Privacy Policy

1Overview

DataVot is a web-based service for New Jersey schools that turns official state assessment data sets (such as NJSLA files) into dashboards, pivot-table reports, and shareable analyses. DataVot is operated by Salesforce Hub LLC ("we", "us", or "our"), an independent New Jersey company. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service at datavot.com and any related pages.

We are committed to protecting your privacy. We collect only the minimum data necessary to provide the service, and we never sell your personal information to third parties.

2Data We Collect

We collect information in the following categories:

We do not collect payment card numbers, social security numbers, health records, or any other sensitive personal data (health, financial, or biometric). We do not use behavioral advertising or tracking pixels.

3How We Use Your Data

We use the data we collect to:

• Operate the service — authenticate your account, process file uploads, compute pivot tables, and display results.
• Create reports — persist reports and preferences so you can resume where you left off.
• Manage school accounts — allow school administrators to invite teachers and manage seat limits.
• Communicate with you — send password-reset emails and important service notifications. We do not send marketing emails.
• Improve the service — review aggregate, anonymized usage patterns to identify errors and plan new features.
• Ensure security — detect and prevent abuse, enforce rate limits, and respond to incidents.

4Storage & Security

DataVot runs on Cloudflare Workers with a Cloudflare D1 database (SQLite). Your data is hosted on Cloudflare's network infrastructure under confidentiality and data protection obligations.

We implement the following technical safeguards:

• All data transmitted between your browser and our servers is encrypted via HTTPS / TLS 1.3.
• Stored data sets and reports are encrypted at rest — the rows are compressed and encrypted with AES-GCM before they are written to the database, and are decrypted only in memory, on the server, when an authorized user opens them.
• Dashboards return aggregated counts only — the totals behind a chart are computed on the server, so raw student rows are never sent to the browser to draw a dashboard.
• Passwords are never stored in plain text — we use a strong hashing algorithm (bcrypt) with per-user salts.
• Authentication uses HTTP-only, Secure, SameSite cookies to prevent cross-site scripting theft of session tokens.
• Uploaded files are processed in-memory and stored only if you explicitly create a report or data set; raw files are not retained after your session ends.
• Role-based access controls mean school admins can only access their own school's data. Teachers can additionally be restricted by a school admin to specific schools within the district; where no restriction is set, a teacher sees their district's data set.

5Data Sharing

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Within your school — your school administrator can see which teachers are members of their school account. Shared reports (if the school admin has enabled teacher sharing) are visible to other school members. Individual preference settings are private.
• Infrastructure providers — Cloudflare for hosting, database, security and request processing, and Resend for transactional email delivery. Account invitations, password resets, verification and support-access notices involve names, email addresses, and school names. Both act as our sub-processors and as data processors on our behalf under confidentiality and data protection obligations.
• Legal requirements — we may disclose data if required to do so by law, court order, or to protect the rights, property, or safety of our users or the public.
• Business transfer — in the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred. We will notify you via email before your data is transferred and becomes subject to a different privacy policy.

6Cookies

DataVot uses a minimal set of cookies:

We do not use advertising cookies or any cross-site tracking, and we set no cookie for analytics. We do not use Google Analytics, Facebook Pixel, or similar services. The single cookie we set is strictly necessary for the service to function. Our hosting provider's privacy-preserving, cookieless web analytics may be enabled at the network level; it counts page requests without cookies and without building a profile of you across sites.

7Data Retention

We retain your data for as long as your account is active. Specifically:

Account deletion is handled on request rather than through a self-service button. Email info@datavot.com to ask us to close your account, and we will delete or anonymize all personal data associated with it within 30 days of verifying the request, except where we are legally required to retain it for longer.

8Your Rights

If you have a DataVot account — as a teacher, school administrator, or system administrator — you have the following rights over your own personal data:

To exercise any of these rights, contact us at info@datavot.com. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.

9Children's Privacy

DataVot is designed for use by teachers and school administrators, not by students directly. The service is not directed to children, and we do not knowingly collect personal data directly from children under 13 (consistent with COPPA).

The data that teachers upload (e.g., class performance spreadsheets) may contain student records. Teachers and school administrators are responsible for ensuring they have the appropriate authorization and legal basis to upload and process any student data, and for complying with applicable U.S. laws such as FERPA and COPPA.

If you believe we have inadvertently collected personal data directly from a child under 13, please contact us immediately at info@datavot.com and we will delete it promptly.

10Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the service, technology, or applicable law. When we make material changes, we will:

• Update the "Last updated" date at the top of this page.
• Send an email notification to all registered users at least 14 days before the change takes effect.

Your continued use of DataVot after the effective date constitutes your acceptance of the updated policy. If you do not agree with the changes, you may request deletion of your account before the effective date by emailing info@datavot.com.

11Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy, please contact us: