FERPA & Student Data

The Family Educational Rights and Privacy Act (FERPA) governs how educational records are handled for students at institutions receiving federal funding. It gives eligible students (and parents of students under 18) the right to inspect, review, and request amendment of educational records, and restricts disclosure of those records without written consent.

When a school or youth orchestra director enrolls students in Orchestra Kingdom through an institutional program, practice data, score reports, and session notes constitute educational records in the context of your program. This page explains how we handle that data and what rights your students and their families have.

Orchestra Kingdom is a service provider acting under the direction of your institution. We do not use or disclose student records for any purpose other than providing the services your program contracted for.

Student performance data is isolated at the program level. Specifically:

• Directors see only the students enrolled in their own programs. Access is enforced by database-level row security: the director dashboard queries use security-definer functions that verify the calling director's identity before returning any rows. A director from one program cannot read data from another.
• Students see only their own practice history and feedback reports. No student can see another student's data.
• Orchestra Kingdom staff access student data only when responding to a support request, investigating a security incident, or when required by law. All staff access is logged.
• Third parties never receive student-identifiable data. Sub-processors (Deepgram for audio analysis, Anthropic for feedback generation) process data transiently and do not retain it. See our Privacy Policy for the full sub-processor list.

The Schools page describes our storage posture as “FERPA-aligned audio storage.” Here is exactly what that means:

• Audio submitted for analysis is sent over TLS to our processing pipeline and converted to acoustic features (pitch, timing, dynamics). The audio is kept for up to 90 days so the student can listen back and download it to study, then automatically deleted.
• Feature data (not raw audio) is passed to Anthropic to generate the written feedback. Anthropic does not retain this data beyond the duration of the request.
• A student's audio is retained only in their own account and is automatically deleted after 90 days. Institutional directors cannot access the raw audio. Students can delete their stored audio at any time.

COPPA (Children's Online Privacy Protection Act) requires verifiable parental consent before collecting personal information from children under 13. For students enrolled through an institutional program, we require one of the following before a minor student can access Judge or Teacher features:

1. Director attestation: the director confirms in their program dashboard that the school has collected signed parental consent for the student, consistent with FERPA school official requirements. This shifts consent accountability to the institution, which already holds parental consent under FERPA for its educational activities.
2. Direct parent consent: for programs where the institution prefers us to collect consent directly, we email the parent a tokenized consent link. The parent attests via the form, and we record the grant with the date, IP, and stated relationship.

In either case, a parental consent record is required before enrollment completes. The database enforces this gate: an insert into the enrollment table will be rejected if no active consent record exists for the student.

Parents may revoke consent at any time by contacting the director or emailing privacy@orchestrakingdom.com. Revocation removes access to Judge and Teacher features for that student within 24 hours. Practice history already recorded is retained until the student's data is deleted per the retention policy below.

For students in institutional programs, FERPA-aligned retention works as follows:

• Active students: practice history, scores, and session notes are retained while the student is enrolled.
• Graduated or departed students: when a director marks a student as graduated, a deletion window opens. One year after the graduation date, that student's program-associated data is eligible for deletion. Directors can request earlier deletion by emailing privacy@orchestrakingdom.com.
• Personal account data: if the student also has an individual Orchestra Kingdom account outside the program, that data is governed by our standard Privacy Policy retention terms, not by the program deletion window.
• Billing and compliance records: retained for 7 years per tax and accounting requirements, then deleted.

Directors may export all program data in machine-readable format at any time. Email privacy@orchestrakingdom.com with the subject "Program data export request."

Under FERPA, eligible students (18 and over, or attending a post-secondary institution) and parents of students under 18 have the right to:

• Inspect and review their educational records held by Orchestra Kingdom
• Request amendment of records they believe are inaccurate
• Consent to disclosure of records to third parties (beyond what FERPA permits without consent)
• File a complaint with the U.S. Department of Education if they believe their rights have been violated

To exercise any of these rights, email privacy@orchestrakingdom.com with the subject "FERPA records request" and include your student's name, program name, and the specific records or action you are requesting. We respond within 10 business days.

Complaints to the Department of Education may be filed with the Family Policy Compliance Office (FPCO) at the U.S. Department of Education, 400 Maryland Avenue SW, Washington, DC 20202-8520.

Institutional partners with formal FERPA obligations may request a Data Processing Agreement (DPA) or FERPA-specific addendum to our Terms of Service. Email legal@orchestrakingdom.com with the subject "DPA request" and your institution name. We will respond within 5 business days.

Student data and FERPA questions: privacy@orchestrakingdom.com. For institutional agreements: legal@orchestrakingdom.com. Orchestra Kingdom LLC, 2900 W Anderson Lane, Ste C 200 PMB 1115, Austin, TX 78757.