Privacy Policy

1. What we collect

On this website

• Demo sign-ups: to watch a demo video, the name, work email, school or district, role, state, number of campuses and (if you give it) phone number you enter, and which demos you watch. They’re kept in our own sales system so we can follow up, and in your browser so you don’t have to fill them in again.
• Messages and requests you send us: such as your name, work email, school or district, role and what you write.
• Emails you send us.
• Basic technical data: like any website, our hosting provider records standard information such as IP address, browser type and pages visited, to keep the site running and secure.

In the Weaverbird Help Desk service

• Account information: names, work emails, roles, campus, and sign-in details for administrators, teachers and staff.
• Sign-in and security records: each sign-in attempt and password reset request (the email typed, the time, the result, the browser, the network address, and a random device identifier kept in a cookie), used to block password guessing, to email you about sign-ins from a new device, and as a sign-in log your district’s administrators can see. If you turn on two-step sign-in, we keep your authenticator key encrypted and your backup codes only in scrambled (hashed) form.
• Activity log: each change someone signed in makes to your district’s settings, people and records (who, when, what kind of record, and which fields), shown to your district’s administrators beside the sign-in log, kept for three years. Secret values such as passwords are never recorded.
• One sign-in for the Weaverbird Works apps: if your district uses more than one of our apps, you can sign in once at app.weaverbirdworks.com. It checks your email and password with each app (between our own servers; your password isn’t stored there), and keeps a short record of each sign-in (your email, the time, the network address and which apps you opened). It also shows your to-dos from each app, fetched from them when you open the page and not stored there.
• Agreements: when you accept our Terms, choose texts or calls, or sign an agreement in Weaverbird Help Desk, we record your name, email, role, district, what you agreed to, its version and when, and when it was replaced or ended. These records are copied each night to Weaverbird HQ, our own internal system, where only our staff who handle legal matters can see them, so we can show what was agreed and when. We keep them while we provide the Service to your district and for as long afterwards as we may need to show an agreement was made. Your district’s administrators can see who in the district has agreed to what.
• Contested agreements: if an administrator contests someone’s agreement, we receive the person’s name, email and role, the agreement, the administrator’s reason, and a summary of what’s been done under it (such as how many texts or calls were sent, sign-ins and changes made), and keep them with our decision and the administrator’s signed agreement to it.
• To-dos and reminders: what’s waiting on you, tasks you or an administrator add (an administrator can give one to anyone in the district), when each is due and whether it repeats, and your choices of which to show and when to be reminded. If you turn it on, your to-dos with a due date are shown on your calendars and in your private calendar link.
• Quiet hours and missed notifications: the quiet hours you choose, and each email, text or call that arrived during them (its subject and text), kept for you to read in the app for 90 days and then deleted.
• System checklists: which items of the quarterly and yearly review your district’s administrators have ticked, by whom and when; we see each district’s progress, not the people.
• Google and Microsoft sign-in: if you choose to sign in with Google or Microsoft, they tell us your name and the email address on that account, and whether it’s verified. We use it only to find your Weaverbird Help Desk account; we don’t receive your password, contacts, files or mail.
• Roster sync: if your district connects its student information system (through OneRoster) or a roster spreadsheet, we read its schools and its teachers’ and staff members’ names, emails, roles, grades and phone numbers to keep its Weaverbird Help Desk roster up to date. We don’t request student records. The connection’s secret is stored encrypted.
• Calendar feeds: if you subscribe to your Weaverbird Help Desk calendar, the calendar app you use (such as Google Calendar, Outlook or Apple Calendar) fetches your entries from a private link, and we note when it last did.
• Staff records: what your district keeps about its people in Weaverbird Help Desk, such as name, email, phone number, campus, role, and text and call preferences.
• Tickets: who sent each one, its subject and description, the campus, room and device, its category, priority and status, who it’s assigned to, replies, resolution notes, when it was answered and resolved, and when it was due under the district’s response targets, if it uses them. Also any photos, screenshots or other files added to a ticket or reply, and the rating and comment the person who sent it gives once it’s resolved.
• Tickets by email: if your district turns this on, email sent to its private help desk address: who sent it, the subject, what they wrote and any attachments. Mail from people who aren’t on the district’s roster, and automatic replies, are not kept.
• Known problems: problems IT posts for staff to see, and who said one was affecting them, so they can be told when it’s fixed.
• Device records: each device’s asset tag, serial number, kind and model, status, campus and room, who it’s assigned to, purchase date, cost, funding source, warranty end, notes, and a history of what happened to it.
• Jamf and Intune device sync: if your district connects Jamf Pro or Microsoft Intune with an API client it creates (read only), we read its managed devices each night: serial number, name, model, asset tag, operating system version, when it last checked in, and the email of the person assigned to it or its primary user. The client’s secret is stored encrypted, and we never send anything back. If the district’s IT team turns on assigning devices on sign-in (it’s off until they do), a spare device is recorded as assigned to the staff member or student whose school email signed in to it.
• Google Admin device sync: if your district connects its Google Workspace, we read its Chromebooks from the Google Admin console each night: serial number, model, asset ID, organizational unit, Chrome OS version, when it last checked in, when Google stops updating it, its status, and the email of its most recent user. We ask Google only for device information, never mail, files or contacts. The connection’s key is stored encrypted, and the district can disconnect it at any time.
• Students, for device checkout: if your district uses device checkout, the student information it adds, by hand or from a file it exports: student ID, name, grade, campus and school email; which devices each student has had, when, their condition, and whether a use agreement was signed; repair or replacement charges, with whether they were paid, waived or covered; and, if the district offers families a device protection plan (device insurance), whether each family bought it, declined it or hasn’t answered for each school year, with a short note from IT and the plan’s cost when the district records it here. We don’t ask for or keep grades, attendance or any other student records, and students don’t sign in to Weaverbird Help Desk. Payments are taken the way the district already does; we never take or store card numbers for them.
• Support requests from administrators: their note, optional screenshots (which they can mark with circles and highlights) and an optional screen recording (with their voice if they turn on the microphone), the page they were on and their browser. Before their first request, administrators agree not to include anything about a student, health or medical details, government ID or financial account numbers, or passwords, and to close anything private before taking a screenshot or recording. If something sensitive is sent by mistake, tell us and we’ll delete it.
• Download records: when an administrator agrees to the Data Export Agreement (their name, the time and network address) and each report or list they download (who, when, and what it covered), shown to their district’s administrators.
• Billing information: handled by Stripe; we see the plan, status and last four digits of a card, not the full number.

