn’t use cookies or track you across sites. The Weaverbird Finance app uses a cookie to keep you signed in, and one that remembers your device so we can tell you about sign-ins from new ones. Our hosting provider may set cookies needed for security.

8. Security and retention

We use encryption in transit, hashed passwords, access controls that keep each district’s data separate, and the ability to sign a person out everywhere. We keep a school’s data while its subscription is active. After it ends, the school can ask us for a copy of its data for 30 days, and we then delete it within 60 days, except copies the law requires us to keep or that sit in backups until they expire. Some files are deleted sooner, automatically. Each district chooses how long its school records are kept, in Settings: its state’s record retention minimums (as we have them from published schedules and federal rules), or its own periods. The district is responsible for confirming its choice meets its requirements. Until a district chooses, these standard periods apply:

• Financial records and their files (including invoices, receipts and audit documents) are kept while the district’s subscription is active, so it can meet its own record-keeping and audit requirements. A district can choose in Settings how long to keep receipts, invoice copies and packing slips; W-9s and insurance certificates of vendors it no longer uses; quotes, bid documents and contracts; and documents uploaded for its auditors. When a file’s time is up it is deleted, and the record it belongs to (such as the invoice or vendor) is kept.

Screen recordings and screenshots sent with a support request are deleted 90 days after the request is resolved (the request itself is kept). Missed notifications are deleted 90 days after they arrive.

We take a backup of our database each night and keep each one for 14 days. So we can recover even if our main host has a problem, an encrypted copy of each nightly backup, and of the files uploaded to Weaverbird Finance, is also kept with a second storage provider. The copies are encrypted before they leave our servers and only we hold the key; backups are kept there for the same 14 days, and an uploaded file’s copy is removed when the file is removed from Weaverbird Finance. We keep tour requests for as long as needed to follow up, and delete them on request.

9. Your choices and rights

• Everyone can turn texts and calls on or off, choose which notifications they get, and set quiet hours, in their own settings at any time.
• You can ask to see, correct or delete your information. If your information is in a school’s Weaverbird Finance, we’ll pass your request to that school, which controls it.
• Depending on where you live (for example California and other US states), you may have additional rights. We will honor them and won’t treat you differently for using them.

To make a request, email privacy@weaverbirdworks.com.

10. Children

Weaverbird Finance is for school staff and the vendors who work with districts, not for children. We don’t knowingly collect personal information from children under 13. If you believe a child has given us information, email us and we will delete it.

11. Changes and contact

We may update this policy and will change the date above when we do. If a change is significant, we’ll tell account owners before it takes effect. Questions or requests: privacy@weaverbirdworks.com.