Student Data Privacy

1.What Staje is

Staje is a production-management platform for theater programs. Directors use it to run auditions, cast lists, rehearsal schedules, announcements, recordings, and ticket sales. Students use it to see their schedule, receive notes, talk with their cast, and practice lines. Each program’s staff control who can join it. A student only sees a program’s content after a director invites them, gives them one of the program’s access codes (which can be set to expire or to limit how many people use them), or approves their request to join.

2.What we collect from students, and who can see it

We also keep standard server logs (IP address, browser type) for security, which we hold for 90 days, and device push tokens so notifications reach the student’s phone.

3.What we never do

• Show ads, or sell or rent student data
• Build advertising profiles or share data with ad networks
• Send marketing to students. Every email we send is about their program, such as rehearsal reminders, call times and announcements
• Let students under 13 sign themselves up
• Record, upload, or keep the audio of a student practicing lines
• Use student data to train AI models

4.Students under 13 (COPPA)

• Sign-up asks for a birth date. If the student is under 13, we stop and create no account. A parent or guardian creates the child’s account from their own Staje account (the Family settings).
• The guardian stays linked to the child’s account. They can see the child’s schedule, buy tickets, approve or decline publishing a public highlight reel, and remove the child’s account.
• A child under 13 can’t publish a public reel without their guardian’s approval.
• For under-13s, Run Lines never turns on the microphone or speech recognition. They practice by rating their own lines.
• Where a school directs students’ use of Staje, the school can give consent on parents’ behalf for this educational use, as FTC guidance permits for school-authorized services. We use that information only to provide the service to the school.

5.Students 13–17

• Profiles start private and hidden from public discovery. A student has to change those settings themselves.
• A highlight reel a teen publishes is unlisted: only people they share the link with can see it. It only appears in public discovery if the student opts in.
• Anyone can block or report another user. Reports go to Staje for review.

6.FERPA and school control

When a school uses Staje, we act as a service provider under the school’s direction (the FERPA “school official” model). Student information is used only to provide Staje to that school’s program. It is shared only with the subprocessors listed below, and only to run the service. It is never shared for anyone else’s purposes. Directors control who joins the program, each member’s role and permissions, who can see each recording, and when a cast list is published. Schools and parents can ask for a student’s records to be exported, corrected, or deleted by emailing privacy@staje.app.

7.AI and Run Lines (voice)

• When a director uploads a script, Staje uses Microsoft Azure OpenAI to identify its characters, songs, scenes, and lines. Under Microsoft’s terms for this service, the data isn’t used to train AI models. The parsed lines are visible only to members of the program that uploaded the script.
• In Run Lines, students can speak their lines and get them checked. The speech recognition built into their phone or browser (Apple, Google, or Microsoft) handles the voice, on the device where that’s supported. Staje never receives, records, or stores the audio, and the text of what they said stays on their device.
• Staje stores only practice results: the score, number of attempts, best score, streak, and when they last practiced. Using the microphone is optional for every student.

8.Where data lives, and security

• Data is hosted in the United States on Microsoft Azure.
• All traffic is encrypted in transit (TLS), and data is encrypted at rest. Passwords are stored as one-way bcrypt hashes. Password-reset and verification tokens are stored hashed, and resetting a password signs out every session.
• Access is role-based: staff, cast, crew, guests, and guardians each see only what their role allows.
• Report a security concern to security@staje.app.

9.Retention and deletion

• Any user can delete their account in the app or at staje.app/delete-account. A guardian can remove their child’s account.
• A deleted account is turned off immediately: all sessions are signed out and notifications stop. After 30 days it’s permanently erased, including the profile photos, clips, and reels it owns. The 30 days give people time to recover an account deleted by mistake.
• A school can ask for faster deletion, or for deletion of a whole program’s student data at the end of an agreement, at privacy@staje.app. Financial records, such as ticket purchases, are kept as tax law requires.

10.Subprocessors

The iOS and Android apps contain no third-party analytics or advertising SDKs. Apple’s or Google’s on-device speech service is used only when a student turns on listening in Run Lines.

11.Data privacy agreements

We work with districts on their data privacy agreements, including state agreements based on the Student Data Privacy Consortium (SDPC) model. Email your agreement or questionnaire to privacy@staje.app and we’ll respond within five business days.