Log inGet started

Cohort Bay

Privacy Policy

Effective September 13, 2026

This Privacy Policy describes how the operator of Cohort Bay (“Cohort Bay,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit Cohort Bay websites, create a school account, or use our software as a service (the “Service”).

We designed this policy to address U.S. federal requirements that apply to our Service—including the Family Educational Rights and Privacy Act (“FERPA”), the Children’s Online Privacy Protection Act (“COPPA”) as it applies to school-directed tools, the FTC Act’s prohibition on unfair or deceptive practices, CAN-SPAM, and (where we send SMS) the Telephone Consumer Protection Act—and Wyoming law, including the Wyoming Consumer Protection Act (W.S. 40-12-101 et seq.) and Wyoming’s computer security breach statutes (W.S. 40-12-501 and 40-12-502). If our legal entity name or Wyoming mailing address is listed on an order form or invoice, that name is the controller or processor identified in that contract.

This policy is not a substitute for a school’s own FERPA annual notice, a signed data-processing addendum, or advice from the school’s counsel. Schools remain responsible for how they collect and use student data inCohort Bay.

1. Roles: visitors, schools, and users

Website visitors browse marketing pages such as our home and pricing pages. We collect limited technical data as described below.

School customers (typically a school or training organization) subscribe to Cohort Bay and decide what student, staff, instructor, and applicant information to put in the Service. For education records, the school is the FERPA-covered institution. Cohort Bay acts as a service provider / “school official” under FERPA (see 34 C.F.R. § 99.31(a)(1)) when we process those records solely to provide the Service to that school.

End users are people a school invites or enrolls: school admins, staff, instructors, students, and applicants. Their accounts exist because of the school’s relationship with us.

2. Information we collect

Depending on how you use the Service, we may process:

  • Account and contact data: name, email address, phone number, school name, role, Google account identifiers if you sign in with Google, and profile details you or your school provide.
  • School operations data: programs, cohorts, classes, attendance, grades, applications, documents, tuition ledgers, payment plans, messages, forms, automations, and similar records the school stores in Cohort Bay.
  • Student and applicant data the school submits, which may include contact information, date of birth, prior school, documents, and other fields the school configures. We do not require Social Security numbers; schools should not upload government IDs or SSNs unless necessary and lawful.
  • Payment records: amounts, methods, and status. Card processing, when enabled, is handled by the payment processor (for example Stripe); we do not store full card numbers.
  • Lead and advertising data if a school connects Meta, TikTok, or Google lead forms: names, emails, phone numbers, and form answers those platforms send to the school’s Cohort Bay workspace.
  • Technical data: IP address, browser type, device information, timestamps, and authentication cookies needed to keep you signed in. Theme preference may be stored in local storage on your device.
  • Support communications: emails you send to hello@cohortbay.com.

We do not knowingly collect information directly from children under 13 for our own marketing. See Section 7.

3. How we use information

We use personal information to:

  • Create and authenticate accounts, including Google sign-in.
  • Provide, maintain, secure, and improve the Service the school purchased.
  • Send transactional email (invites, password and security notices, product messages the school configures).
  • Send SMS only when a school uses messaging features and has a lawful basis (including consent where the TCPA requires it).
  • Process AI-assisted drafts or document extraction when a school uses those features, solely to deliver that function for that school.
  • Detect, prevent, and investigate security incidents and abuse.
  • Comply with law, enforce our Terms, and protect our rights.
  • Communicate with school admins about billing, outages, and product changes.

We do not sell personal information, and we do not use student education records for targeted advertising.

4. How we share information

We share personal information only:

  • With the school that owns the workspace, and with users that school authorizes (admins, staff, instructors, and the student or applicant as the school configures).
  • With processors that host or support the Service, including our database and authentication provider (currently Supabase), cloud infrastructure, email delivery, and—when a school enables them—Google (sign-in), payment processors, and lead-ad platforms. They may process data in the United States.
  • If required by law or a valid legal process, or to prevent harm.
  • In a business transfer (merger, acquisition, or asset sale), subject to this policy or equivalent protections.

