Privacy & Compliance

1. Information We Collect

Depending on how TripDirector is used, information may include:

Account and organization information

• Name
• Email address
• Login and authentication information
• School, organization, or performing arts program information

Student and trip information

• Student names
• Grade or age
• School or program affiliation
• Trip participation information
• Emergency contact information
• Payment and balance records
• Trip expenses and financial records
• Itineraries and schedules
• Uploaded documents
• Other information entered by an authorized user for purposes related to the services

TripDirector does not require Social Security numbers, government identification numbers, biometric information, or similarly sensitive identifiers for ordinary use of the service.

Technical information

We may automatically collect limited technical information necessary to operate, secure, and improve the service, such as browser and device information, IP address, authentication records, error information, and security or activity logs.

2. How We Use Information

TripDirector uses information only as reasonably necessary to provide, maintain, secure, and support the services.

This may include:

• Managing student rosters and participation
• Tracking payments and balances
• Managing trip expenses
• Creating estimates and reports
• Building and managing itineraries
• Storing and organizing uploaded documents
• Providing customer support
• Maintaining account security
• Detecting, preventing, and investigating misuse or unauthorized activity
• Maintaining and improving the reliability and performance of the service

We do not sell student information.

We do not use student information for targeted or behavioral advertising.

We do not create commercial profiles of students based on their use of TripDirector.

We do not use student information for purposes unrelated to the educational or administrative services for which the school or organization has authorized TripDirector to process the information.

3. School and Student Data

When TripDirector is used by a school or educational organization, the school or organization determines what information is entered into the service and the purposes for which that information is used.

The school or organization retains control over its student and education-related information. TripDirector processes that information on behalf of the school or organization and only for authorized purposes related to providing the services.

Schools and organizations are responsible for determining what information is appropriate to enter into TripDirector and for configuring and using the service in accordance with applicable laws, policies, and agreements.

Additional information regarding student education records and FERPA is provided in our FERPA & Student Education Records section.

4. Sharing of Information

TripDirector does not sell student information or share it with third parties for targeted advertising or commercial profiling.

We may share information with service providers and technology providers that help us operate, secure, maintain, and support TripDirector. These providers are permitted to process information only as necessary to provide their services to us and subject to applicable contractual and privacy requirements.

TripDirector is hosted on infrastructure provided by Base44. Base44 and its applicable subprocessors may process information as necessary to provide the underlying hosting, storage, security, communications, and related services.

We may also disclose information when required by law, legal process, or governmental authority, or when reasonably necessary to protect the security, rights, or safety of TripDirector, our users, or others.

5. Security

TripDirector uses reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, use, alteration, disclosure, or destruction.

These measures include, as applicable:

• Encryption of data in transit and at rest
• Authentication and access controls
• Application-level permissions
• Row-level security controls
• Private storage for uploaded documents
• Security monitoring and logging
• Measures designed to limit access to authorized personnel and systems

TripDirector is hosted using Base44 infrastructure, which provides additional platform-level security controls and maintains SOC 2 Type II and ISO 27001 certifications.

No method of electronic storage or transmission can be guaranteed to be completely secure. We continually evaluate and improve our security practices as the service develops.

6. Children's Privacy

TripDirector is designed for use by adults, schools, teachers, directors, and educational organizations to manage administrative information.

Students do not need to create individual TripDirector accounts to use the core administrative functions of the service.

When a school or educational organization uses TripDirector to manage information about children, including children under 13, the school or organization is responsible for authorizing that use and determining the information necessary for its educational or administrative purposes.

TripDirector does not use children's information for targeted advertising or unrelated commercial purposes.

7. Data Retention and Deletion

TripDirector retains information for as long as reasonably necessary to provide the services, comply with applicable legal obligations, resolve disputes, maintain security, and fulfill the purposes for which the information was collected.

Schools and organizations may request deletion of their information, subject to applicable legal, contractual, and operational requirements.

Within TripDirector, deleted records may remain recoverable for a limited period before permanent deletion. Certain backup copies may also remain for a limited period in accordance with the policies and practices of our underlying service providers.

When a school or organization terminates its use of TripDirector, data deletion and return will be handled in accordance with the applicable agreement and applicable law.

8. Access, Correction, and Export

Authorized school and organization users may access and manage information within their TripDirector account based on the permissions provided to them.

Schools and organizations may request assistance with accessing, correcting, exporting, or deleting their information, subject to applicable law and the terms of the applicable agreement.

TripDirector provides data export capabilities for applicable records.

9. Uploaded Documents

TripDirector may allow authorized users to upload documents related to students, trips, payments, or other administrative activities.

Users should upload only information that is reasonably necessary for the intended purpose.

Uploaded documents are stored using private storage mechanisms and are not made publicly available through TripDirector.

10. De-Identified and Aggregated Information

TripDirector may use information that has been de-identified or aggregated so that it is no longer reasonably associated with an identifiable individual for purposes such as understanding service performance, usage trends, reliability, and improving the service.

TripDirector will not use de-identified or aggregated information to attempt to re-identify individuals except where reasonably necessary for security, fraud prevention, legal compliance, or other legitimate purposes.

11. Service Providers and Subprocessors

TripDirector relies on third-party technology and infrastructure providers to operate the service.

Our primary application hosting provider is Base44. Base44 maintains its own privacy and data processing documentation, including information regarding its subprocessors and security practices.

TripDirector will take reasonable steps to ensure that service providers processing school or student information are subject to appropriate contractual and privacy protections.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time as TripDirector develops or as applicable laws and requirements change.

When we make material changes, we will update the “Last Updated” date and provide additional notice when appropriate.

13. Contact Us

If you have questions about this Privacy Policy, student data, privacy practices, or data protection agreements, please contact TripDirector through the contact information provided on our website.