2. How we use it

• To run Weaverbird Help Desk: taking in tickets (including by email), routing them to IT, replies and resolutions, response targets and response-time figures, ratings, known problems, the device inventory, device checkout and charges.
• To send the emails, texts and calls the Service needs, such as ticket updates, invites and password resets.
• To provide support, keep the Service secure, and fix and improve it.
• To answer support requests: an AI assistant takes a first look at each request’s note and screenshots to help our support team sort it and draft an answer. A person at Weaverbird Help Desk reads and sends every reply.
• To suggest troubleshooting steps on help desk tickets, if your district turns this on (it’s off unless an IT administrator turns it on): an AI assistant reads each new ticket’s category, the device model, the description and the steps the person already tried, and suggests a likely cause and steps. We take out names, email addresses, phone numbers and long numbers (like ID numbers) before it’s sent. Suggestions are shown only to your district’s IT team and the person sending the ticket, and a person decides what to do. Without it, suggested steps come from our own built-in list, and nothing leaves Weaverbird Help Desk.
• To answer questions and requests you send us, and to follow up with people who watched a demo.
• To meet legal obligations.

We do not sell personal information, share it for cross-context behavioral advertising, or use it to build advertising profiles.

3. Schools and student privacy

In the Service, we act for the school or district that uses Weaverbird Help Desk. The school decides what goes in and who can see it, and each district’s data is kept separate. Weaverbird Help Desk is built for IT requests and device records. The only student information it’s designed to hold is what device checkout needs (described in section 1), and only if the district adds it.

