Privacy Policy

Last updated: August 12, 2025

At PLS 3rd Learning, we believe that privacy is fundamental to trust. We are committed to protecting the data entrusted to us by educational agencies and their staff.

PLS 3rd Learning (“us”, “we”, or “our”) operates the SuperEval public website at www.supereval.com (the “Public Website”) and the associated service for leadership evaluation (the “Evaluation Platform”) used by educational agencies. This Privacy Policy (the “Policy”) describes how we collect, use, disclose, and protect Public Website Data and Customer Data across the Public Website and Evaluation Platform (collectively, the “Service”).

1. Scope

This Policy applies to information collected through the Service, which includes:

  • Visitors to the Public Website at www.supereval.com
  • Authorized users of the Evaluation Platform provided to educational agencies for leadership evaluation

The Service is not intended for student use and is not designed to collect, process, or store student data.

This Policy does not apply to third-party services that may be linked to or accessed through the Service.

By using the Service, you agree to this Policy.

2. Definitions

“Customer Data” refers to all data submitted to, created within, or collected by the Evaluation Platform on behalf of an educational agency. This includes, but is not limited to, account configurations, evaluation content (such as goals, observations, ratings, and documents), evaluation frameworks, rubrics, and templates). Customer Data may include Personally Identifiable Information (PII) as defined in the Family Educational Rights and Privacy Act (FERPA), 34 CFR § 99.3, to the extent such information is entered into the Evaluation Platform. Customer Data is subject to the protections and restrictions described in this Policy and in applicable agreements with educational agencies.

“Public Website Data” refers to all information collected through the Public Website or other non-Platform channels, such as demo requests or general inquiries. This may include names, work email addresses, phone numbers, job titles, organization names, IP addresses, and the contents of messages or requests. Public Website Data does not include Customer Data or any FERPA-protected Personally Identifiable Information (PII), both of which are handled solely as Customer Data under this Policy.

3. Information We Collect

a. Customer Data on the Evaluation Platform
We collect the following types of Customer Data on behalf of educational agencies:

  • Account Setup Information: Names, email addresses, job titles, and role assignments (such as evaluator, assistant, or view-only), as provided by the educational agency.
  • Evaluation Content: Goals, observations, documents, ratings, comments, and other inputs provided during evaluations.
  • Configuration Settings: Evaluation frameworks, rubrics, and goal templates, as provided by the educational agency.
  • Audit and Activity Logs: Login times, IP addresses, and records of actions taken, which help us support, secure, and monitor the Evaluation Platform.
  • Support Communications: Information submitted through help desk requests or feedback forms.
  • Session Cookies: Essential cookies are used to manage user sessions, maintain login state, and ensure secure access. These cookies are required for the Evaluation Platform to function and cannot be disabled.

Note: The examples of data above are illustrative and reflect common use of the Evaluation Platform. If we introduce categories of Customer Data that materially differ from these examples, we will update this Policy and notify educational agencies in writing of the change.

We do not use analytics tools on the Evaluation Platform, including Google Analytics. User activity is internally logged solely for operational support, security, and audit purposes. This data is not shared with third parties.

b. Public Website Data
When you use the Public Website, we may collect:

  • Inquiry Data: Names, email addresses, organizations, and the contents of any messages or requests sent to us.
  • Analytics: We use tools such as Google Analytics on the Public Website to collect information such as browser types, referring URLs, time spent on pages, and general site interactions. Google Analytics is configured to minimize identifiers and prevent data sharing with other Google products.
  • Cookies and Tracking: Data generated through the use of cookies and similar technologies on the Public Website to support the analytics described above and to enable limited interaction tracking, provided by third-party services such as customer relationship platforms and spam-prevention tools. We do not use cookies for cross-site tracking, targeted advertising, or to build profiles for marketing purposes. Most features remain accessible without these cookies. You can manage your cookie preferences through your browser settings.
  • Additional Voluntary Information: Such as roles, the type or size of educational agencies, or other information provided voluntarily.

4. How We Use Information

a. Customer Data
We use Customer Data collected through the Evaluation Platform for the following purposes:

  • To provide, operate, support, and maintain the Evaluation Platform
  • To support evaluation workflows
  • To monitor system activity for performance, security, and audit purposes
  • To comply with legal, regulatory, or contractual obligations

We may also use aggregated and de-identified data to improve our services and support internal research. Such data will meet applicable legal standards for deidentification under U.S. privacy laws and will not be used to target, profile, or re-identify any individual.

b. Public Website Data
We use Public Website Data to respond to requests, provide support, maintain communications, and evaluate interest in our services.

