Privacy Policy
1. Introduction
Frame ("we," "our," or "us") is a film course management platform designed for educational institutions. This Privacy Policy explains how we collect, use, and protect information about students, teachers, and parents who use Frame.
We are committed to protecting the privacy of students and complying with applicable education privacy laws, including the Family Educational Rights and Privacy Act (FERPA) in the United States and the General Data Protection Regulation (GDPR) where applicable.
2. Information We Collect
We collect only the information necessary to provide our educational services:
Account Information: Name and email address, obtained through Google Sign-In. We do not store passwords.
Educational Records: Lesson responses and journal entries written by students, video and photo submission links (stored on Google Drive, not on our servers), activity responses and quiz results, and teacher grades and rubric scores.
Usage Data: Which lessons have been viewed and completed, submission timestamps, and teacher comments on student work.
We do not collect Social Security numbers, government IDs, financial information, health information, or precise location data.
3. How We Use Information
We use the information we collect solely to:
Provide the Frame platform and its educational features, allow teachers to track student progress and provide feedback, enable students to access their lessons and submit their work, and improve the reliability and performance of our service.
We do not sell student data. We do not use student data for advertising. We do not share student data with third parties except as described in this policy.
4. Data Storage and Security
Student data is stored securely using Supabase, a SOC 2 compliant database provider with servers located in the United States. All data is encrypted in transit using TLS and encrypted at rest.
Access to student data is controlled through Row Level Security policies — students can only access their own records, and teachers can only access records within their own institution.
We implement rate limiting to prevent unauthorized access attempts and maintain an audit log of significant data changes.
5. FERPA Compliance
For schools subject to FERPA, Frame operates as a "school official" with a legitimate educational interest in student records, as permitted under 34 CFR § 99.31(a)(1). We use student education records only to provide the Frame service to the school and do not disclose those records to third parties without appropriate consent or a lawful exception.
Schools retain ownership and control of all student education records stored in Frame. Upon request, we will provide schools with access to their data and will delete student records upon termination of the school's agreement with Frame.
6. GDPR Compliance
For users in the European Economic Area, Frame processes personal data on the legal basis of legitimate interests in providing educational services, and — where required — with the consent of the data subject or their parent or guardian.
Students and parents have the right to access, correct, or delete their personal data. To exercise these rights, contact your school administrator or reach out to us directly.
We do not transfer personal data outside the European Economic Area except where necessary to provide the Frame service and with appropriate safeguards in place.
7. Children's Privacy
Frame is designed for use in educational settings and may be used by students under the age of 13 (in the US) or 16 (in the EU). We collect student data only through schools, which are responsible for obtaining appropriate parental consent where required.
We do not knowingly collect personal information from children outside of the school context without verifiable parental consent.
8. Data Retention
We retain student data for as long as the school maintains an active account with Frame. When a school terminates its account, we will delete all associated student data within 30 days upon written request.
Individual student records can be deleted at any time by the school administrator through the Frame roster management interface.
9. Third-Party Services
Frame uses the following third-party services to operate:
Google OAuth for authentication (governed by Google's Privacy Policy), Supabase for database storage and authentication infrastructure, and Vercel for application hosting and delivery.
Students submit work via Google Drive links. Content stored on Google Drive is governed by Google's Privacy Policy and the school's Google Workspace agreement.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify schools of any material changes by email or through a notice in the Frame platform. Continued use of Frame after such notice constitutes acceptance of the updated policy.
11. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us at:
Frame Education privacy@frame.education
Schools with questions about their data processing agreement should contact their Frame account representative.