Privacy Policy
Effective May 6, 2026.
ServePanda is a tool for K-12 schools to track non-credit graduation requirements. This policy describes what we collect, how we store it, and what schools can do about it.
What we collect
The data your school uploads or enters: student records (name, ID, graduation year, advisor, enrollment date), and log entries against graduation requirements (date, amount, description, verifier). We also collect basic account information for staff seats: name, work email, and role.
How we store it
Data is stored encrypted at rest on Cloudflare's US-East infrastructure (Cloudflare D1). Access is gated by signed session cookies. We do not store data on third-party analytics or tracking services.
What we don't do
- We don't sell your data.
- We don't share it with marketers or data brokers.
- We don't use it to train AI or machine-learning models.
- We don't surface it to other schools or other tenants.
Who owns the data
Your school does. You can export every row to CSV at any time. On request, we will delete your school's data within 30 days — including backups within an additional 30 days.
Subprocessors
We rely on the following infrastructure providers:
- Cloudflare Pages — hosting and edge delivery.
- Cloudflare D1 — SQLite-on-edge database for student and log records.
- Cloudflare Access — authentication (when provisioned for your account).
We will give 30 days' notice before adding a new subprocessor that handles student records.
Honest disclosure
ServePanda is an early-stage product. We aim for the standards above and we'll be transparent if we fall short. If you find a security issue or have a privacy question, contact us via the request-access form and we'll respond within two business days.
Changes to this policy
If we change this policy in a way that affects existing customers, we'll email account contacts at least 30 days before the change takes effect.