Individuals may request access, correction, or deletion of their Public Website Data by contacting privacy@supereval.com. For data collected through the Evaluation Platform, educational agencies retain full control, and users should contact their agency directly.

5. Data Ownership and Processing Responsibilities

a. Customer Data
For Customer Data collected through the Evaluation Platform, PLS 3rd Learning acts as the service provider to the educational agency. The educational agency retains full ownership and control of all Customer Data and determines its use. We will process such data solely to provide and support the Evaluation Platform, and in accordance with the written instructions of the educational agency and applicable U.S. federal and state privacy laws.

b. Public Website Data
For Public Website Data, PLS 3rd Learning determines the purposes for which and the manner in which the information is used and is directly responsible for complying with applicable U.S. privacy laws in relation to that information.

6. Education Privacy Compliance

We support the privacy and security obligations of educational agencies by maintaining strong data handling practices, entering into required agreements, and providing transparency around our systems and controls.

  • State Education Privacy Laws: We comply with applicable U.S. state education data privacy laws, including but not limited to NYS Ed Law § 2-d and similar statutes in other jurisdictions. We enter into Data Protection Agreements (DPAs) or equivalent agreements as necessary to meet legal and contractual requirements.
  • FERPA: Although the Evaluation Platform is not intended to process student data, we recognize that educational agencies are subject to the Family Educational Rights and Privacy Act (FERPA). We support their compliance by limiting how data is accessed and used, offering contractual protections, and implementing safeguards aligned with education-sector expectations.
  • COPPA: The Evaluation Platform is not directed to children under 13. We do not knowingly collect information from children.

If you have specific compliance requirements or need a signed agreement, please contact us at dpa@supereval.com.

Student Data Disclaimer
The Evaluation Platform is not intended to collect, process, or store student data. Educational agencies are responsible for ensuring that such data is not entered into the Evaluation Platform. If student data is submitted in error, it remains protected under the same security and access controls that apply to all Customer Data. Upon request from the educational agency, we will delete any such data in accordance with our standard data handling procedures and will provide written confirmation to the educational agency upon completion of data removal.

7. Security Standards

We maintain a security program aligned with the NIST Cybersecurity Framework (CSF) version 1.1 and are committed to adopting relevant improvements introduced in CSF 2.0 and later versions as they become applicable to our operations. This program is designed to meet the operational and regulatory needs of educational agencies and to safeguard data processed through the Evaluation Platform. Key components of our security program include:

  • Encryption: All data is encrypted in transit (TLS 1.2 or higher) and at rest (AES256). Encryption keys are managed and controlled by us in AWS Key Management Service (KMS) and rotated regularly.
  • Access Controls: Role-based, least-privilege access controls and multi-factor authentication are enforced for administrator access to our systems.
  • System Monitoring: Audit logs and security events are collected and monitored through centralized logging and endpoint detection tools.
  • Vulnerability Management: We perform regular vulnerability scans across our infrastructure and promptly remediate identified issues.
  • Incident Response: We maintain a documented incident response plan. In the event of a breach, we will notify affected educational agencies without unreasonable delay, in accordance with applicable laws and contractual obligations.
  • Third-Party Risk Management: We conduct annual reviews and risk-based assessments of third-party service providers.
  • Internal Safeguards: Employees with access to Public Website Data or Customer Data complete regular security training and undergo periodic access reviews.

Our infrastructure is hosted in AWS GovCloud (US), a FedRAMP-authorized environment that provides strong baseline protections for sensitive data. All physical security controls are managed by AWS in accordance with their security and compliance standards. While no system can guarantee absolute security, we continually evaluate and improve our controls to reduce risk and protect data entrusted to us.

8. Data Retention and Disposal

a. Customer Data
We retain Customer Data only as long as necessary to:

  • Provide the Evaluation Platform and related services to educational agencies
  • Meet legal, regulatory, or contractual obligations

Upon termination of an educational agency’s contract, all active Evaluation Platform data is deleted within 30 days unless otherwise required by law or agreed in writing. Upon request, we will provide written confirmation of destruction.

Encrypted backups of that data may persist temporarily in our systems beyond the 30 day window. These backups are deleted in accordance with our data lifecycle policies and are never used for active processing.

