FERPA at Ruberis

• Students don’t need accounts; no email or password collected.
• Teachers control what student identifier appears in Ruberis — often just a name or student ID.
• Student submissions are readable only by the teacher who created the assignment.
• Ruberis will sign a DPA with schools and districts.
• Parents can request access, corrections, or deletion through the school, and we’ll support the school’s response.

When a school contracts with Ruberis to provide grading services to its teachers, Ruberis acts as a “school official” with a legitimate educational interest in the student records it processes (34 CFR § 99.31(a)(1)). We only use student records for the educational services we were contracted to provide.

Ruberis is designed to collect as little PII as possible. For student submissions we store the essay, a display identifier chosen by the teacher, and the feedback history. We do not collect student date of birth, home address, phone number, or demographic data. If a teacher chooses to enter additional identifying fields, those fields live only in that teacher’s class.

The essays students submit to Ruberis are education records under FERPA. They are not directory information and are not published or shared outside the class they were submitted to.

Student records in Ruberis are protected by Postgres row-level security: only the assigning teacher can read or modify them. Administrative access by Ruberis staff is restricted to support cases the school has opened and is logged to an internal audit trail.

Teachers can delete student submissions at any time. When a teacher closes their account or a school ends its subscription, we delete or anonymize student submissions within 30 days. If your school needs a specific retention schedule, include it in the DPA and we’ll honor it.

We do not sell student data. We share it only with the sub-processors we need to run the service (Supabase, Anthropic, Railway, Stripe), each under contractual obligations that mirror FERPA’s requirements on us. Our sub-processor list is available on the Privacy page.

Under FERPA, the school is the controller of a student’s education records. When a parent or eligible student requests access, correction, or deletion, the request goes through the school. Ruberis will provide the records or make the changes promptly once the school directs us.

Ruberis will sign a Data Processing Agreement that mirrors the common FERPA addendum language used by US districts. Email send us a message and we’ll send ours over, or we’ll sign yours.

FERPA or privacy questions? Email send us a message.