NostaView Compliance Center

Yes. NostaView operates under the direct control of the school, processes data only for the school's legitimate educational purposes, and is subject to FERPA's re-disclosure prohibition. Schools should include NostaView in their annual FERPA notice to parents as a service provider used to collect event photos. See Terms of Service, Section 3 and SDPA, Section 11.

No. All data — including photos — is stored on US-based infrastructure: Render (Oregon data center) for application hosting and Cloudflare R2 (US region) for photo storage. Student data does not leave the United States. See SDPA, Section 6.

Minimal. QR contributors (students and parents uploading photos) are not required to create accounts, provide names, or provide email addresses. The only data collected in the QR upload flow is: the photo itself, an upload timestamp, and a temporary IP address (for security only, not displayed publicly). Student names, IDs, email addresses, grades, and behavioral data are never collected. See SDPA, Section 3 and Privacy Policy.

No. NostaView does not perform facial recognition or collect biometric data of any kind. The Pro tier uses Google Cloud Vision for photo quality analysis (detecting blurry, dark, or duplicate photos) — this does not identify individuals or create facial templates.

NostaView notifies the school LEA within 24 hours of a confirmed or reasonably suspected breach involving student data. Written incident reports are provided within 72 hours. The school is then responsible for notifying parents and regulatory authorities per applicable law. Full breach notification procedure is in SDPA, Section 7.

You can request deletion via: (1) the administrator dashboard using the account deletion feature, or (2) emailing supports@nostaview.com with subject "Student Data Deletion Request." Deletion is completed within 30 days and NostaView provides written certification of destruction. You can also export all data first via the admin dashboard.

Yes. NostaView's SDPA and practices are designed to comply with major state student data privacy laws including California SOPIPA and AB 1584, New York Education Law § 2-d, Texas SCOPE Act, Illinois SOPPA, and others. A full state law compliance matrix is in SDPA, Section 12. Contact supports@nostaview.com for state-specific questions.

Email supports@nostaview.com with subject "SDPA Signature Request" and include your district name, contact name, and state. We'll return a countersigned PDF within 2 business days. The signed SDPA can be submitted to your district's vendor compliance office for procurement approval.

We are in the process of registering on state SDPC registries. If your state uses the SDPC registry and you would like to add NostaView to your district's approved vendor list, contact supports@nostaview.com — we'll work with you to complete the registration.