Our Privacy Philosophy

Heronix Education Systems is built on a fundamental principle: your data belongs to you. Unlike cloud-based SaaS providers, we don't store, access, or monetize your student data. Our on-premise software runs entirely on your infrastructure.

1. Data We Do NOT Collect

Because Heronix software is installed on your servers (on-premise), we do not have access to:

• Student personally identifiable information (PII)
• Student educational records
• Teacher or staff information
• Parent/guardian data
• Grades, attendance, or behavioral records
• Any data entered into the Heronix software

Your school maintains complete ownership and control of all data stored in Heronix systems.

What we do collect

So the list above is not read as covering everything: if you create an account on this website to download an evaluation copy, we hold exactly three things about you.

• Your name
• Your work email address
• Your school or organization name

Plus which build your account downloaded, and any bug report or review you choose to send us. If your district later purchases, an order adds a billing address for the invoice. That is the whole of it, and none of it is student data.

2. Website Data Collection

This section covers our website only. It is separate from the on-premise software described in Section 1: the applications you install collect nothing and send nothing to Heronix. When you visit our website (heronixedu.com), we collect:

• Website analytics: page views, referring site, approximate location (country, region, city) derived from your IP address at the time of the request, and device type. We do not store your IP address, and we do not use cross-site tracking cookies. A random identifier in your browser's local storage distinguishes new from returning visits.
• Account information (if you create one): your name, email address, and organization, a securely hashed password, and the products you download. This is customer information about you, never anything about your students.
• Cookies: a sign-in session cookie when you are logged in. No advertising or third-party tracking cookies.

Where this data lives. Website analytics and account data are stored on Heronix-controlled infrastructure. We do not use third-party analytics platforms, and this website loads no third-party analytics or font services. Our site is served through a hosting provider and large downloads through a storage provider, which necessarily handle the request traffic required to deliver them; the analytics we collect and store are our own.

Opt out of analytics at any time by visiting the site with ?hx_dev=1 appended to the address, or by enabling Do Not Track in your browser. Either one stops collection.

We do not sell, rent, or share this information with third parties for marketing purposes.

3. FERPA Compliance

Districts requiring a signed agreement: see our Data Privacy Agreement. We will also sign your district's own form.

We never receive student data. Heronix software runs on your own servers; student records are written there and are not transmitted to us. We are not a recipient, a processor or a school official with respect to education records, because none reach us.

The software is built to support your FERPA obligations:

• No Third-Party Data Sharing: Student records never leave your network
• Data Ownership: Schools maintain 100% ownership of all educational records
• Access Control: Role-based permissions ensure only authorized personnel access student data
• Audit Logging: Complete audit trails of all data access and modifications
• Guardian Security Perimeter: Cryptographic tokenization protects student PII when integrating with third-party vendors

4. Data Storage & Security

On-Premise Architecture:

• All data is stored on your school's servers
• No cloud storage or third-party hosting
• AES encryption for sensitive data at rest
• Offline-first design - works without internet connectivity

Your IT team controls:

• Server security and access
• Backup and disaster recovery
• Network security and firewalls
• User authentication and permissions

5. Third-Party Integrations

When using Heronix with third-party services (LMS platforms, classroom tools, etc.):

• The Guardian gateway tokenizes student data before it is sent to vendors
• Each vendor receives unique, isolated tokens - not real student identities
• If a vendor is breached, only meaningless tokens are exposed
• You control which integrations are enabled

6. Your Rights

There are two separate kinds of data, and your rights work differently for each.

Data inside the Heronix software you run

Student records, hall passes, forms, schedules and everything else the software holds live on your own servers. Your school or district owns it outright:

• Access: Full access to all data at any time
• Export: Export data in standard formats (CSV, JSON, SQL)
• Deletion: Delete any data at your discretion
• Portability: Migrate data to other systems without restriction

Heronix cannot access, modify, or delete that data, because we do not have access to it.

Data in your Heronix account on this website

If you create an account here to download software or place an order, we do hold that: your name, email, organization, orders, invoices and licence keys. For this data you can:

• Download it: a complete copy as a JSON file, from your account page, including orders, invoices, licences, bug reports and the browsers your account has been used from
• Delete your account: also from your account page. Your profile, sessions, saved devices, download history, bug reports and reviews are erased

One exception, stated plainly: orders and invoices are anonymized rather than deleted. They are financial records we are legally required to retain. The amounts, dates and invoice numbers remain; your name, email, organization and address are removed from them.

7. How Long We Keep Things

We do not keep data indefinitely just because storage is cheap. Each kind has a defined lifetime:

Analytics on this site use no tracking cookies, and your raw IP address is never stored — it is used to derive an approximate country and then discarded.

How we keep purchase records

We need your billing details to raise an invoice, and tax law requires us to keep that invoice. We handle those records deliberately conservatively:

• Paper is our permanent record. Every transaction is printed and filed in our own offices. That file, not a database, is what we go back to.
• The digital copy has an end date. Order records live on our in-house servers for seven years. After that they are sealed into an encrypted, compressed archive and deleted from the live system; the archive itself is destroyed once we no longer need it. Nothing is kept online indefinitely.
• Nothing is hosted with a payment processor. We do not store card numbers, because we never take card payments.
• Copies on request. Ask for an invoice or a transaction history at any time and we will mail you a printed copy. If you need it quickly, we will scan the document and send it to you.

8. Support & Maintenance

Under the annual upkeep agreement, where your license includes one:

• Support is provided via email and phone
• We may request screenshots or logs to diagnose issues
• We do not require remote access to your systems
• Any data you share for support is used solely for troubleshooting

9. Changes to This Policy

We may update this Privacy Policy periodically. Changes will be posted on this page with an updated revision date. Significant changes will be communicated via our website or email to registered contacts.

10. Contact Us

For privacy-related questions or concerns:

• Email: privacy@heronixedu.com
• Website: Contact Form