Student information, and any education records covered by the Family Educational Rights and Privacy Act (FERPA) or a state student privacy law that are put into Weaverbird Help Desk (for example in a ticket), we handle as a “school official” under the school’s direct control. We use it only to provide the Service to that school: never for advertising, never to build profiles of students, never sold, and never used to train AI models. It’s seen only by the district’s IT team. The school can correct or remove a student’s information at any time, and it’s deleted with the rest of the school’s data when its subscription ends (section 8). Questions about your records, or your child’s? Contact your school first; we’ll help it respond.

4. What goes in a ticket

Tickets are for describing IT problems. The Send to IT form reminds staff not to include student records, grades or anything about a student, passwords or sign-in codes, health details, or Social Security, bank or card numbers. If something like that is sent by mistake, IT can ask the district to remove it, or you can email us.

The same goes for photos and files added to a ticket: before adding one, check that it doesn’t show any of those things.

Inside a district’s Weaverbird Help Desk, a ticket, its files and its rating can be seen by the person who sent it, by colleagues they or IT add as followers (who can open the ticket and reply), and by the district’s IT admins and technicians. A request that needs approval can also be seen by the approver the district chose, such as a principal. Files on IT’s internal notes, and the time IT records working on a ticket, are seen only by the IT team. Device records, checkouts, students, charges and device protection plan answers can be seen by the district’s IT team.

5. Who we share it with

We share information only with service providers that help us run Weaverbird Help Desk, under contracts that limit their use of it to providing their service to us:

• Hosting and security: running this website, the app and its database, keeping an encrypted off-site copy of our backups, and the bot check on the sign-in page. New passwords are checked against known data breaches without the password itself ever being sent.
• Payments: processing subscription payments.
• Messaging: delivering the emails, texts and automated calls the Service sends, and, for districts that turn on tickets by email, receiving email sent to their help desk address and passing it straight to Weaverbird Help Desk.
• Address suggestions: when someone types an address into Weaverbird Help Desk (a campus, a vendor, a home address, or an address question on a form), what they’ve typed so far is sent from our servers to an address search built on OpenStreetMap (Photon, run by komoot) to suggest matching US addresses. Only the typed words are sent: not who typed them, their district, or anything else, so the search service never learns who it was. Typing the whole address and ignoring the suggestions works just the same.
• Support: an AI assistant that takes a first look at support requests (the note and screenshots an administrator sends, not recordings; it doesn’t use them to train its models), and tools for tracking and fixing reported bugs, which never receive the district, names, contact details, screenshots or recordings.
• Jamf and Microsoft: for districts that connect them, we read device information as described above, using the district’s own API client; we send them nothing about your district.
• Google: for districts that connect Google Admin device sync, we read device information from Google as described above; we don’t send Google anything about your district except, if your IT team chooses, an instruction to disable or turn back on one of the district’s own Chromebooks.
• Troubleshooting suggestions: for districts that turn them on, the same AI assistant reads help desk tickets as described above (never names or contact details; it doesn’t use them to train its models).

For a current list of our service providers and what each one does, email privacy@weaverbirdworks.com. Districts with a data privacy agreement get this list, and notice when it changes.