Educational agencies may also request data deletion at any time, subject to any legal or contractual requirements that require retention.

b. Public Website Data
We retain Public Website Data collected through the Public Website or related channels, such as demo requests, support inquiries, or marketing communications, only as long as necessary to fulfill the purposes for which it was collected. These purposes may include responding to requests, maintaining business relationships, or fulfilling legal or compliance obligations.

Retention periods may vary depending on the type of Public Website Data, the applicable laws, and the systems in which the data resides. We periodically review our retention practices and delete or anonymize Public Website Data when it is no longer needed.

9. Data Sharing and Disclosure

a. Customer Data
We use Customer Data only to provide and support the Evaluation Platform. We do not sell, share, or otherwise disclose Customer Data to third parties for their own use. Access is limited to authorized users within the educational agency and to authorized PLS 3rd Learning personnel with a legitimate need to operate or maintain the Evaluation Platform.

All Customer Data is stored and processed exclusively within AWS GovCloud (US), our infrastructure provider. AWS acts as a subcontractor under our control. While AWS hosts the data, it does not access or use Customer Data, and encryption keys remain managed by PLS 3rd Learning.

We use Zendesk to manage support requests. If an authorized user enters Customer Data into a support ticket, Zendesk may act as our subcontractor for that limited purpose only, processing the information under contractual safeguards. Users should avoid including sensitive evaluation content in support tickets whenever possible.

Customer Data is never shared with analytics providers, customer relationship platforms, marketing services, or any other third parties not directly involved in Evaluation Platform operations. The subcontractors named in this Policy are the only subcontractors currently authorized to process Customer Data, whether on an ongoing basis or in limited circumstances such as when Customer Data is voluntarily included in a support request. We update this Policy periodically to reflect changes in subcontracting relationships.

b. Public Website Data
We collect Public Website Data only as needed to fulfill requests, respond to inquiries, or maintain communications. We do not sell Public Website Data or use it for advertising, behavioral tracking, or any unrelated purpose.

We may share Public Website Data with trusted service providers, such as customer relationship platforms (e.g., HubSpot), support tools (e.g., Zendesk), and analytics providers (e.g., Google Analytics), strictly to the extent necessary to perform services on our behalf. We minimize the data shared, restrict access where possible, and select providers with strong reputations for privacy and security. Google Analytics is configured to minimize identifiers and prevent data sharing with other Google products.

A current list of these service providers is available upon request by emailing privacy@supereval.com.

c. Legal Disclosures
We may disclose Customer Data or Public Website Data when required by law, regulation, or legal process, such as a subpoena or request from a regulatory authority.

Such disclosures are rare and not part of our standard operations. When legally permitted and feasible, we will notify the relevant educational agency in advance. If we are prohibited from providing advance notice, we will notify the agency once the restriction is lifted.

10. Data Residency

All Evaluation Platform data is stored and processed exclusively in the United States, within secure environments hosted in AWS GovCloud (US). AWS GovCloud supports compliance with U.S. government and education-sector data protection requirements.

We do not use offshore storage, processing, or support services for Evaluation Platform data. Customers may access the Evaluation Platform from outside the U.S., but all data remains securely hosted and managed within the U.S. at all times.

11. Communications

We may send service-related communications as part of our contractual relationship with educational agencies. These include essential messages such as account notices, security alerts, and system updates.

You may opt out of non-essential communications, such as newsletters or product announcements, by using the unsubscribe link in any message or by contacting privacy@supereval.com. We honor opt-out requests within five business days.

Opting out of non-essential communications does not affect your ability to receive service-related messages necessary to operate your account or fulfill contractual obligations.

12. Business Transfers

If PLS 3rd Learning is involved in a merger, acquisition, restructuring, or other transfer of assets, Customer Data and Public Website Data may be transferred to the successor entity. The successor will be bound by the same contractual and privacy obligations set out in this Policy.

If such a transfer results in a material change to this Policy, we will provide advance notice to affected educational agencies in writing and through the Evaluation Platform or the Public Website.

13. Changes to This Policy

We may make changes to this Policy from time to time. If a material change occurs, we will provide notice through the Evaluation Platform or the Public Website.

The latest version will always be available on the Public Website with the effective date clearly indicated. Continued use of the Platform after an update constitutes acceptance of the revised Policy.

14. Contact Us

We welcome your questions or feedback about our privacy practices and are committed to maintaining the highest standards of data protection.

PLS 3rd Learning
678 Main Street
Buffalo, NY 14202
Email: privacy@supereval.com