Processors are bound to use school data only to provide their services to us. A current subprocessors list is available on request at hello@cohortbay.com.

5. FERPA (education records)

When we process education records for a U.S. school, we do so as a contractor performing institutional services the school would otherwise use employees to perform, under the school’s direct control as to use and maintenance of records, consistent with FERPA’s school-official exception.

We will not:

  • Use education records except to provide the Service to that school or as the school directs.
  • Disclose education records to third parties except processors, persons the school authorizes, or as FERPA and other law allow.

Parents and eligible students should send FERPA access, amendment, and complaint requests to the school, not to Cohort Bay. We will assist the school in responding. The U.S. Department of Education Student Privacy Policy Office administers FERPA complaints.

6. Other federal rules

  • COPPA: Cohort Bay is directed to schools, not to children as a consumer website. When a school creates accounts for students under 13 for educational use, the school is responsible for providing any notice and obtaining any consent COPPA requires (including the school-as-agent model described in FTC COPPA guidance). We do not condition a child’s participation on extra data beyond what the school needs for the Service.
  • PPRA: Schools remain responsible for PPRA notices about surveys and certain covered information.
  • CAN-SPAM: Commercial email we send includes a way to contact us. Transactional mail about an account or school workflow is not treated as advertising.
  • TCPA: Schools that send SMS through Cohort Bay must have required consent. Recipients may opt out as the message instructions allow.
  • GLBA / HIPAA: We are not a financial institution under GLBA. We are not a HIPAA covered entity. Do not store protected health information in Cohort Bay unless we have executed a Business Associate Agreement with the school.

7. Wyoming law

We intend to conduct the Service in a manner consistent with Wyoming consumer-protection law (W.S. 40-12-101 et seq.), including avoiding unfair or deceptive acts in connection with the sale of the Service.

If we become aware of a “breach of the security of the data system” involving computerized personal identifying information of a Wyoming resident, as those terms are defined in W.S. 40-12-501, we will investigate in good faith as W.S. 40-12-502 requires. If misuse of that information has occurred or is reasonably likely to occur, we will notify affected Wyoming residents in the most expedient time possible and without unreasonable delay, consistent with measures needed to determine the scope of the incident and restore system integrity, and with any delay requested by law enforcement. Notice will include the content W.S. 40-12-502 requires (including types of information involved, general circumstances, approximate date if reasonably possible, steps taken to protect the system, and advice to remain vigilant). If we maintain data we do not own, we will notify the owner or licensee (typically the school) as the statute requires.

Wyoming does not currently have a comprehensive consumer privacy statute comparable to the California CCPA. If you are a consumer in a state that does (for example California, Colorado, or Virginia), you may have additional rights. Email hello@cohortbay.com and we will honor legally required requests, coordinating with your school when the data is education records.

8. Cookies and similar technologies

We use essential cookies and similar storage to keep sessions authenticated (including after Google sign-in) and to remember display preferences. We do not use third-party advertising cookies on the marketing site as of the effective date. Blocking essential cookies will prevent sign-in.

9. Retention and security

We retain account and school data for as long as the school’s subscription is active and as needed for legal, security, and backup purposes afterward, unless the contract or a lawful deletion request requires earlier deletion. Schools may export or request deletion of workspace data subject to backups and legal holds.

We use administrative, technical, and physical safeguards appropriate to the nature of the data, including encryption in transit, access controls, and row-level separation among schools. No method of transmission or storage is 100% secure.

10. Your choices

  • School admins can manage users, roles, and most records in the dashboard.
  • You may disconnect Google access in your Google account settings; you can still use email sign-in if the school enabled it.
  • Email hello@cohortbay.com to access, correct, or delete personal information we hold as a business (for example a school admin’s billing contact). Student record requests go to the school first.

11. International visitors

The Service is built for U.S. schools. If you access it from outside the United States, you understand that we process information in the United States, where laws may differ from those in your country.

12. Changes

We may update this policy. We will change the effective date above and, for material changes, notify school admins by email or in-product notice. Continued use after the effective date means you accept the updated policy, except where law requires additional consent.

13. Contact

Privacy questions: hello@cohortbay.com

Related terms of service: /terms