Between your district’s own apps. If your district uses other Weaverbird Works apps and connects them to Weaverbird Help Desk, information it chooses to share moves between them, for example the answers to a form in Weaverbird Builder (the person’s name, email, answers and an approver’s note) arriving here as a ticket, with its status sent back. Only what the district sets up is shared, only within the district, and it stays the district’s information. Connected apps also keep the district’s setup once: its campuses (names, addresses and phone numbers), its grade, department and subject lists, and its teachers and staff (names, emails, campuses, roles, departments, grades and phone numbers) are kept in one of its apps (Weaverbird HR first, if the district uses it) and copied to the others it connects, and someone turned off there is turned off in the others. Passwords, sign-in settings, consents and notification choices are never copied. When Weaverbird HR starts someone’s onboarding or offboarding, the steps for IT, facilities and the business office (with the person’s name, email, role, campus and start or last day) go to the district’s Weaverbird Help Desk, Weaverbird Facilities and Weaverbird Finance, which add the devices, keys or purchasing cards they have there so they can be collected, and say back when the work is done. The district’s vendors (business names and contact details) are kept in Weaverbird Finance when it’s connected and copied to the others, and a work order can ask it for a purchase order. If the district connects Weaverbird HR and Weaverbird Finance and an Weaverbird HR admin turns on position budgeting (it’s off until they do, and they agree to share this first), Weaverbird Finance reads the district’s positions from Weaverbird HR to budget them (each position’s title, campus, department and FTE, the name of the person in it and their yearly salary from the district’s salary schedule), and tells Weaverbird HR which positions its adopted budget funds. Turning it off stops this straight away.

Inside a school’s Weaverbird Help Desk, information is shared with the people who need it, for example a teacher’s name and room with the technician working their ticket. We may also share information if the law requires it, to protect people’s safety, or as part of a merger or sale of our business, in which case this policy continues to apply.

6. Texts and calls

We text or call someone only after they agree to it themselves in Weaverbird Help Desk, separately for texts and for calls; no one can agree for them. During their quiet hours, texts and calls aren’t sent (except security messages, and urgent alerts they allow), and while an administrator’s contest of their agreement is open, none are sent at all. Phone numbers and consent are never shared with third parties for their marketing. Reply STOP to any text to opt out. See our Text and call terms.

7. Cookies

This website doesn’t use advertising or tracking cookies. The Weaverbird Help Desk app uses a cookie to keep you signed in, and one that remembers your device so we can tell you about sign-ins from new ones. Our hosting provider may set cookies needed for security.

8. Security and retention

We use encryption in transit, hashed passwords, access controls that keep each district’s data separate, and the ability to sign a person out everywhere. We keep a school’s data while its subscription is active. After it ends, the school can ask us for a copy of its data for 30 days, and we then delete it within 60 days, except copies the law requires us to keep or that sit in backups until they expire. Tickets and device records are kept while the subscription is active, unless the district removes them.

Screen recordings and screenshots sent with a support request are deleted 90 days after the request is resolved (the request itself is kept). Photos and files on help desk tickets are deleted one year after the ticket is resolved (the ticket itself is kept). Student information, checkouts, charges and device protection plan answers are kept while the subscription is active, unless the district removes them; a student the district turns off is no longer offered for checkout.

We take a backup of our database each night and keep each one for 14 days. So we can recover even if our main host has a problem, an encrypted copy of each nightly backup, and of the files uploaded to Weaverbird Help Desk, is also kept with a second storage provider. The copies are encrypted before they leave our servers and only we hold the key; backups are kept there for the same 14 days, and an uploaded file’s copy is removed when the file is removed from Weaverbird Help Desk. We keep messages you send us for as long as needed to follow up, and delete them on request.

9. Your choices and rights

• Anyone can turn texts and calls on or off, choose which notices they get, and set quiet hours, in their own settings at any time.
• You can ask to see, correct or delete your information. If your information is in a school’s Weaverbird Help Desk, we’ll pass your request to that school, which controls it.
• Depending on where you live (for example California and other US states), you may have additional rights. We will honor them and won’t treat you differently for using them.

To make a request, email privacy@weaverbirdworks.com.

10. Children

Weaverbird Help Desk is for school staff, not for children: students never sign in or give us information themselves. The limited student information used for device checkout is added by the school, which is responsible for any notice or consent its policies or the law require, and is handled as described in section 3. We don’t knowingly collect personal information directly from children under 13. If you believe a child has given us information, email us and we will delete it.

11. Changes and contact

We may update this policy and will change the date above when we do. If a change is significant, we’ll tell account owners before it takes effect. Questions or requests: privacy@weaverbirdworks.com.